What changed

SHORT JUSTIFICATION

Organizations affected by cyberattacks, including in the transport sector, rarely report them, especially private sector companies, since they tend to see them as ‘bad publicity’. Most organizations prefer to deal with them internally and it is often the attackers who publicize them. In the EU, the good news is that the entry into force of Directive 2022/2555 on network security (known as the ‘NIS2 Directive’), which Member States have until October 2024 to transpose, harmonises the incident reporting obligations across the Member States. Therefore, a better understanding of the nature and scale of the problem is likely to emerge in coming years.

The European Union Agency for Cybersecurity (ENISA) published a recent report that provides information on cybersecurity threats in the transport sector, where it emphasizes that cybercriminals were responsible for more than half of the incidents observed in the 2022 reporting period (55%) and that the leading motivation behind these attacks was financial gain. It also notes that most cyber-attacks in the transport sector target IT systems, causing operational disruptions.

As regards preparedness and response to cybersecurity incidents, there is currently limited support at Union level and solidarity between Member States. The Council Conclusions of May 2022 highlighted the need to address these gaps, by calling for the Commission to present a proposal on a new Emergency Response Fund for Cybersecurity.

This Regulation implements the EU Cybersecurity Strategy adopted in December 2020 that announced the creation of a European Cyber Shield, reinforcing the cyber threat detection and information sharing capabilities in the European Union through a federation of national and cross-border Security Operations Centres (SOCs). The actions of this Regulation will be supported by funding under ‘Cybersecurity’ Strategic Objective of DEP (Digital Europe Programme).

The total budget includes an increase of EUR 100 million that this Regulation proposes to re-allocate from other strategic objectives of DEP. This will bring the new total amount available for cybersecurity actions under DEP to EUR 842.8 million.

Part of the additional EUR 100 million will reinforce the budget managed by the European Cybersecurity Competence Centre (ECCC) to implement actions on SOCs and preparedness as part of their work programme(s). Moreover, the additional funding will serve to support the establishment of the EU Cybersecurity Reserve. It complements the budget already foreseen for similar actions in the main DEP and Cybersecurity DEP Work Programme for the 2023-2027 period which could boost the total amount to 551 million for 2023-2027, while 115 million were dedicated already in the form of pilots for 2021-2022. Including Member States contributions, the overall budget could amount up to 1.109 billion euros.

Rapporteur’s position

Your rapporteur welcomes the new proposal and believes that it will offer significant benefits to the various stakeholders. The rapporteur underlines the necessity for a deeper understanding of the cybersecurity needs and requirements of transportation, as well as for providing transport critical entities with access to proper funding for preparedness, response and solving incidents.

Your rapporteur endorses the ‘transport cybersecurity toolkit’, which aims at contributing to greater levels of cyber-awareness and cyber-hygiene, with a specific focus on the transport sector. It addresses transport organisations, regardless of their size and domain of activity, as well as taking into account transport critical infrastructure and military mobility, particularly having regards the war in Ukraine, especially but not limited to:

 Air carriers, airport managing bodies, core airports, air traffic management and air traffic control centres, the European Union Aviation Safety Agency and Eurocontrol;

 Infrastructure managers, railway undertakings and the European Rail Traffic Management System (ERTMS);

 Inland, sea and coastal passenger and freight water transport companies, managing bodies of ports, including their port facilities, entities operating works and equipment contained within ports, operators of vessel traffic services;

 Road authorities responsible for traffic management control, operators of Intelligent Transport Systems;

 Postal and courier services.

Your Rapporteur believes that the size of the budget for the functioning of the Emergency Response Fund for Cybersecurity (ERFC) will determine its success; therefore, it should be sufficiently large to support Member States in preparing for, responding to and recovering from significant and large-scale cybersecurity incidents. Support for incident response shall also be made available to institutions, bodies, offices and agencies of the Union.

The European Cyber Shield will improve the cyber threat detection capabilities of the Member States. The Cyber Emergency Mechanism will complement Member States’ actions through emergency support for preparedness, response and immediate recovery/restoration of the functioning of essential services.

AMENDMENT

The Committee on Transport and Tourism calls on the Committee on Industry, Research and Energy, as the committee responsible, to take the following into account:

Amendment 1

Recital 2

Or. en

Amendment 2

Recital 2 a (new)

Or. en

Amendment 3

Proposal for a regulation

Recital 2 b (new)

Recital 3

Or. en

Amendment 4

Proposal for a regulation

Recital 2 c (new)

Recital 4

Or. en

Amendment 5

Proposal for a regulation

Recital 36

Or. en

Amendment 6

Proposal for a regulation

Recital 4

Recital 6 a (new)

Or. en

Amendment 7

Proposal for a regulation

Recital 4 a (new)

Recital 11

Or. en

Amendment 8

Proposal for a regulation

Recital 4 a (new)

Recital 13

Or. en

Amendment 9

Proposal for a regulation

Recital 1214

Or. en

Amendment 10

Proposal for a regulation

Recital 14 a (new)

Recital 15

Or. en

Amendment 11

Proposal for a regulation

Recital 1516

Or. en

Amendment 12

Proposal for a regulation

Recital 2117

Or. en

Amendment 13

Proposal for a regulation

Recital 21 a (new)

Recital 19

Or. en

Amendment 14

Proposal for a regulation

Recital 29

Recital 19 a (new)

Or. en

Amendment 15

Proposal for a regulation

Recital 30 a (new)

Recital 20

Or. en

Amendment 16

Proposal for a regulation

Recital 35 a (new)

Recital 25

Or. en

Amendment 17

Proposal for a regulation

Recital 38 a (new)

Recital 26

Or. en

Amendment 18

Proposal for a regulation

Article 1 – paragraph 2 – point a

Recital 28

Or. en

Amendment 19

Proposal for a regulation

Article 1 – paragraph 2 – point b

Recital 29

Or. en

Amendment 20

Proposal for a regulation

Article 1 – paragraph 2 – point c a (new)

Recital 32

Or. en

Amendment 21

Proposal for a regulation

Article 3 – paragraph 2 – subparagraph 1 – point c

Recital 33

Or. en

Amendment 22

Proposal for a regulation

Article 3 – paragraph 2 – subparagraph 2

Recital 34

Or. en

Amendment 23

Proposal for a regulation

Article 8 – paragraph 2 a (new)

Recital 36

Or. en

Amendment 24

Proposal for a regulation

Article 10 – paragraph 1 – point a

Recital 37

Or. en

Amendment 25

Proposal for a regulation

Article 181 – paragraph 21 – point c

Or. en

Amendment 26

Proposal for a regulation

Article 19 – paragraph 1 – pointparagraph 12 – point ba

Regulation (EU) 2021/694

Or. en

Article 6 – Paragraph 2a (new)

Amendment 27

Proposal for a regulation

Article 191 – paragraph 12 – point 1 a (new)b

Or. en

Amendment 28

Proposal for a regulation

Article 1 – paragraph 2 a (new)

Or. en

Amendment 29

Proposal for a regulation

Article 2 – paragraph 1 a (new)

Or. en

Amendment 30

Proposal for a regulation

Article 3 – paragraph 2 – subparagraph 1 – point d a (new)

Or. en

Amendment 31

Proposal for a regulation

Article 4 – paragraph 1 – subparagraph 2

Or. en

Amendment 32

Proposal for a regulation

Article 4 – paragraph 2

Or. en

Amendment 33

Proposal for a regulation

Article 5 – paragraph 2

Or. en

Amendment 34

Proposal for a regulation

Article 6 – paragraph 1 – point b a (new)

Or. en

Amendment 35

Proposal for a regulation

Article 7 – paragraph 1

Or. en

Amendment 36

Proposal for a regulation

Article 8 – paragraph 1

Or. en

Amendment 37

Proposal for a regulation

Article 8 – paragraph 2

Or. en

Amendment 38

Proposal for a regulation

Article 8 – paragraph 3

Or. en

Amendment 39

Proposal for a regulation

Article 9 – paragraph 2

Or. en

Amendment 40

Proposal for a regulation

Article 10 – paragraph 1 – point c

Or. en

Amendment 41

Proposal for a regulation

Article 10 – paragraph 1 – point c a (new)

Or. en

Amendment 42

Proposal for a regulation

Article 11 – paragraph 2

Or. en

Amendment 43

Proposal for a regulation

Article 12 – paragraph 2

Or. en

Amendment 44

Proposal for a regulation

Article 12 – paragraph 3 – point b

Or. en

Amendment 45

Proposal for a regulation

Article 12 – paragraph 5

Or. en

Amendment 46

Proposal for a regulation

Article 12 – paragraph 7

Or. en

Amendment 47

Proposal for a regulation

Article 14 – paragraph 2 – point a a (new)

Or. en

Amendment 48

Proposal for a regulation

Article 15 – paragraph 3

Or. en

Amendment 49

Proposal for a regulation

Article 16 – paragraph 2 – point f

Or. en

Amendment 50

Proposal for a regulation

Article 16 – paragraph 2 a (new)

Or. en

Amendment 51

Proposal for a regulation

Article 17 – paragraph 1

Or. en

Amendment 52

Proposal for a regulation

Article 17 – paragraph 2

Or. en

Amendment 53

Proposal for a regulation

Article 18 – paragraph 1

Or. en

Amendment 54

Proposal for a regulation

Article 19 – paragraph 1 – point 1 – point a – point 1

Regulation (EU) 2021/694

Article 7 –6, paragraph 1 – point ca (new)

PROCEDURE – COMMITTEE ASKED FOR OPINION

Or. en

FINAL VOTE BY ROLL CALL IN COMMITTEE ASKED FOR OPINION

Amendment 55

Proposal for a regulation

Article 20 – paragraph 1

Or. en