Towards a Baltic Sea Region Strategy in Critical ... - Helsinki.fi

CRITICAL INFRASTRUCTURE PROTECTION IN THE BALTIC SEA REGION
As in the Green Paper, the Directive requires the establishment of the
Operator Security Plans (OSP) which aim is to identify the ECI owners’ and
operators’ assets and establish relevant security solutions for their protection. In
addition, the OSP should include a risk analysis based on major threat scenarios,
vulnerability assessment based on common methodologies as well as
identification, selection and prioritisation of counter-measures and procedures
divided between permanent (such security measures which cannot be installed at
short notice) and graduated security measures (activated based on the prevailing
risk and threat level). It is up to the Security Liaison Officer (SLO), appointed by
ECI owners/operators, to function as the contact point in providing all the relevant
security information between the ECI and the member state authority. The CIP
Contact Point instead coordinates the information between the Commission, the
Member State itself and other Member States. In all information exchange and
sharing confidentiality is regarded as crucial.
While it might be said that the EPCIP is a typical technocratic and
bureaucratic – if not top-down – approach to face common problems, as a whole
the Directive Proposal seems to have found an acceptable compromise between the
needs of multilateral or even supranational cooperation and coordination and the
national governments’ defensive reactions against the threats to their autonomy
and sovereignty in a field that traditionally has been regarded as their sole legal
responsibility. True, in reality several multilateral and EU regulations and
coordination issues have a long time have to been taken into account in national
CIP efforts.
The Commission has prepared the implementation strategy for the Directive
by proposing a EPCIP Action Plan, which would consists of three ‘workstreams’,
much along to the lines proposed in the above-mentioned ‘Non-Paper’, defined as
loss and/or degradation of products or services); 3) Environmental effect; 4) Political effects; 5)
Psychological effects; 6) and Public health consequences. Each Member State then identifies those
infrastructures which satisfy the criteria and notifies the Commission. (Commission 2006a) The
‘criticality’, in turn, is a widely discussed and somewhat flexible concept, as already seen when
reviewing the different definitions of CI. The International Risk Governance Council (IRGC), for
instance, states that criticality of infrastructures depends on several factors as well as on
perception of the individuals. Moreover, governments have different priorities and criteria for
classifying infrastructures that can be different than the priorities of individuals. Thus, the IRGC
(2005) has suggested three factors which determine the degree of criticality: 1) Scope – extent of
the population and geographic area covered; 2) Magnitude – potential impact or loss (public
health, economic, environmental) of supply; 3) and Time-effect – additional damage caused by
extended duration of serious impact. ‘Risk assessment’, in turn, has been defined (Risk assessment
and prioritization 2003; see also Moteff 2004, p. 3) as a systematic, analytical process to identify
hazards, establish their likelihood, and assess potential severity of a successful attack on some
element of the system. It involves the integration of threat, vulnerability, and consequence
information. They are necessary for selection and implementation of actions to reduce the risk
associated with existing or anticipated threats. From the perspective of deliberate threats, risk
assessment should include three basic components: 1) assessment of the threat environment
(likelihood for an attack); 2) vulnerability of the system (likelihood that an attack will be
successful); 3) and the criticality and magnitude of the possible consequences (impact of a
successful attack). It is important that risk assessment is iterative and periodically updated to
determine how risks change based on implementation of safeguards and countermeasures. Many
models and methodologies have been developed by which threats, vulnerabilities, and risks are
integrated and then used to inform the cost effective allocation of resources to reduce those risks.
44 NORDREGIO REPORT 2007:5