Following the Commission Recommendation for a common European approach to the security of 5G networks, 24 EU Member States have now completed the first step and submitted national risk assessments. These assessments will feed into the next phase, a EU-wide risk assessment which will be completed by 1 October. Commissioner for the Security Union, Julian King, and Commissioner for the Digital Economy and Society, Mariya Gabriel, welcomed this important step forward and said:

“We are pleased to see that most Member States have now submitted their risk assessments. Following the support expressed by the European Council on 22 March for a concerted approach, Member States responded promptly to our call for concrete measures to help ensure the cybersecurity of 5G networks across the EU. The national risk assessments are essential to make sure that Member States are adequately prepared for the deployment of the next generation of wireless connectivity that will soon form the backbone of our societies and economies.

We urge Member States to remain committed to the concerted approach and to use this important step to gain momentum for a swift and secure rollout of 5G networks. Close EU-wide cooperation is essential both for achieving strong cybersecurity and for reaping the full benefits, which 5G will have to offer for people and businesses.

The completion of the risk assessments underlines the commitment of Member States not only to set high standards for security but also to make full use of this groundbreaking technology. We hope that the outcomes will be taken into account in the process of 5G spectrum auctions and network deployment, which is taking place across the EU now and in the coming months. Several Member States have already taken steps to reinforce applicable security requirements while others are considering introducing new measures in the near future.

We need all key players, big and small, to accelerate their efforts and join us in building a common framework aimed at ensuring consistently high levels of security. We look forward to continuing our close cooperation with Member States as we begin the work on an EU-wide risk assessment, due to be complete by 1 October, that will help to develop a European approach to protecting the integrity of 5G.”

National risk assessments include an overview of:

·    the main threats and actors affecting 5G networks;

·    the degree of sensitivity of 5G network components and functions as well as other assets; and

·    various types of vulnerabilities, including both technical ones and other types of vulnerabilities, such as those potentially arising from the 5G supply chain.

In addition, the work on national risk assessments involved a range of responsible actors in the Member States, including cybersecurity and telecommunication authorities and security and intelligence services, strengthening their cooperation and coordination.

Next Steps

Based on the information received, Member States, together with the Commission and the EU Agency for Cybersecurity (ENISA), will prepare a coordinated EU-wide risk assessment by 1 October 2019. In parallel, ENISA is analysing the 5G threat landscape as an additional input. 

By 31 December 2019, the NIS Cooperation Group that leads the cooperation efforts together with the Commission will develop and agree on a toolbox of mitigating measures to address the risks identified in the risk assessments at Member State and EU level.

Following the recent entry into force of the Cybersecurity Act at the end of June, the Commission and the EU Agency for Cybersecurity will set up an EU-wide certification framework. Member States are encouraged to cooperate with the Commission and the EU Agency for Cybersecurity to prioritise a certification scheme covering 5G networks and equipment.

By 1 October 2020, Member States should assess in cooperation with the Commission, the effects of measures taken to determine whether there is a need for further action. This assessment should take into account the coordinated European risk assessment.

Background

Fifth generation (5G) networks will form essential digital infrastructure in the future, connecting billions of objects and systems, including in critical sectors such as energy, transport, banking, and health, as well as industrial control systems carrying sensitive information and supporting safety systems.

The European Commission recommended on 26 March 2019 a set of concrete actions to assess cybersecurity risks of 5G networks and to strengthen preventive measures, following the support from Heads of State or Government for a concerted approach to the security of 5G networks.

The Commission called on Member States to complete national risk assessments and review national measures as well as to work together at EU level on a coordinated risk assessment and a common toolbox of mitigating measures.

The European Commission today adopted a new set of assistance measures worth €1.41 billion, ensuring continued European Union support to refugees and host communities in Turkey. The programmes will focus on the areas of health, protection, socio-economic support and municipal infrastructure. The new measures are part of the second tranche of the Facility for Refugees in Turkey, bringing the total amount already allocated to €5.6 billion out of €6 billion since 2016, with the remaining balance due to be allocated over the summer.  

Johannes Hahn, Commissioner for European Neighbourhood Policy and Enlargement Negotiations, said: “With this new allocation of funds, the European Union continues to deliver on its commitment to support Turkey in hosting the largest group of refugees in the world. Our assistance will focus on healthcare and protection services to refugees, and increase the resilience and self-reliance of refugees and host communities through socio-economic support. In addition, we will support municipal infrastructure in provinces with a high number of refugees.”

The new assistance measures focus on long-term support and development assistance, as a combination of agreements with partners and relevant Turkish ministries. Contracts should be signed by end-2020 and actions should be completed by mid-2025 at the latest.

A particular feature of today’s financial allocation is that it aims to ensure the sustainability of Facility-funded activities, reflecting the need for sustainable support for refugee inclusion, self-reliance and integration beyond the EU Facility.

Background

The EU Facility for Refugees in Turkey was set up in 2015 in response to the European Council’s call for significant additional funding to support Syrian refugees in Turkey. It has a total budget of €6 billion divided into two equal tranches of €3 billion each. Out of the operational funds of €6 billion, over €2.35 billion has already been disbursed, €3.5 billion contracted and €5.6 billion allocated, with over 80 projects already rolled out.

The Facility provides for a joint coordination mechanism of EU budget and Member States’ contributions designed to ensure that the needs of refugees and host communities are being addressed in a comprehensive and coordinated manner. The support seeks to improve conditions for refugees in Turkey as part of the EU’s comprehensive approach to addressing the refugee crisis inside and outside the EU.

In a ruling delivered on Wednesday, the International Court of Justice (ICJ) ordered Pakistan to review a death sentence handed down in the case of a former Indian Navy officer accused by Pakistan of spying, finding that the country’s authorities acted in breach of the Vienna Convention, which lays out rules for diplomatic relations between countries.

Kulbhushan Jadhav, said the Court, had not been informed of his rights by the Pakistani authorities, and that the Indian Government has been deprived of “consular access”: the right to communicate with him.

During the hearings, the ICJ had directed Pakistan not to carry out the death sentence until the Court’s final ruling. On Wednesday, the Court ordered a “continued stay of execution”, as a “indispensable condition for the effective review and reconsideration of the conviction and sentence”.

Mr. Jadhav was arrested three years ago by Pakistani authorities, who say that he was in the restive Balochistan province, which is home to a separatist insurgency that Pakistan accuses India of backing. The charges levelled against Mr. Jadhav were of “espionage and sabotage activities against Pakistan”.

Although a video was released shortly after Mr. Jadhav’s arrest, in which he was shown admitting involvement in spying, India has always questioned the alleged confession, saying that it was extracted under duress. The Indian authorities also deny that Jadhav is a spy and say that he was kidnapped in Iran, which borders the province, which he was visiting on business.

Following Pakistan’s pronouncement of the death penalty, in April 2017, India filed a case with the ICJ, calling the trial, which took place in a military court, “farcical”, and asked for a stay of execution and consular access to Mr. Jadhav. Pakistan countered that Mr. Jadhav was not given consular access because he is a spy who illegally entered the country in order to create “unrest and instability”.