EU-NATO Task Force releases final assessment report on boosting resilience, protecting critical infrastructure
The EU-NATO Task Force presented a final assessment report that maps out the current security challenges and identifies four key sectors of importance, including energy, transport, digital infrastructure, and space. The report recommends strengthening critical infrastructure resilience and deepening EU-NATO cooperation through information exchanges, alternative transport routes, and security research ties.
“Disruptions to critical infrastructure can come from many sources, both natural and human-induced. Moreover, due to an increasingly intertwined and connected economy and society, disruptions of critical infrastructure can have significant repercussions across sectors and borders,” the EU-NATO Task Force said in its report last week. “Critical infrastructure is vulnerable to intentional attack or accidents. Many types of critical infrastructure are widely dispersed and some are easily accessible. Given the extent of private ownership and the need to ensure inter alia financial viability, strong security measures may not be feasible.”
Thus, it added that critical infrastructure can be seen as a ‘soft target’ by an adversary, especially to hybrid tactics, which allow for such attacks to take place under a cloak of plausible deniability. Intentional attacks can also be timed to maximize the disruptive impact.
The EU-NATO report also identified that Russia’s war of aggression against Ukraine has shown that critical infrastructure can be targeted in various ways: through espionage and intelligence gathering, physical attack, hostile reconnaissance, malicious hybrid, and cyber activities, exploitation of dependencies, or seizure. “At the same time, Ukraine’s example has both proven that it is possible to withstand even large-scale attacks and underscored how important resilient critical infrastructure and the continued provision of essential services are to a country’s ability and determination to defend itself.”
Russia has already demonstrated that it sees critical infrastructure as a target through its actions in Ukraine, according to the assessment report. “It is also mapping critical infrastructure in the Euro-Atlantic area, which it could target. Russia and groups associated with it have used cyber attacks as a means to disrupt essential services in the Euro-Atlantic area. Terrorist organisations also pose a threat to critical infrastructure. Various terrorist groups have targeted the transport infrastructure of Allies and of Member States several times.”
The assessment report identified that the sabotage of the Nord Stream pipelines illustrated the vulnerability of energy infrastructure. Energy security is more challenging in the current geopolitical environment. Moreover, military activities significantly rely on civilian energy networks and supplies. Energy infrastructure is also networked, so disruption in one location can have a broader impact.
“Decisive steps were taken by Member States and Allies to reduce our dependence on Russian energy. The growing use of renewable energy sources and electrification can also strengthen resilience because it increases the diversity of sources and autonomy and reduces reliance on a single central system,” the report revealed. “On the other hand, the new infrastructure and connections also bring new challenges in terms of infrastructure protection. The increased reliance on renewable energy also brings potential supply chain vulnerabilities since many of their critical components are still largely concentrated outside of NATO and the EU.”
The EU-NATO report said that transport infrastructure, including airports and seaports, is also vulnerable to cyber-attacks, which can inflict substantial economic damage and possibly cause disruptions for use by the military. “Our militaries rely heavily on civil and commercial transport infrastructure to deploy their activities. Furthermore, the transport sector is affected by and has a significant impact the other sectors covered in this report, and these interdependencies are growing.”
It added that the increasing electrification of transport will lead to a greater reliance on the electricity grid, batteries, and associated infrastructure, in addition to existing dependencies on pipelines for hydrocarbon products that will remain part of the energy mix for the foreseeable future. “Moreover, transport infrastructure is increasingly digitalised, making it more vulnerable to malicious cyber activities and disruptions.”
Addressing digital infrastructure, the report said that a wide range of infrastructure is required to provide information and communications services, from underground and undersea fiber-optic cables to cellular base stations and satellites. “The reliance on undersea cables and 5G networks poses risks due to limited repair capabilities and increased vulnerability. Moreover, digital infrastructure relies on global supply chains. These are vulnerable to accidental and intentional disruptions, which could impact global networks and introduce security risks,” it added.
When it came to the space sector, the report said that space infrastructure encompasses both space-based assets and ground-based systems, which can be vulnerable to various human-induced and natural risks. “Space assets can be owned and operated by the EU (Galileo, Copernicus), Member States, Allies, and, increasingly, commercial entities. Strategic competitors and potential adversaries are developing counter-space capabilities that could threaten NATO and the EU’s access to and freedom of operation in space, potentially disrupting critical infrastructure,” it added.
The EU-NATO report said that the sector-specific elements raised above point to the strong physical and digital interlinkages that exist between sectors, including others outside the scope of the current analysis (for example, public health, water supply, or agriculture, to name a few). “Due to this high degree of interdependence among different types of infrastructure, the effects of disruption in one sector can cascade, affecting critical infrastructure in other sectors as well. These linkages need to be better understood in order to anticipate potential cascading effects, identify measures to mitigate them, and facilitate an effective and complementary response through civilian and military means, including those available through the Union Civil Protection Mechanism (UCPM),” it added.
“The fast-growing digitalisation of each of the four sectors assessed above makes them vulnerable to malicious cyber activities. Cyberspace is contested at all times,” the EU-NATO report said. “Malign actors have shown increasing willingness to conduct malicious cyber activity against critical infrastructure to achieve their strategic objectives, including by conducting extensive reconnaissance; carrying out attacks, including against supply chains; exploiting vulnerabilities in hardware and software; and taking advantage of poor cyber hygiene and security awareness in both public and private organisations.”
It also added that ownership or control by potential adversaries of critical infrastructure and supporting supply chains in allies and member states also poses a potential challenge. This could give access to data and information or it could be used to degrade, disrupt or deny access or withhold services.
The EU-NATO report identified several recommendations to build on their cooperation. These include ensuring swift engagement between high-level EU and NATO officials in the case of an identified major hazard to critical infrastructure or a significant change in the security context. It also suggests developing regular Parallel and Coordinated Assessments of the threats to critical infrastructure, building on the one conducted in spring 2023, and strengthening the structured dialogue on resilience and military mobility. It also advises making full use of synergies between respective processes deriving from EU and NATO critical infrastructure policies and programs.
It also calls for systematically taking into account the resilience of critical infrastructure in any future parallel and coordinated exercises, holding dedicated scenario-based discussions between staff to understand challenges, interdependencies, and cascading effects, and enhancing awareness of the security implications of participation in or control of critical infrastructure by entities from strategic competitors, as well as the potential risks related to suppliers from those countries, including in 5G networks.
The report also explores possibilities for exchanges on improving the monitoring and protection of critical infrastructure in the maritime domain by relevant authorities and discusses ways to enhance maritime situational awareness. It also recommends promoting the exchange of best practices between civilian and military actors on the implementation of relevant cyber-related policies and legislation, including relevant legislation aimed at enhancing the cyber resilience of critical infrastructure for a more resilient military. It also suggests exchanging best practices for enhancing the resilience of critical infrastructure and identifying potential ways to strengthen it further.
The EU-NATO report identifies alternative transport routes for civilian and military purposes in case of a significant disruption to a particular route and promotes engagement among allies, member states, and the private sector, including on security by design for critical infrastructure. It also suggests promoting exchanges on the management of cross-sectoral consequences of major disruptions of critical infrastructure, in particular through increased cooperation between NATO and the EU’s Emergency Response Coordination Centre (ERCC).
Lastly, the EU-NATO report recommends identifying synergies and potential areas of cooperation in security research activities related to critical infrastructure, including challenges related to new technologies or supply chain security.
In conclusion, the report identified that EU and NATO staff will take forward the recommendations of this report based on long-standing cooperation and in full respect of the agreed guiding principles enshrined in the three Joint Declarations on EU-NATO cooperation. The EU-NATO Structured Dialogue on Resilience will ensure the coherence of the follow-up work of the Task Force.
Related
