Protecting Europe Against Large-Scale Cyber-Attacks
Total Page:16
File Type:pdf, Size:1020Kb
HOUSE OF LORDS European Union Committee 5th Report of Session 2009–10 Protecting Europe against large-scale cyber-attacks Report with Evidence Ordered to be printed 9 March 2010 and published 18 March 2010 Published by the Authority of the House of Lords London : The Stationery Office Limited £price HL Paper 68 The European Union Committee The European Union Committee of the House of Lords considers EU documents and other matters relating to the EU in advance of decisions being taken on them in Brussels. It does this in order to influence the Government’s position in negotiations, and to hold them to account for their actions at EU level. The Government are required to deposit EU documents in Parliament, and to produce within two weeks an Explanatory Memorandum setting out the implications for the UK. The Committee examines these documents, and ‘holds under scrutiny’ any about which it has concerns, entering into correspondence with the relevant Minister until satisfied. Letters must be answered within two weeks. Under the ‘scrutiny reserve resolution’, the Government may not agree in the EU Council of Ministers to any proposal still held under scrutiny; reasons must be given for any breach. The Committee also conducts inquiries and makes reports. The Government are required to respond in writing to a report’s recommendations within two months of publication. If the report is for debate, then there is a debate in the House of Lords, which a Minister attends and responds to. The Committee has seven Sub-Committees which are: Economic and Financial Affairs and International Trade (Sub-Committee A) Internal Market (Sub-Committee B) Foreign Affairs, Defence and Development Policy (Sub-Committee C) Environment and Agriculture (Sub-Committee D) Law and Institutions (Sub-Committee E) Home Affairs (Sub-Committee F) Social Policy and Consumer Affairs (Sub-Committee G) Our Membership The Members of the European Union Committee are: Lord Bowness Lord Kerr of Kinlochard Lord Carter of Coles Lord Paul Baroness Cohen of Pimlico Lord Plumb Lord Dear Lord Powell of Bayswater Lord Dykes Lord Richard Lord Freeman Lord Roper (Chairman) Lord Hannay of Chiswick Lord Sewel Baroness Howarth of Breckland Baroness Sharp of Guildford Lord Jopling Lord Teverson The Members of the Sub-Committee which conducted this inquiry are listed in Appendix 1. Information about the Committee The reports and evidence of the Committee are published by and available from The Stationery Office. For information freely available on the web, our homepage is http://www.parliament.uk/hleu There you will find many of our publications, along with press notices, details of membership and forthcoming meetings, and other information about the ongoing work of the Committee and its Sub-Committees, each of which has its own homepage. General Information General information about the House of Lords and its Committees, including guidance to witnesses, details of current inquiries and forthcoming meetings is on the internet at http://www.parliament.uk/about_lords/about_lords.cfm Contacts for the European Union Committee Contact details for individual Sub-Committees are given on the website. General correspondence should be addressed to the Clerk of the European Union Committee, Committee Office, House of Lords, London, SW1A 0PW The telephone number for general enquiries is 020 7219 5791. The Committee’s email address is [email protected] CONTENTS Paragraph Page Summary 6 Chapter 1: Our Inquiry 1 7 Introduction 1 7 Conduct of the inquiry 4 7 Chapter 2: Background to the Inquiry 7 9 Cyber-attacks: some definitions 7 9 Estonia, April–May 2007 11 10 Box 1: Attacks against Estonia, April–May 2007 10 Attribution 13 10 China 15 11 Box 2: The Dalai Lama 11 Natural disasters and accidental damage 19 12 Resilience of the Internet 22 13 Chapter 3: Is there a role for the EU? 29 15 A legitimate role 30 15 Member States with less resilient systems 34 16 National security 36 16 The wider global context 38 17 A second best? 41 17 Chapter 4: The Commission Communication 47 19 Reaction to the Communication 50 19 Specific actions 55 20 Computer Emergency Response Teams (CERTs) 57 21 Public private partnerships 72 23 The EU and NATO 80 25 Resilience exercises 88 26 Box 3: Exercise White Noise 27 Timescales 93 28 Chapter 5: ENISA 99 30 Functions of the agency 99 30 Management and staff 103 30 Assessments of ENISA’s work 106 31 The impact of the Communication on ENISA’s mandate 107 32 Location 112 33 Box 4: ENISA Evaluation Report: Location 33 Chapter 6: Summary of Conclusions and Recommendations 121 35 Appendix 1: Sub-Committee F (Home Affairs) 38 Appendix 2: List of Witnesses 39 Appendix 3: Call for Evidence 40 Appendix 4: The Commission Communication 42 Appendix 5: Glossary, Acronyms and Abbreviations 51 Oral Evidence Mr Geoff Smith, Head, Communications Security and Resilience, Information Economy Directorate, Department for Business, Innovation and Skills (BIS) and Dr Steve Marsh, Deputy Director, Office of Cyber Space, Cabinet Office Written evidence 1 Oral evidence, 4 November 2009 11 Supplementary written evidence 23 Mr Chris Gibson, Chief Finance Officer, Forum for Incident Response and Security Teams (FIRST) and Mr Andrew Cormack, Chief Regulatory Adviser, JANET (UK) Oral evidence, 25 November 2009 25 Mr Andrea Servida, Deputy Head of Unit, Directorate General Information Society and Media, European Commission Oral evidence, 2 December 2009 38 Mr Ilias Chantzos, Director of Government Relations, Symantec (UK) Ltd., and Dr Jose Nazario, Manager of Security Research, Arbor Networks Written evidence 50 Oral evidence, 9 December 2009 56 Dr Udo Helmbrecht, Executive Director, and Dr Jeremy Beale, Head of Stakeholders Relations, ENISA Written evidence 70 Oral evidence, 16 December 2009 74 Professor Ross Anderson, Professor of Security Engineering, Cambridge University Oral evidence, 6 January 2010 87 Lord West of Spithead, Parliamentary Under-Secretary of State, Minister for Security and Counter-Terrorism, Home Office, and Dr Steve Marsh, Deputy Director, Office of Cyber Security, Cabinet Office Oral evidence, 13 January 2010 99 Supplementary written evidence 110 Further supplementary written evidence 111 Written Evidence Association of Chief Police Officers (ACPO) 112 Boxing Orange 121 Professor Jon Crowcroft, Marconi Professor of Communications Systems, Cambridge University 123 Europol 124 Dr Steven Fafinski, Lecturer in Law at Brunel University and a Director of Invenio Research Limited 127 Intellect 136 ISACA London Chapter 139 ISSA-UK and BCS 142 Professor Farnam Jahanian, Founder and Chairman of the Board, Arbor Networks 147 Professor Juliet Lodge, Jean Monnet European Centre of Excellence, University of Leeds 150 Ofcom 151 Payments Council 153 Serious Organised Crime Agency (SOCA) 158 Mr Tim Stevens 160 XS4All Internet 164 NOTE: References in the text of the report are as follows: (Q) refers to a question in the oral evidence (p) refers to a page of written evidence SUMMARY We all rely on the Internet, at every level: individuals, small firms, large companies, international corporations, and at national level. Yet at every level our Internet communications are vulnerable. The Internet is run by private companies, but it is an increasingly important part of the critical national infrastructure (CNI); and we have always expected States to take significant responsibility for CNI. The issue of large-scale cyber-attacks on the Internet has moved up the international agenda in recent months. In this inquiry we have been looking at how States and their major organisations can defend themselves and their critical information infrastructures (CIIs) against such attacks, whether these attacks are criminally or politically motivated; along with the similar issues which arise when considering how to reduce the risk of disruptions to the CII caused by natural or man-made disasters. Individual States bear primary responsibility for their CNI, but the infrastructures of the Member States of the European Union are heavily interdependent. This has led to EU legislation beginning to regulate the extent and manner of cooperation between the Member States. However, the Internet is a global network of networks where individual States and groups of States cannot be viewed in isolation, so we started by considering whether intervention at an EU level was appropriate. We concluded that it was. There are wide differences between the Member States. Some, like Estonia, are very heavily reliant on the Internet but have—or had until very recently—defences wholly inadequate to protect their CII against even minor attacks. Some, and the United Kingdom is among them, also rely heavily on the Internet, but have sophisticated and well-developed defences to guard against attacks or disruptions. Yet other Member States rely less on the Internet, but their defences are insufficient. We concluded that all Member States have an interest in bringing the defences of the lowest up to those of the highest, and that this is a matter of legitimate concern to the EU as a whole. In 2009 the Commission published a Communication with proposals for enhancing the preparedness, security and resilience of the Member States in protecting their CIIs from large-scale cyber-attacks and disruptions. This document is central to our inquiry. The Communication does not put forward legislation, but makes a large number of proposals for common action by the Member States. Some, like the development of national and governmental Computer Emergency Response Teams (CERTs), will be of great benefit to many less advanced Member States. In the case of other suggestions, like enhanced EU action at global level, it is hard to see exactly what is being proposed. But we believe that there is much in the Communication that should be supported. Lastly we looked at ENISA, the European Network and Information Security Agency. This small body has been useful as a platform for the exchange of views and of best practice, but is not helped by being in Crete, on the periphery of the EU.