A dangerous development in the Network and Infrastructure Safety Directive
The European Council’s “Telecoms, Transport and Energy” configuration will meet on November 27. On its agenda will be the “Network and Infrastructure Security” directive, which aims to increase the level of cyber-security in EU member states.
This directive was passed in March 2014 in the European Parliament, focusing on the entities presenting the greatest risks: critical infrastructure operators, within which an incident can have major consequences for public health, the economy or security. It includes provisions that Syntec Numérique has warmly welcomed, and which will both create a real cyber-security force and increase attention on cyber threats.
However, the European Council now wishes to broaden the scope of this directive to include information society companies and Internet players. This enlargement jeopardizes the cyber-security architecture and the economic attractiveness of the whole of Europe, in particular by :
- A detour of the resources needed by operators of vital importance (OIV) to private messaging services, social networks and online gaming;
- Additional obligations for small businesses in the face of new local standards, even though international standards such as ISO 27000 have proved their effectiveness.
“Although France supports the extension of the scope of this directive, we are firmly opposed to this development. By confusing data protection with cyber-security, this extension opens the door to the “balkanization” of the Internet and risks isolating our economic space. Digital businesses are urging the French government not to sacrifice French citizens’ cyber space for political reasons. On the contrary, on November 27, it must promote a global, risk-based approach, enabling the whole of Europe to evolve with security and confidence in the digital world”, comments the French government. Laurent Baudart, General Delegate of Syntec Numérique.
rn