M O N T E N E G R O Negotiating Team for the Accession of Montenegro to the European Union Working Group for Chapter 10 – Information society and media Bilateral screening: Chapter 10 PRESENTATION OF MONTENEGRO Brussels, January

Chapter 10: Information society and media NETWORK AND INFORMATION SECURITY Bojana Bajić Adviser to Minister Ministry for Information Society and Telecommunication M O N T E N E G R O Negotiating Team for the Accession of Montenegro to the European Union Chapter 10: INFORMATION SOCIETY AND MEDIA 2

Chapter 10: Information society and media Content  Relevant Acquis  National Legislation  Computer Incident Response Team  Trainings & Conferences  International Cooperation  Cooperation with State Institutions  Cooperation with the Private Sector  Detailed study with defined responsibilities of state institutions in the fight against cyber crime  FUTURE ACTIVITIES M O N T E N E G R O Negotiating Team for the Accession of Montenegro to the European Union Chapter 10: INFORMATION SOCIETY AND MEDIA 3

Chapter 10: Information society and media M O N T E N E G R O Negotiating Team for the Accession of Montenegro to the European Union Chapter 10: INFORMATION SOCIETY AND MEDIA Relevant Acquis  Regulation No 460/2004 of the European Parliament and of the Council of 10 March 2004 establishing the European Network and Information Security Agency 32004R0460 Regulation No 460/2004  Council decision 2004/541/EC of 5 July 2004 on the three stakeholders’ representatives and their alternates to the Management Board of the European Network and Information Security Agency 32004D0541 Council decision 2004/541/EC  92/242/EEC: Council Decision of 31 March 1992 in the field of security of information systems 92/242/EEC: Council Decision  (OJ L 123, , p. 19–25) 31992D D0242  Council Resolution of 28 January 2002 on a common approach and specific actions in the area of network and information security (OJ C 43, , p. 2–4) 32002G0216(02) Council Resolution32002G0216(02)  Council Resolution of 18 February 2003 on a European approach towards a culture of network and information security (OJ C 48, , p. 1–2) 32003G0228(01) Council Resolution32003G0228(01) 4

Chapter 10: Information society and media M O N T E N E G R O Negotiating Team for the Accession of Montenegro to the European Union Chapter 10: INFORMATION SOCIETY AND MEDIA Relevant Acquis Directive 2002/21/ECDirective 2002/21/EC of the European Parliament and of the Council on a common regulatory framework for electronic communications networks and services (Framework Directive) 02002L – articles 13a and 13b Amended by Directive 2009/140/EC 32009L0140 ( P) Amended by Regulation (EC) No 544/ R0544 Consolidated text 32002L0021 – articles 13a and b ( P) 5

Chapter 10: Information society and media M O N T E N E G R O Negotiating Team for the Accession of Montenegro to the European Union Chapter 10: INFORMATION SOCIETY AND MEDIA Relevant Acquis Information Security Law – fully harmonised with: 31995L0046 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23/11/1995 P – 0050) 32002L0058 Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ L 201, 31/07/2002 P – 0047) 6

Chapter 10: Information society and media M O N T E N E G R O Negotiating Team for the Accession of Montenegro to the European Union Chapter 10: INFORMATION SOCIETY AND MEDIA Relevant Acquis 32006L0024 Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC (OJ L 105, 13/04/2006 P – 0063) 32002G0216(02) Council Resolution of 28 January 2002 on a common approach and specific actions in the area of network and information security (OJ C 043, 16/02/2002 P – 0004) 7

Chapter 10: Information society and media M O N T E N E G R O Negotiating Team for the Accession of Montenegro to the European Union Chapter 10: INFORMATION SOCIETY AND MEDIA  Law on Ratification of the Convention on Cybercrime ("Official Gazette of Montenegro -" International Treaties ", no. 4/09")  Law on the Ratification of the Additional Protocol to the Convention on Cybercrime (Official Gazette of Montenegro-International Treaties-number 4/09)  The Criminal Code of Montenegro ("Official Gazette of Montenegro", no. 32/2011.)  The Criminal Procedure Code (Official Gazette of Montenegro no. 57/09 and 49/10)  Law on responsibility of private and legal entities ("Official Gazette of Montenegro, no. 14/10")  Information Security Law ("Official Gazette of Montenegro, no. 14/10")  Data Secrecy Law (Official Gazette of Montenegro, no.14/08, 76/09 and 41/10, 38/12 and 44/12 ") National Legislation 8

Chapter 10: Information society and media M O N T E N E G R O Negotiating Team for the Accession of Montenegro to the European Union Chapter 10: INFORMATION SOCIETY AND MEDIA  Regulation on Measures of Information Security ("Official Gazette of Montenegro", no. 14/10, 16 September 2010)  Regulation on detailed conditions and manners of implementation of information measures for the protection of classified information ("Official Gazette of Montenegro", no. 14/08 and 76/09, 01.July 2010)  Regulation on the manner of performance and content of internal control over the implementation of measures for the protection of classified information ("Official Gazette of Montenegro", no. 14/08, 25. June 2009).  Study with clearly defined responsibilities of state institutions in the fight against cyber crime (Adopted by Government of Montenegro on ) c National Legislation 9

Chapter 10: Information society and media M O N T E N E G R O Negotiating Team for the Accession of Montenegro to the European Union Chapter 10: INFORMATION SOCIETY AND MEDIA Computer Incident Response Team - CIRT Establishment Partners in the project of establishment of the National CIRT of Montenegro: Government of Montenegro – Ministry for information society and telecommunications ITU – International telecommunication union IMPACT – International multilateral partnership against cyber threats Administrative Agreement between the Government of Montenegro and the ITU, signed on 29 July prerequisite for the establishment of the National CIRT 10

Chapter 10: Information society and media M O N T E N E G R O Negotiating Team for the Accession of Montenegro to the European Union Chapter 10: INFORMATION SOCIETY AND MEDIA Services delivered by CIRT  Processing of incidents, response and coordination in case of incidents  Security Tips and Alerts  Promotion and awareness CIRT users  State institutions,  Government authorities,  Agencies of local self-government,  Legal entities with public authorizations  Other legal and private entities who have access or handle relevant data  “Point of contact” for all other CERT teams 11

Chapter 10: Information society and media M O N T E N E G R O Negotiating Team for the Accession of Montenegro to the European Union Chapter 10: INFORMATION SOCIETY AND MEDIA Legislative regulation for the functioning of Montenegro CIRT  Information security Law  Administrative agreement between ITU and the Government of Montenegro (ITU/MIST)  Assessment Report on the state of cyber security in Montenegro (ITU/IMPACT/MIST)  The strategy of establishing the National CIRT in Montenegro (ITU/IMPACT/MIST)  The signing of User Requirement Specification (IMPACT/MIST)  CIRT policies (IMPACT/MIST)  Study with clearly defined responsibilities of state institutions in the fight against cyber crime  Memorandum of cooperation with local CIRT teams 12

Chapter 10: Information society and media M O N T E N E G R O Negotiating Team for the Accession of Montenegro to the European Union Chapter 10: INFORMATION SOCIETY AND MEDIA Trainings & Conferences  Two representatives attended “Developing and Implementing a CIRT Team” in Malaysia. (7 days)  IMPACT experts held Incident Response training in Montenegro for 12 representatives from different Government agencies (10 days)  Two representatives attended “Information Security for E-Government“ – Organized by JICA Japan (4 months)  “Cyber drill / Regional Forum on Cyber security for Europe” organized by ITU- IMPACT-a in Sofia, Bulgaria (3 representatives)  “National Cyber Security Framework”-Workshop in Geneva (3 representatives)  International Conference - Confidence and Security in the Information Society organized by Russian state officials – Montenegro, Herceg Novi,

Chapter 10: Information society and media M O N T E N E G R O Negotiating Team for the Accession of Montenegro to the European Union Chapter 10: INFORMATION SOCIETY AND MEDIA National CIRT Position 14

Chapter 10: Information society and media M O N T E N E G R O Negotiating Team for the Accession of Montenegro to the European Union Chapter 10: INFORMATION SOCIETY AND MEDIA National CIRT Position  Key institution in Montenegro for coordination of cyber security related activities  Department within the Ministry for Information Society and Telecommunications  Agreements for cooperation should be signed with key institutions in the Private sector (deadline: March 23, 2013)  Collection of all reports related to cyber security breach in Montenegro 15

Chapter 10: Information society and media M O N T E N E G R O Negotiating Team for the Accession of Montenegro to the European Union Chapter 10: INFORMATION SOCIETY AND MEDIA CIRT Implementation  Implementation stage started in February 2012  Publishing of website and RTIR ticketing system, April 2012www.cirt.me 16

Chapter 10: Information society and media M O N T E N E G R O Negotiating Team for the Accession of Montenegro to the European Union Chapter 10: INFORMATION SOCIETY AND MEDIA International Cooperation Importance of cooperation between National CIRT and key international organizations in cyber security field:  ITU  IMPACT  ENISA  TRUSTED Introducer  FIRST  CERT/CIRT/CSIRT teams  CERT Slovenia  CERT HR,  CERT Japan  etc. 17

 Agreement between Government of Montenegro and ITU for cooperation in the field of cyber security  Agreement with IMPACT about the technical implementation and the establishment of the National CIRT of Montenegro  FIRST Membership application submitted  Sponsors for the FIRST application: Slovenian SI-CERT and Croatian Carnet CERT  Application documents  Site Visit  Memorandum of Understanding with CERT Japan (JPCERT) Chapter 10: Information society and media M O N T E N E G R O Negotiating Team for the Accession of Montenegro to the European Union Chapter 10: INFORMATION SOCIETY AND MEDIA International Cooperation 18

Chapter 10: Information society and media M O N T E N E G R O Negotiating Team for the Accession of Montenegro to the European Union Chapter 10: INFORMATION SOCIETY AND MEDIA Cooperation with State Institutions National CIRT started the process of establishing local CIRT teams in Montenegro. National CIRT will develop special relations with key Government Institutions recognized in the cyber security field:  Ministry of Defense,  Ministry of Internal Affairs,  Ministry of Justice,  National Security Agency,  Directorate for the Protection of Classified Information,  etc. 19

Chapter 10: Information society and media M O N T E N E G R O Negotiating Team for the Accession of Montenegro to the European Union Chapter 10: INFORMATION SOCIETY AND MEDIA Cooperation with the Private sector Importance of good cooperation between National CIRT and Private sector Key Institutions (Recognized in ITU/IMPACT/CIRT Analysis in 2012):  ISP  Mobile operators,  Banking sector  EPCG  Montenegro Post  Health institutions  Other 20

Chapter 10: Information society and media M O N T E N E G R O Negotiating Team for the Accession of Montenegro to the European Union Chapter 10: INFORMATION SOCIETY AND MEDIA 21 Detailed study with defined responsibilities of state institutions in the fight against cyber crime

Chapter 10: Information society and media M O N T E N E G R O Negotiating Team for the Accession of Montenegro to the European Union Chapter 10: INFORMATION SOCIETY AND MEDIA FUTURE ACTIVITIES  Adoption of Strategy on Cyber ​​Security – in 2013  Defining the Critical Information Infrastructure in Montenegro (Analysis done in 2012, with IMPACT)  Full membership in FIRST  Signing of Memorandum of understanding with JPCERT (MoU in progress)  Further improvement of conditions for the functioning of the National CIRT - Legal Framework - Training & Education - SW Tools - Additional funding  Local and International cooperation - Membership in international organizations - Memorandums of understanding  Improving quantity and quality of the services 22

Thank you for your attention. QUESTIONS 23