European Commission calls for greater role over protection of critical infrastructure

The European Commission on Tuesday proposed giving itself a greater support and coordination role to enhance the bloc’s preparedness and response against threats to its critical infrastructure.

In new recommendations unveiled from Brussels, the EU’s executive stressed that European critical infrastructure including pipelines, transport ways, or undersea cables is increasingly more interconnected and interdependent, which makes it more efficient but also more vulnerable to incidents or attacks.

It argued therefore that the EU has “a particular role to play” when it comes to cross-border infrastructures and services and called for member states to accelerate the application of new rules to enhance protection and resilience. 

Since 2008, the EU has had in place the Critical Infrastructure Directive, and earlier this year, the bloc’s institutions reached a political agreement on new rules with a wider scope.

The updated critical infrastructure directive will cover 11 risk areas, including natural hazards, terrorist attacks, insider threats, and sabotage, but also public health emergencies like the recent COVID-19 pandemic.

The new rules will come into force in 2024, but both the European Commission chief Ursula von der Leyen and her Home Affairs Commissioner, Ylva Johansson, have urged countries to apply them sooner after a series of suspected sabotage acts on Nord Stream pipelines and German rail network. 

Union Civil Protection Mechanism to step in

In its latest communication, which von der Leyen will present to EU leaders later this week at their regular Council summit, the Commission envisages that the Union Civil Protection Mechanism — which coordinates rescue and humanitarian assistance in the event of natural and man-made disasters such as floods, forest fires and wars — could step in to strengthen the capacity for “early warning and response to disruptions of critical infrastructure”.

The mechanism could be triggered by an EU country in case of an “overwhelming disruption” to the operations of a critical entity with the Brussels-based Emergency Response Coordination Centre (ERCC) then able to coordinate and co-finance the deployment of essential equipment, materials and expertise available in other member states.

“Assistance that can be made available upon request includes, for example, fuel, generators, electricity infrastructure, shelter capacity, water purification capacity, and emergency medical capacities,” according to the recommendations. 

Finally, it called for a new Task Force to be set up with NATO allies as part of its call for stronger cooperation with key partners and neighbouring countries as much of the infrastructure travel through neighbouring land or maritime territories.

For instance, more than 99% of international internet and telephone traffic passes through submarine telecommunication cables. About 20 such cables link North America and Europe through the Atlantic whose sheer size makes it impossible to ensure round-the-clock surveillance.

Climate and stress tests

Although the war in Ukraine has underlined the need for the bloc to focus on security-related risks and threats to critical infrastructure, the recommendations also emphasise that there is also a “pressing need” to pay increased attention to how climate change is also impacting key infrastructure and services.

A severe drought this summer, believed to be the worst Europe has experienced in 500 years, led to a drop in hydropower generation while repeated intense heatwaves forced the closure of nuclear reactors over safety and environmental concerns.

Finally, the Commission reiterated calls for EU states to conduct stress tests on entities operating critical infrastructure with priority to be given to key sectors of energy, digital infrastructure, transport and space.

It said that this should result in the development of a “blueprint on critical infrastructure incidents and crises” that will outline the modes of cooperation between member states and EU institutions or agencies in responding to incidents, in particular in case of disruption.