Towards a Baltic Sea Region Strategy in Critical ... - Helsinki.fi

CRITICAL INFRASTRUCTURE PROTECTION IN THE BALTIC SEA REGION
threats to the nation’s critical infrastructures; recommend a comprehensive
national policy and implementation plan for protecting critical infrastructures;
determine legal and policy issues raised by proposals to increase protections; and
propose statutory and regulatory changes necessary to effect recommendations.
The PCCIP concluded in 1997 that advanced societies rely heavily upon critical
infrastructures, which are susceptible to physical disruptions and to new virtual
threats. The security, economy, way of life, and perhaps even the survival of the
industrialized world are dependent on the combination of electrical energy,
communications and computers. These recommendations led to “Presidential
Decision Directive 63” on Critical Infrastructure Protection in 1998, which
established lines of responsibility within the federal government for protecting
each of the infrastructure elements and for formulating an R&D strategy for
improving the surety of the infrastructure. Some other events, such as ‘Y2K’ added
to the perceived importance to develop a national CIP strategy. (PCCIP 1997; PDD
1998; see also Abele-Wigert and Dunn 2006, pp. 26-27; Moteff 2003; Hagelstam
2005; Fritzon et al. 2007, p. 31)
Naturally, the 9/11 attacks in the United States considerably reinforced these
CIP efforts. The Department of Homeland Security (DHS) was established and in
2003 President George W. Bush released the “Homeland Security Presidential
Directive/HSPD-7” that established a national policy for federal departments and
agencies to identify and prioritise CI and key resources (KR) and protect them
from terrorist attack. The following year the White House released two
presidential national strategies: the “National Strategy to Cyber Security” (NSCS
2003) and the “National Strategy for Physical Protection of Critical Infrastructure
and Key Assets” (NSPPCI/KA 2003). These were follow-up documents to the
“National Strategy for Homeland Security” (NSHS 2002), which was released in
July 2002 as a reaction to the 9/11. In 2006 the DHS released a new “National
Infrastructure Protection Plan” (NIPP 2006) to outline roles and responsibilities
for specific government and local agencies, and the private sector. (Abele-Wigert
and Dunn 2006, pp. 315-319)
The emergence of the EPCIP
The origins of the EPCIP are similarly clearly connected to the threat of terrorism.
The wider European CIP debate started in the aftermath of 9/11, followed by much
more rapid development especially after the 2004 Madrid train bombs and the
London bomb attacks in 2005. True, there can be found CIP-related EU
documents, legislation and pre-legislative proposals already before the issue of
terrorism had become the priority, especially in the field of Information and
Communication Technology (ICT). 4
However, the Madrid train bombing led the European Council to ask the
Commission to prepare an overall strategy to protect CI. The Commission
consequently adopted in October 2004 a Communication “Critical Infrastructure
Protection in the Fight Against Terrorism” (Commission 2004), which made
4 These include, inter alia, the Commission Communication “Creating a Safer Information Society
by Improving the Security of Information Infrastructures and Combating Computer-related Crime”
(Commission 2000), which reflects the growing interest in cyber security issues in particular.
4 NORDREGIO REPORT 2007:5