AISCAT position paper on: European Commission s Green Paper on a European Programme for Critical Infrastructure Protection Rome, January 2006
Index 1. FOREWORD 2. AISCAT, ITS MEMBERS AND TOLL MOTORWAY CONCESSIONS IN ITALY 3. AISCAT S ANSWERS TO THE GREEN PAPER
1. FOREWORD This document represents the position of AISCAT - the Italian Association of Toll Motorways and Tunnels Operators with respect to the questions of the Green Paper on the European Programme for Critical Infrastructure Protection (EPCIP) prepared by the European Commission. With this document, AISCAT aims to bring to the Commission s attention, the position and experience of those stretches of the Italian Toll Motorway network that are in concession, with respect to matters of absolute relevance and complexity such as those concerning security of infrastructure networks and the development of new and more efficient policies for the protection of these networks, also related to new kinds of risk (such as, for instance, terrorist attacks). We wish to thank the European Commission for this opportunity. In sharing the objectives pursued by the Commission and supporting the efforts made by the Commission in order to define a common programme for protection, AISCAT wishes to confirm its full support in contributing (with respect to its areas of competence) in a concrete way to all open discussions, both on this occasion as well as in future occasions. Well aware that this is a process that will lead to more in-depth analyses throughout a series of activities in time, AISCAT wishes to be present, in accordance to the Community s procedures, throughout the steps that will be taken in the future with respect to its industry sector, in consideration of the strategic role played by Italian toll motorways within the European motorway network. Moreover AISCAT, taking also into account its relevant experience in the sector, is readily available for active participation in seminars and debates and further meetings that may be held on the subject.
2. AISCAT, ITS MEMBERS AND TOLL MOTORWAY CONCESSIONS IN ITALY 2.1 AISCAT and its members AISCAT the Italian Association of Toll Motorways and Tunnels Operators was established in 1966. Its objective is the collection and comparison of the experiences and common needs of its members, dealing with all the issues related to the planning, construction and operating of toll motorways and tunnels. AISCAT s attention has always focused on two key areas: The harmonisation of members procedures and behaviour with respect to service operations, relationship with end users and relationship with Public Bodies: all in accordance with the nature of each independent decision making body; The promotion of shared positions with respect to the interests and needs of the sector and the subsequent presentation of these to all responsible bodies, both national and International. The Association s members are companies, entities and consortia that own a concession for the construction and/or management of Italian toll motorways or tunnels; there are currently 23 members, representing approximately 5,600 kilometres of motorway network. 2
3
COMPANIES KM IN OPERATION AUTOSTRADE PER L'ITALIA 2.854,6 ITALIANA TRAFORO MONTE BIANCO 5,8 ITALIANA TRAFORO DEL GRAN SAN BERNARDO (S.I.TRA.S.B.) 12,8 ITALIANA TRAFORO AUTOSTRADALE DEL FREJUS (S.I.T.A.F.). 82,5 RACCORDO AUTOSTRADALE VALLE D'AOSTA (R.A.V.) 27,0 AUTOSTRADE VALDOSTANE (S.A.V.) 67,4 AUTOSTRADA TORINO-IVREA-VALLE D'AOSTA (A.T.I.V.A.) 152,9 AUTOSTRADA TORINO-ALESSANDRIA-PIACENZA (S.A.T.A.P.) 291,9 AUTOSTRADA TORINO-SAVONA 130,9 MILANO SERRAVALLE - MILANO TANGENZIALI 177,6 AUTOSTRADE CENTROPADANE 88,6 AUTOSTRADA BRESCIA-VERONA-VICENZA-PADOVA 182,5 AUTOSTRADA DEL BRENNERO 314,0 AUTOVIE VENETE 180,3 AUTOSTRADE DI VENEZIA E PADOVA 41,8 AUTOSTRADA DEI FIORI 113,3 AUTOCAMIONALE DELLA CISA 101,0 AUTOSTRADA LIGURE TOSCANA (S.A.L.T.) 154,9 AUTOSTRADA TIRRENICA (S.A.T.) 36,6 STRADA DEI PARCHI 281,4 TANGENZIALE DI NAPOLI 20,2 AUTOSTRADE MERIDIONALI (S.A.M.) 51,6 CONSORZIO PER LE AUTOSTRADE SICILIANE 268,2 4
2.2 The role of motorway Concessionaries in the management of the network The rights and responsibilities of road owning Entities are defined in article 14 of Legislative Decree no. 285 dated 30 April 1992 (New Road Code). This article establishes that for roads granted in concession, the aforementioned rights and responsibilities may be exercised by the Concessionaries. This article thus puts on the same level (both in form and in substance) Owner Entities and Concessionary companies. With specific attention to Italian toll motorways, the concessionary instrument is undertaken by way of a contract (the Agreement ) between the granting Body (the State on behalf of ANAS) and the Concessionary (the motorway company). In the Agreement all rights and responsibilities of the parties are defined and regulated and the motorway company is entrusted with all activities and necessary tasks to guarantee the proper operation of the infrastructure it is responsible for. Accordingly, concessionary companies face a number of obligations essentially related to the maintenance of the infrastructure s service levels and of the conditions of traffic safety and regularity, through the design and execution of all necessary improvement works and the implementation of suitable management schemes. However, is necessary to respect the binding economic and financial equilibrium, on which the management of motorways it is based, as well as the specific competences of the national and Institutional Bodies (such as State Police) that, by law, are entitled to control and manage the traffic. 5
3. AISCAT S ANSWERS TO THE GREEN PAPER Par. 3.1: The overall goal of EPCIP Is this an appropriate goal for Yes. These objectives are absolutely of EPCIP? If not, what should the goal a shared interest (we also find it be? important the need to minimise the negative impact of the security investments on market competitiveness and stability). Par. 3.2: What should EPCIP protect against Which approach should EPCIP take? Why? EPCIP should have a general and flexible approach in order to cover a large number of possible outcomes and risk types, while of course devoting specific priority to terrorist attacks. Accordingly, option 2 is considered to be more suitable. Chap. 4: Suggested Key Principles Are these key principles The principles may certainly be shared acceptable? Are some superfluous? and we find them to be fulfilling and Are there additional ones that exhaustive, but with respect to the should be considered? principle of subsidiarity it is necessary to clarify duties and responsibilities. Indeed, bearing in mind that for all infrastructures the main responsibilities (especially financial and operative) are borne by Member States, the Commission should: define the operating procedures in co-operation with Member States; Do you agree that protection measures should be proportionate to the level of risk involved as not all infrastructures can be protected from all threats? coordinate the various activities; monitor and assess adherence to provisions, acting with a guarantor role. We agree with the principle that protection measures should be proportionate to the level of risk involved. 6
Chap. 5: A Common EPCIP Framework Would a common framework be effective in strengthening CIP? If a legislative framework is required, what elements should it contain? Do you agree that the criteria for identifying different types of ECI, and the protection measures considered necessary, should be identified sector-by-sector? Would a common framework be helpful in clarifying the responsibilities of the stakeholders concerned? To what extent should such a common framework be obligatory and to what extent voluntary? Yes, we agree with the need to define a common framework, but, with respect to the list included in the text, devote specific attention to the definition of the term standard. This term should be defined in such a way so that its meaning may be unequivocally conveyed. Indeed, it is a question of distinguishing common elements (such as, for example, definitions and operating procedures) from technical elements to be submitted (or already submitted) for standardisation processes and which thus correspond to clearly defined International regulations. Paying maximum attention to the International legal environment, it is necessary to clearly define a framework for: legal responsibilities; financing of activities and works. Yes. Both the identifying criteria as well as the necessary means of protection need to be identified on a sector-by-sector basis, depending on the specificities of each, so as to optimally calibrate the measures. More than a common framework, one should look for a definition of a unique reference scenario and guidelines to which each Member State, within the context of its specific institutions, may refer to. In this way, functions will need to be agreed upon at EU level, while Member States will elect the acting bodies responsible for these functions. 7
What should be the scope of the common framework? Do you agree with the list of indicative terms and definitions in annex I on the basis of which, sector specific definitions (where relevant) can be created? Do you agree with the list of indicative CI sectors in annex II As per our previous answer, the aim should be to provide reference guidelines, within which all functions are clearly defined. With respect to the lists contained in annexes 1 and 2, we agree, in principle, with the contents of the document. Par. 6.1: Definition of EU Critical Infrastructure Should ECI be infrastructure that has a potentially serious crossborder impact with two or more MS, or three or more MS? Why? With respect to our sector, we believe ECI should be identified among those infrastructure that belong to the Trans- European Networks (TEN). Par. 6.2: Interdependencies How can interdependencies be taken into account? Do you know of any suitable methodologies for analysing interdependencies? At what level should the identification of interdependencies take place at EU and/or MS level? The Commission shall have to take on a management role for interdependencies, whatever their nature is (legal, procedural, etc.) As of today, interventions have always been made in an empirical way, without any form of methodological approach. It is thus not possible to indicate standard methodologies for this type of analyses. As mentioned earlier, the EU will need to define the functions, while it will be up to individual Member States to identify and assign the responsible bodies which, bilaterally, will manage interdependencies. Par. 6.3: Implementing steps for ECI Is the list of steps concerning the implementation of the ECI acceptable? How do you suggest the Commission and the MS designate together ECI - MS have expertise, Commission has overview of European interest? Should this be a legal decision? Yes. The list is certainly acceptable and covers all levels of competence. This matter needs to be clarified, especially in consideration of our previous answers (see Chapter 5) 8
Is there a need for an arbitration mechanism if a particular MS do not agree to designate an infrastructure under its jurisdiction as ECI? Is there a need for verification of designations? Who should be responsible? Should MS be able to designate infrastructure in other MS or third countries as being critical for them? What should happen if a MS, a third country or an industry considers a piece of infrastructure in a MS to be critical for them? What should happen if that MS then does not identify it? Is there a need for an appeals mechanism? If so what? Should an operator have the possibility of appealing, if they do not agree with their designation or non-designation. If so, to whom? What methodologies would need to be developed for setting priority sectors/infrastructure for action? Do suitable methodologies already exist that can be adapted to the Europeanlevel? How can the Commission be involved in analysing the security gaps in relation to ECI? This is not of our competence. It is up to the EU authorities and Member States. Please refer to our previous answer. It being understood that each Member State maintains internaly its sovereignty, the role of European institutions needs to be recalled for the harmonisation of conflicts among different Member States. Since all decisions should be reached during the negotiation phase, this outcome should never become necessary. Without prejudice to our previous statements, and thus respecting the role of the authorities involved, operators should certainly play an active role in the designations. Institutionally shared parameters need to be defined at EU level. The Commission will need to collect the indications of different Member States and carry out an harmonisation of all information received. Par. 7.1: The NCI role in EPCIP The efficient protection of critical infrastructure in the European Union would seem to require the identification of both ECI and NCI. Do you agree that although EPCIP should focus on ECI, NCI cannot altogether be left out? Which of these options do you feel is the most appropriate for EPCIP? Having clearly defined what falls within the scope of European interests, we do not believe it is appropriate nor necessary to take an interest in all other Member States infrastructure (to which full sovereignty is left). Based on our statements, we believe that the preferred option is to leave NCIs out of EPCIP objectives. 9
Par. 7.2: National CIP Programmes Is it desirable that each MS adopts a No - If these Programmes exclusively National CIP Programme based on concern NCIs. EPCIP? Conversely, i.e. in the case of National Programmes for the protection of ECIs, this is a question to be addressed by individual Member States. We therefore believe that any answer would not be ripe at this moment. Par. 7.3: Single Overseeing Body Do you agree that MS would alone be responsible for designating and managing NCI under a common EPCIP framework? Is it desirable to designate a CIP coordination body within each MS having overall coordination responsibility for CIP related measures while respecting existing sector based responsibilities (civil aviation authorities, Seveso Directive etc)? Would the suggested competences of such a coordination body be appropriate? Are there others that are necessary? As previously mentioned, NCIs should be kept out of the EPCIP This question concerns each Member State. All depends on the functions of the system established at EU level. The competences and different assignations specifically concern individual Member State. Par. 7.4: Implementing steps for NCI Is the list of steps concerning the NCIs are not within the scope of the implementation of the NCI EPCIP. It is up to the individual appropriate? Are any steps Member State to decide. superfluous? Should any steps be added? Par. 8.1: Responsibilities of CI Owners, Operators and Users Are the potential responsibilities for owners/operators of critical infrastructure acceptable in terms of increasing the security of critical infrastructure? What would be their likely cost? The responsibilities of owners/operators, as well as the other items mentioned in the paragraph, cannot be conclusively answered at this moment in time, since they depend on how the system s functions will be defined. 10
Should owners and operators be obliged to notify the fact that their infrastructure may be of a critical nature? Do you think the OSP concept is useful? Why? Are the suggested obligations proportional to the costs involved? What rights could the CI owners and operators be given by the MS authorities and Commission? Furthermore, one must take into account: the possible legal implications that will need to be addressed once a clearer framework is available. The procedures to implement with respect to the cost of the works, which will change the existing financial framework of the publicprivate partnership. Please refer to our previous answer. Nothing can be stated at this level. This requires detailed analyses, which are not possible in this phase. Nothing can be stated at this level. This requires detailed analyses, which are not possible in this phase. Par. 8.2: Dialogue between owners/operators and users of CI How should the dialogue with the owners, operators and users of CI be structured? Who should represent the owners, operators and users in the public private dialogue? Owners and operators need to be involved right from the beginning of the process, since, in view of their experience and role, they are important and active elements. This depends on the Member State and different sectors in question. With respect to the road sector, AISCAT, in its capacity of Association of reference, is a candidate to represent Italian toll motorway networks. Par. 9.1: The Critical Infrastructure Warning Information Network What form should the CIWIN This will depend entirely on the network take in order to support the functions of the system that will be objectives of EPCIP? defined (see questions in chapter 5). Member States will only be able to decide once the functions of the system have been defined. Should CI owners and operators be Please refer to our previous answer. connected to CIWIN? 11
Par. 9.2: Common Methodologies To what extent is it desirable and feasible to harmonise or calibrate different alert levels? Should there be a common methodology of identifying and classifying threats, capabilities, risks, and vulnerabilities and drawing conclusions about the possibility, probability, and degree of severity posed by a threat? This is certainly desirable and should be pursued. Harmonisation will need to be one of the main elements on which the guidelines should be established. Certainly. Common guidelines need to be established and these guidelines should be the same for all. Par. 9.3: Funding How would you estimate the cost and impact of the implementation of the measures put forward in this green paper for administrations and industry? Would you find it proportionate? The measures will certainly be costly and need to be carefully assessed. The funding of the measures and their sustainability need to be especially considered when, in the case of the toll motorways sector, private parties (a number of which listed companies) are involved. These companies are obliged to maintain an economical and financial equilibrium in time and obliged to respect the original conditions underlying their existing agreement with the State (represented by the concessionary instrument). Par. 9.4: Evaluation and Monitoring What type of evaluation mechanism The first 2 mechanisms mentioned in would be needed for EPCIP? Would the text may certainly be shared. About the above mentioned mechanism be the third item, this will depend on the sufficient? system as it is not possible to define the competences within each Member State beforehand. 12