ICT-C Meeting, 25 July 2007 Jacques Bus Head of Unit, INFSO-F5 “Security” ICT and Security FP7 Themes Joint Call on Critical Infrastructure Protection Handling “Sensitive” Projects

Joint FP7 Call between Security and ICT Themes on Critical Infrastructure Protection (1) Call FP7-ICT-SEC  ICT Objective 1.7  Budget 40 m€ (ICT Theme 20m€, Security Theme 20m€)  Opening 30 AUG 2007 Closing 29 NOV 2007 at 17:00 (Brussels time)Aims  More secure and dependable Critical Infrastructures (CI’s)  Protect CI’s against deliberate acts of terrorism, natural disasters, negligence, mismanagements, accidents, computer hacking, criminal activity and malicious behaviour  New technical solutions that support and refine the policy options and legislative processes  ‘Coalition formation’ and ‘consensus building’

Focus of the FP7 ICT Theme a)Understand and Manage complex interconnected and interdependent CI’s; b)Build secure and resilient networked and distributed information and process control systems; Risk analysis, security configuration & management; security forensics; c)Develop research roadmaps, metrics, benchmarks, International-Cooperation Technology building blocks for creating secure, resilient, responsive and always available information infrastructures linking critical infrastructures (CI’s) Joint FP7 initiative between Security and ICT Themes on Critical Infrastructure Protection (2)

Joint FP7 initiative between Security and ICT Themes on Critical Infrastructure Protection (3) Joint FP7 initiative between Security and ICT Themes on Critical Infrastructure Protection (3) Focus of the FP7 Security Theme a)Risk assessment and contingency planning for interconnected transport or energy networks b)Modelling and simulation for training c)Optimised situational awareness through intelligent surveillance of interconnected transport or energy infrastructures d)ICT support for first responders in crises occurring in critical Infrastructures Technology building blocks for secure, resilient and always available transport & energy infrastructures that survive malicious attacks or accidental failures and guarantee continuous provision of services

 Indicative Call Budget: 40 m€ – 20 m€ by ICT Theme and 20 m€ by Security Theme – Collaborative Projects: Up to 36 m€ Expected Project Proposals  Typical size of 2-5 m€ (total cost) and duration of 2-4 years – Coordination and Support Actions: Up to 4 m€ Expected Project Proposals of average size around 0.5 m€  Provisional: Information Day in Brussels on 27 SEP 2007 – further info will become available at the dedicated web site: Joint FP7 initiative between Security and ICT Themes on Critical Infrastructure Protection Budget Call and Information

Handling “Sensitive” Projects What is a sensitive project?  No “Sensitive” Proposals are allowed in the call (no classified information in a proposal)  BUT: a Proposal could lead to a “Sensitive” Project (project that could use classified/sensitive background and/or produce classified/sensitive foreground)  A “Sensitive” Project is handling: – Data or information requiring protection against unauthorised disclosure: classified information – Information or materials subject to security restrictions – Material subject to export- or transfer-control Some subjects are sensitive and have always been addressed nationally

Handling “Sensitive” Projects Classification of information  Each country has a national classification system  EU classification system established to allow exchange of sensitive information inside the EU  This EU classification is recognised by all Member States (MS)  In a European project, classified information may be exchanged between EU participants on the basis of EU classification procedures  Each MS has designated a National Security Authority (NSA)  The NSAs are managing the EU classification procedures for the entities located in their MS

 cause exceptionally grave prejudice to the essential interests of the EU or of one or more of its MS  no EU TOP SECRET classified information in an FP7 action  seriously harm the essential interests of the EU or of one or more of its MS  harm the essential interests of the EU or of one or more of its MS  be disadvantageous to the interests of the EU or of one or more of its MS Information and material the unauthorised disclosure of which could: TRES SECRET UE / EU TOP SECRET SECRET UE CONFIDENTIAL UE RESTREINT UE Handling “Sensitive” Projects Levels of classification of information

Handling “Sensitive” Projects Sensitive proposals with non-EU participants  EU classification is limited to EU Member States  Sensitive projects can include participants from associated or third countries  Countries having a security agreement with the EU (Council level) could refer to that security agreement for handling sensitive information and material  Special MoU (Memorandum of Understanding) could be agreed between the countries involved in the handling of sensitive information/material of a project limited to that project No restriction for the participation to sensitive projects for associated countries and from third countries if no access foreseen to sensitive information/material

“Sensitive” Project Proposals and the ICT-Committee  EC sends to the Programme Committees of the ICT Theme and the Security Theme the evaluation results of the joint Call  a ranked “selection” list of successful proposals (proposals for negotiation or on reserve list)  All sensitive project proposals are flagged  ICT-C will have the discretion of proposals selected under the budget of the ICT-Theme and is informed of the proposals to be selected under the budget of the Security Theme  ICT-C Members or ICT-C Observers could request that some additional proposals from the selection list are identified as sensitive

Handling “Sensitive” Projects Scrutiny Procedure  For each sensitive project proposal of the selection list:  The concerned ICT-C Members or ICT-C Observers will be requested (via their national security authority representative) to verify that all security aspects are properly addressed and to reach an agreement among themselves  the scrutiny procedure is done, in a 2 months period, following the evaluation and before the start of the negotiation of the flagged projects  The results of the scrutiny could be:  go ahead with negotiation;  recommendations for the negotiation;  Recommendation not to finance the proposal  Proposers receive report with the conclusions of the scrutiny procedure