text: www.enisa.europa.eu European Union Agency For Network And Information Security

text: Annual Incident Reports 2016

text: June 2017

text: Annual Incident Reports 2016

text: June 2017

text: Annual Incident Reports 2016

text: June 2017

text: Annual Incident Reports 2016

text: June 2017

text: See https://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidents-reporting/power-supply-dependencies/ See http://www.enisa.europa.eu/media/press-releases/using-national-roaming-to-mitigate-mobile-network-outages201dnew-report-by-eu-cyber-security-agency-enisa See https://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidents-reporting/requirements-ecomms-vendors See https://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidents-reporting/protection-of-undergroundinfrastructure See https://www.enisa.europa.eu/publications/security-measures See https://www.enisa.europa.eu/publications/security-incidents-indicators See https://www.enisa.europa.eu/publications/impact-evaluation-article13a

text: Annual Incident Reports 2016

text: June 2017

text: See http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32009L0140:en:NOT See https://ec.europa.eu/digital-agenda/sites/digital-agenda/files/Copy of Regulatory Framework for Electonic Communications 2013 NO CROPS.pdf See http://resilience.enisa.europa.eu/article-13

text: Annual Incident Reports 2016

text: June 2017

text: EC Incident notification Annual reporting ENISA

text: Member state Member state

text: National National authority authority

text: Network or Network or Network or Network or Network or Network or service service service service service service provider provider provider provider provider provider

text: Figure 1: Incident reporting in

text: Article 13

text: a

text: Here integrity means network integrity, which is often called availability or continuity in information security literature. https://ec.europa.eu/digital-single-market/en/news/public-consultation-evaluation-and-review-regulatory-frameworkelectronic-communications

text: Annual Incident Reports 2016

text: June 2017

text: Annual Incident Reports 2016

text: June 2017

text: See https://resilience.enisa.europa.eu/article-13/guideline-for-incident-reporting See https://resilience.enisa.europa.eu/article-13/guideline-for-minimum-security-measures See https://resilience.enisa.europa.eu/article-13/guideline_on_threats_and_assets

text: Annual Incident Reports 2016

text: June 2017

text: CLASSIC SERVICES OTHER SERVICES (SINCE 2016)

text: Fixed telephony SMS Mobile telephony MMS Fixed Internet access Satellite TV Mobile Internet access International roaming RADIO broadcasting TV broadcasting Cable TV IPTV Video on demand Public WIFI Web based voice services Web-based messaging services Public email services

text: Table 1: Services in scope

text: Reference is made to the definition agreed in the COCOM meetings.

text: Annual Incident Reports 2016

text: June 2017

text: Table 2: Threshold for annual summary reporting based on a combination of duration and the percentage of the national user base.

text: Annual Incident Reports 2016

text: June 2017

text: 2011 2012 2013 2014 2015 2016 Total incidents above EU thresholds Total incidents in annual reports

text: Figure 2: Total incidents in annual reports vs. Total incidents above thresholds

text: Annual Incident Reports 2016

text: June 2017

text: See https://www.enisa.europa.eu/publications/impact-evaluation-article13a

text: Annual Incident Reports 2016

text: June 2017

text: Figure 3: Countries involved in the annual summary reporting in 2015.

text: Annual Incident Reports 2016

text: June 2017

text: Figure 4: Incidents per classic services (percentage)

text: Annual Incident Reports 2016

text: June 2017

text: Figure 5: Incidents per other service (percentage)

text: Figure 6: Average number of user connections affected per incident per classic service (1000s).

text: Annual Incident Reports 2016

text: June 2017

text: Figure 7: Average number of user connections affected (1000s) - other services

text: Figure 8: Percentage of national user base affected on average per incident per service.

text: Annual Incident Reports 2016

text: June 2017

text: Figure 9: Impact on emergency calls.

text: Figure 10: Impact on interconnections (percentage)

text: Annual Incident Reports 2016

text: June 2017

text: Figure 11: Incidents per root cause category (percentage).

text: Figure 12: Third party failures and non-third party failures of all incidents (percentages).

text: Annual Incident Reports 2016

text: June 2017

text: Figure 13: Root cause categories for fixed telephony (percentage).

text: Figure 14: Root cause categories for fixed Internet (percentage).

text: Annual Incident Reports 2016

text: June 2017

text: Figure 15: Root cause categories for mobile telephony (percentage).

text: Figure 16: Root cause categories for mobile Internet (percentage).

text: Annual Incident Reports 2016

text: June 2017

text: Figure 17: Root cause categories for other services (percentage).

text: Figure 18: Average number of user connections affected per incident per root cause (1000s)

text: Annual Incident Reports 2016

text: June 2017

text: Figure 19: Average duration of incidents per root cause category (hours).

text: Figure 20: User hours lost per root cause category (hours).

text: Annual Incident Reports 2016

text: June 2017

text: Figure 21: Detailed causes of reported incidents (percentage)

text: Annual Incident Reports 2016

text: June 2017

text: Figure 22: Detailed causes for fixed telephony (percentage).

text: Figure 23: Detailed causes for fixed Internet (percentage).

text: Annual Incident Reports 2016

text: June 2017

text: Figure 24: Detailed causes for mobile telephony (percentage).

text: Figure 25: Detailed causes for mobile Internet (percentage).

text: Annual Incident Reports 2016

text: June 2017

text: Figure 26: Detailed causes for other services (percentage).

text: Figure 27: Average number of user connections affected per detailed cause (hours).

text: Annual Incident Reports 2016

text: June 2017

text: Figure 28: Average duration of incidents per detailed cause category (hours).

text: Figure 29: User hours lost per detailed cause (hours).

text: Annual Incident Reports 2016

text: June 2017

text: See http://www.pwc.com/gx/en/issues/cyber-security/information-security-survey.html See https://ec.europa.eu/digital-single-market/en/news/digital-single-market-commission-calls-swift-adoption-keyproposals-and-maps-out-challenges See http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52016PC0590&from=EN

text: Annual Incident Reports 2016

text: June 2017

text: Annual Incident Reports 2016

text: June 2017

text: Figure 30: Assets affected by the incidents (percentage).

text: Annual Incident Reports 2016

text: June 2017

text: Figure 31: Assets affected by system failures (percentages).

text: Annual Incident Reports 2016

text: June 2017

text: Annual Incident Reports 2016

text: June 2017

text: Annual Incident Reports 2016

text: June 2017

identifier: Annual Incident Reports 2016

title: Annual Incident Reports 2016

text: Analysis of Article 13a annual incident reports in the telecom sector JUNE 2017

text: About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Contact

text: For contacting the authors please use resilience@enisa.europa.eu. For media enquires about this paper, please use press@enisa.europa.eu.

text: Acknowledgements

text: For the completion of this report ENISA has worked closely with a group of experts from National Regulatory Authorities and ministries from across Europe. Listing the organizations (in no particular order): PTS (SE), FICORA (FI), Ofcom (UK), ANACOM (PT), ComReg (IE), EETT (GR), ADAE (GR), Centre for Cyber Security - CFCS (DK), RTR (AT), ANCOM (RO), CRC (BG), Ministry of Economics, Finance and Industry (FR), Bundes-netzagentur (DE), BIPT (BE), Agentschap Telecom (NL), MINETUR (ES), MPO (CZ), CTO (CZ), CERT LT (LT), Teleoff (SK), ILR (LU), PECSRS (SI), MCA (MT), Ministry of Economic Development (IT), OCECPR (CY), Nkom (NO), RIA (EE), NMHH (HU), ITSIRI (LV), OEC (PL), AKOS (SI), OFCOM (CH), and HAKOM (HR).

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Copyright Notice

text: © European Union Agency for Network and Information Security (ENISA), 2017 Reproduction is authorised provided the source is acknowledged.

text: Cover images: © Shuttestock. For reproduction or use of these photos, permission must be sought directly with the copyright holder.

text: ISBN: 978-92-9204-222-6, DOI: 10.2824/21700

text: Table of Contents

text: Executive Summary 4

text: 1. Introduction 6

text: Article 13

text: a of the Framework Directive: ‘Security and Integrity’ 7

text: Article 13

text: a Expert Group and Incident Reporting Procedure 9

text: Incident reporting procedure 9

text: 4. Analysis of the incidents 14

text: Impact of incidents 15

text: Root cause categories 19

text: Detailed causes 24

text: Analysis of arising cybersecurity trends/issues 29

text: Assets affected 30

text: 5. Conclusions 33

text: References 35

text: Executive Summary

text: For the sixth year, ENISA publishes the annual report about significant outage incidents in the European electronic communications sector, which are reported to ENISA and the European Commission under

text: Article 13

text: a of the Framework Directive (

text: ), by the National Regulatory Authorities (NRAs) of the different EU Member States. This report covers the incidents that occurred in 2016 and it gives an aggregated analysis of the incident reports about severe outages across the EU. This report does not include details about individual countries or providers. The aim of the incident reporting scheme is to provide transparency to society and to learn from past incidents in the electronic communications sector in order to systematically improve the security of the networks and services. This report provides an overview on an aggregated level of what services and network assets are impacted and the root causes of the incidents. Conclusions on the main patterns of incidents are drawn, contributing to discussions at policy level on strategic measures to improve the security in the electronic communications sector. The main conclusions from this year’s incident reporting are the following:

text:  158 major incidents reported: This year 24 countries, including two EFTA countries, reported 158 significant incidents that occurred in 2016, while 6 countries reported they had no significant incidents. 102 incidents were above the informal EU thresholds.  Mobile internet most affected service: In 2016 most incidents affected mobile internet (48% of all reported incidents). Mobile internet and mobile telephony were the predominant affected services in the previous years also, except for 2014 where fixed telephony was the most affected.  System failures are the dominant root cause of incidents: Most incidents were caused by system failures or technical failures (almost 73% of the incidents) as a root cause. This has been the dominant root cause for all the reporting years so far. In the system failures root category, software bugs and hardware failures were the most common causes affecting core network equipment.  System failures affected on average more user connections per incident: In 2016 system failures was the root cause category involving most users affected per incident (around 2 million user connections on average per incident). The second place was taken by malicious actions with 1.2 million user connections on average per incident.  Malicious actions along with natural phenomena are not among the main root causes creating disruptions: the total number of incidents caused by malicious actions was 5.1%; double compared to previous year (2.5% in 2015).  Malware caused the longest lasting incidents this year: Incidents caused by malware, although there were not too many of them, had most impact in terms of duration and user hours lost.  Emergency services are affected by incidents: Same as last year, 20 % of the incidents affected the 112 emergency services, a considerably high percentage.  Mobile base stations and controllers the most affected assets: Overall, mobile base stations and controllers and mobile switches were the network components most affected by incidents (7% and 6% respectively). The analysis of annual incident reports the last six years has revealed specific trends and patterns of root causes, detailed causes and affected services. These assets and threats need particular attention when carrying out risk and vulnerability assessments in the electronic communications sector.

text: ENISA is permanently analysing the current threat environment and develops projects that address particular technical or policy related topics directly linked to the electronic communications sector. In the context of Article13a efforts, ENISA has been conducting many supporting activities in order to provide a holistic and in-depth view to providers that need to assess risks, take appropriate security measures, and report about significant security incidents. Based on the annual summary reporting of previous years, ENISA analysed power supply dependencies , and issued recommendations regarding the sector’s ability to withstand and act efficiently after power cuts. ENISA also studied in 2013 national roaming for increased resilience in mobile networks . Last year, based on the annual summary reporting of 2012 and 2013 incidents, ENISA has issued recommendations for providers about how to manage security requirements for vendors of ICT equipment and outsourced services used for core operations. Based on the 2012 and 2013 summary reporting ENISA has also studied national initiatives to reduce the number of underground cable breaks caused by mistakes . ENISA has developed studies in order to facilitate NRAs as well as telco providers to incorporate these recommendations to their security activities. Recently developed a study on security measures implemented by electronic communication providers , and alternative indicators for measuring impact in electronic communications services . Furthermore, in 2015, ENISA developed an impact evaluation of the Art. 13a provisions , with the purpose of assessing the changes in outcome that can directly be attributed to the article, the effects caused by this particular set of obligations within the Telecom Package.

text: 1. Introduction

text: The current document represents the sixth iteration of the report “Annual Incident Reports”, which summarises significant outage incidents in the telecom sector reported to ENISA and the European Commission (EC), under

text: Article 13

text: a of the Framework Directive (

text: ) , an article introduced in the 2009 reform of the EU regulatory framework for electronic communications . This year ENISA and EC received 158 incident reports from NRAs, about severe outages in the EU’s electronic communication networks and/or services which occurred in 2016. This report provides an aggregate analysis of these 158 incidents. Please note that in this document we do not provide details from the individual incident reports. The analysis is only an aggregation in terms of averages and percentages across the EU and EFTA countries, and it does not contain references to specific countries or specific providers. Individual incidents are discussed in more detail with the NRAs in the

text: Article 13

text: a Expert Group . This document is structured as follows: Section 2 and Section 3 briefly summarize

text: Article 13

text: a and the details of the technical implementation of

text: Article 13

text: a, as agreed in the

text: Article 13

text: a Expert Group by the different NRAs of the EU Member States. Section 4 analyses the incidents from 2016 which were reported to ENISA and the Commission and provides examples of incidents. Section 5 provides the conclusions. In the separate document of Annex (Annexes A-D) we show graphs with the trend over the years to allow for the reader to make a comparison with data from previous years. This comparison should however be done with caution, as the methodology for details in the reporting has been improved over the years and the thresholds have been lowered year by year allowing for more incidents to be reported.

text: Article 13

text: a of the Framework Directive: ‘Security and Integrity’

text: The reform of the EU regulatory framework for electronic communications , which was adopted in 2009 and was transposed by most EU countries around May 2011, added

text: Article 13

text: a to the Framework Directive .

text: Article 13

text: a addresses the security and integrity of public electronic communications networks and services. The legislation concerns National Regulatory Authorities (NRAs) and providers of public electronic communications networks and services (providers).

text: Article 13

text: a states:  Providers of public electronic communications networks and services should take measures to guarantee security and integrity of their networks.  Providers must notify competent national authorities about breaches of security or loss of integrity that have had significant impact on the operation of networks or services.  National Regulatory Authorities should notify ENISA and national authorities abroad when necessary, for example in case of incidents with cross-border impact.  Annually, National Regulatory Authorities should submit a summary report to ENISA and the European Commission about the incidents.

text: These incident reporting flows (incident notification and annual reporting) are shown in the diagram below. This document analyses the incidents from 2015 that have been reported to ENISA (the black dashed arrow).

text: In late 2015 the European Commission started the process of revising the regulatory framework on electronic communications in order to “assess the current rules and to seek views on possible adaptations to the framework in light of market and technological developments, with the objective of contributing to the Digital Single Market Strategy” . A public consultation concerning the evaluation and review of the current regulatory framework was ended in December 2015. In this context, ENISA along with the

text: Article 13

text: a Expert Group submitted an opinion on

text: the evaluation and review of

text: Article 13

text: a and 13b of the Framework Directive, an area which is at the core of ENISA expertise and competence.

text: Article 13

text: a Expert Group and Incident Reporting Procedure

text: In 2010, ENISA, Ministries and NRAs initiated a series of meetings (workshops, conference calls) to achieve a harmonised implementation of

text: Article 13

text: a of the Framework directive. In these meetings, a group of experts from NRAs, called the

text: Article 13

text: a Expert Group, reached agreement on two non-binding technical documents providing guidance to the NRAs in the EU Member States:

text:  Technical Guideline on Incident Reporting  Technical Guideline on Security Measures

text: Later on, in 2014, the group of experts agreed on the third non-binding technical document:

text:  Technical Guideline on Threats and Assets

text: The

text: Article 13

text: a Expert Group continues to meet several times a year to develop the technical guidelines and to discuss the implementation of

text: Article 13

text: a (for example, on how to supervise the electronic communications sector) and to share knowledge and exchange views about past incidents, and how to address them.

text: Incident reporting procedure

text: In spring 2012, the EC agreed with the EU Member States (in meetings of the Communications Committee, COCOM) to do the first round of annual summary reporting on the 2011 incidents impacting the continuity of supply of electronic communications services. The decision included a recommendation to use the reporting template agreed within the

text: Article 13

text: a Expert Group and published by ENISA. Following the COCOM meeting, ENISA implemented the technical procedure by deploying a basic electronic form based on the

text: Article 13

text: a Technical Guideline on Incident Reporting. There was also an agreement that in the coming years, annual reporting would be carried out by the end of February each year. In autumn 2012, ENISA developed an online incident reporting tool (called CIRAS), which replaces the electronic forms exchanged by email. CIRAS allows NRAs to exert greater control over the data reported and provides the NRAs with better access to data about incidents reported across the EU. Since 2015 ENISA is providing the possibility for the NRAs to extract graphs from CIRAS based on their search results. We briefly explain the main features of the incident reporting procedure, as described in the

text: Article 13

text: a Technical Guideline on Incident Reporting, which was developed in collaboration with the NRAs.

text: 3.1.1 Services in scope

text: Although the focus of this report is still on the main 4 types of classic services, due to latest technological and legal advancements, we have decided to extend the number of services. As some of those services become more and more important in the EU digital market, and some countries already cover them through their national level regulations, their inclusion in ENISA’s annual report is a must as preparatory work needs to be done to cover them in the future.

text: Besides the four main services (aka. classic services), others were added as follows:

text: 3.1.2 Security incidents in scope

text: NRAs are required to report security incidents, which had a significant impact on the continuity of supply of electronic communications services. As explained, not all types of incidents are reportable under the Art. 13a provisions. Depending on the national implementation of Art. 13a, if one incident does not affect the continuity of the service (availability), although confidentiality or integrity might be affected, the incident does not need to be reported.

text: 3.1.3 National user base

text: NRAs should provide estimates of the total number of users of each service in their country. The national user base is used for determining the significance of incidents, in cases where the threshold is relative to the national user base.  For fixed telephony and Internet, NRAs should use the number of subscribers or access lines in their country.  For mobile telephony, NRAs should use the number of active telephony SIM cards.  For mobile Internet, NRAs should sum up : 1. The number of standard mobile subscriptions, which offer both telephony and Internet access, and which have been used for Internet access recently (e.g. in the past 3 months). 2. The number of subscriptions dedicated for mobile Internet access, which are purchased separately, either standalone or on top of an existing voice subscription.  For other types of services that are still in an experimental phase no national user base was collected at this point.

text: 3.1.4 Thresholds

text: Art. 13a provisions state that Member States (MS) shall ensure that electronic communication providers will “notify the competent national regulatory authority of a breach of security or loss of integrity that has had a significant impact on the operation of networks or services”. However, the thresholds for defining significant incidents were not established through the Directive and the EC has not issued any implementing measures in this sense leaving the matter open for discussions and unrestricted for national implementation. At this point the activities of ENISA

text: and Art. 13a expert group have proved to be very useful by defining a set of informal and non-binding EU thresholds

text: to help Member States in reporting or setting up their own national level thresholds. In this respect a set of EU thresholds were adopted by the Art. 13a expert group that are known and accepted by every country, but it has remained at the discretion of each Member State to adopt its own national thresholds. All incidents reported within the annual report to ENISA and EC, and presented within this report, are based on the thresholds established at national levels, which can be above or below (in most of the cases they are below) the EU thresholds. For an analysis of incidents based on the informal EU level thresholds see Section 3.1.5. The EU thresholds for the annual summary reporting are based on the duration and the number of users of a service affected as a percentage of the national user base of the service. NRAs should send an incident report, as part of the annual summary reporting, if the incident:  lasts more than an hour, and the percentage of users affected is higher than 15 %,  lasts more than 2 hours, and the percentage of users affected is higher than 10 %,  lasts more than 4 hours, and the percentage of users affected is higher than 5 %,  lasts more than 6 hours, and the percentage of users affected is higher than 2 %, or if it  lasts more than 8 hours, and the percentage of users affected is higher than 1 %. >8 1h 2h 4h 6h <. <. <. <. h ..<2 ..<4 ..<6 ..<8 h h h h

text: 1%<...< 2% of user base

text: 2%<...< 5% of user base

text: 5%<...< 10% of user base

text: 10%<...< 15% of user base

text: > 15% of user base

text: The threshold should be understood on a “per service” basis. In other words, if an incident impacts multiple services, then for one of the services the threshold should be passed in order to trigger the reporting mechanism. NRAs have the discretion to also report incidents with impact graded below the threshold. Since 2013, we introduced a new optional threshold for annual summary reporting, based on absolute impact, in order to allow for NRAs in large Member States to include larger incidents but that would not exceed the relative thresholds. This absolute threshold has been lowered for 2014 and has now become mandatory. NRAs should

text: include incidents when the product of duration and number of user connections affected exceeds 60 million user minutes, or 1 million user hours. Note that the introduction of this mandatory and lowered absolute threshold has

text: led to an increase in the number of reported incidents to ENISA and the Commission.

text: In case of the services that deviate from the four main services no thresholds were established. Member states could report incidents that they consider significant.

text: 3.1.5 EU thresholds vs. national level thresholds

text: Art. 13a provisions state that member states shall ensure that electronic communication providers will “notify the competent national regulatory authority of a breach of security or loss of integrity that has had a significant impact on the operation of networks or services”. But the thresholds for defining significant incidents were not established through the Directive and the EC has not issued any implementing measures in this sense leaving the matter open for discussions and unrestricted as regards the national implementation. At this point the activities of ENISA and Art.

text: 13a expert group have proved to be very useful by defining a set of informal and non-binding EU thresholds to help

text: member states in reporting or setting up their own national level thresholds. In this respect a set of EU thresholds were adopted by the Art. 13a expert group that are known and accepted by every country, but it has remained at the discretion of each Member State to adopt its own national thresholds. All incidents reported within the annual report to ENISA and EC, and presented within this report, are based on the thresholds established at national levels, which can be above or below (in most of the cases they are below) the EU thresholds. This section presents a short analysis of incidents based on the informal EU level thresholds.

text: According to our estimations more than half of the EU member states have thresholds below the ones defined by ENISA while others use the same thresholds.

text: 3.1.6 Root cause categories

text: In the incident reports four categories of root causes have been outlined plus one category that is used in conjunction with one of the other four categories.  Natural phenomena – This category includes incidents caused by severe weather, earthquakes, floods, pandemic diseases, wildfires, wildlife, and so on.  Human errors - This category includes incidents caused by errors committed by employees of the provider or outside the provider, during the operation of equipment or facilities, the use of tools, the execution of procedures, etc. E.g. an excavator cutting off a cable.  Malicious attacks - This category includes incidents caused by a deliberate act by someone or some organisation, e.g. a Denial of Service attack disrupting the service, or a cable theft.  System failures – This category includes incidents caused by technical failures of a system, for example caused by hardware failures, software bugs or flaws in manuals, procedures or policies.

text:  Third party failures – This category includes incidents caused by a failure or incident at a third party. The category is used in conjunctions with one of the other four root cause categories.

text: 3.1.7 Detailed causes

text: In the incident reports, detailed causes are specified in terms of “initial cause” and “subsequent cause”. “Initial cause” is the event or factor that triggered the incident. Often incidents involve a chain of events or factors, and by specifying a “subsequent cause” NRAs may indicate a cause that subsequently played a role in the incident. In the ENISA annual reports the initial and subsequent causes are equally presented in the graphs of the detailed causes. These detailed causes are referred to as “threats” in the

text: Article 13

text: a Technical Guideline on Threats and Assets . In the report, which is used by the NRAs as a guide for the annual summary reporting, the causes/threats are listed and described.

text: 3.1.8 Assets affected

text: Optionally NRAs may indicate what network assets were affected by the incidents, e.g. HLRs, routers and switches, underground cables etc. These assets are listed and described in the

text: Article 13

text: a Technical Guideline on Threats and Assets.

text: 3.1.9 Impact evaluation on the implementation of

text: Article 13

text: a incident reporting scheme

text: As several years have passed since the publication and implementation of the Framework Directive including Art. 13a, an impact evaluation of the new article was the proper thing to do. This was done by ENISA along with the

text: Article 13

text: a Expert Group in 2015. The evaluation had the purpose of assessing the changes in outcome that can directly be attributed to the provision of Art. 13a, the effects caused by this particular set of obligations within the Telecom Package. The evaluation focused on 5 key areas, where we tried to identify possible outcomes:  The new security measures implemented in the member states;  The transparency resulting from the incident reporting process;  The learning process resulting from incidents;  The level of collaboration between the stakeholders;  The harmonization of the procedures within the European Union.

text: The evaluation done within this project has brought to light some important outcomes that have definitely contributed to increasing the resilience and security of the telecommunications infrastructures in Europe. In a European Union which was highly diversified in terms of security measures, Art. 13a brought a certain amount of uniformity in the approach taken regarding security of telecommunication services, but more importantly contributed to strengthening the European telecom infrastructure’s resilience and services availability across the EU. The role of ENISA, especially in the coordination of Art. 13a expert group, was most beneficial as it helped considerably in bringing more harmonization within the implementation process and collaboration among stakeholders (NRAs and providers). Findings and conclusions of the Impact evaluation on the implementation of

text: Article 13

text: a incident reporting scheme have served as an input to the EU Commission in the telecom framework evaluation process.

text: 4. Analysis of the incidents

text: In total, all 28 EU Member States and 2 EFTA country participated in this process. Of these, 22 Member States and 2 EFTA countries reported in total 158 significant incidents and 6 countries reported there were no significant incidents. An increase from previous year where 21 countries reported significant incidents.

text: In this section, the 158 reported incidents are aggregated and analysed. First, the impact per service is analysed (in Section 4.1), then the impact per root cause category is analysed (Section 4.2), and in Section 4.3 detailed causes are examined. In Section 4.3.5 the impact, as a product of user connections affected and duration of the incidents, is analysed, and in Section 4.4 the components or assets affected by the incidents are considered. Throughout the text we provide anonymized descriptions (in blue italic) of actual large-scale incidents which occurred in 2015. In annex A-D we show graphs including the previous two years to allow the reader to make a comparison. This comparison should however be done with caution, see below.

text: Note about statistical conclusions: Readers should be cautious when drawing conclusions from the statistics in this

text: report. In particular, they should take into account that: 1. The scope of reporting major security incidents is restricted to incidents with an impact on the continuity of public electronic communication services and networks. There are many other types of incidents with an impact on security of services and networks which are not in scope of annual reporting. For example, if attackers would wiretap undersea cables without causing any outages, then such a security incident would not be included in the annual reporting. 2. The scope of reporting includes major, or significant, incidents scoring above the agreed reporting thresholds (Table 2). Smaller incidents are not reported at EU level, meaning that the view is skewed towards the larger incidents. 3. Year by year we are in collaboration with the NRAs and in some cases the thresholds that define the significance of incidents are modified. This may cause the number of reported incidents to fluctuate. Until now the thresholds have only been lowered, causing in some years an increase in the number of incidents. This doesn’t necessarily mean that the number of incidents throughout the EU is increasing. 4. We are continuously working in collaboration with the NRAs for improved quality in the incident reporting. There are still changes, more details and improvements in the way national and EU reporting is being implemented, including the lowering of reporting thresholds and refinements of parameters for reporting.

text: Statistical conclusions about multi-annual trends should therefore be drawn with caution.

text: 5. All incidents reported within the annual report to ENISA and EC, and presented within this report, are based on the thresholds established at national levels, which can be above or below (in most of the cases they are below) the EU thresholds. For an analysis of incidents based on the informal EU level thresholds see Section 3.1.5.

text: Impact of incidents

text: First we look at the electronic communications services and compare them with each other in terms of incidents.

text: 4.1.1 Impact per service

text: For third year in a row most of the reported incidents affected mobile internet. Both mobile internet and mobile telephony services had an increase on incidents compared to last year’s results. In 2014 the most affected service was fixed telephony (see Annex A).

text: Note that most reported incidents usually have an impact on more than one service in the same incident (which is why the percentages in the chart add up to more than 100 %).

text: A system failure affected mobile internet to fail for millions of users (duration: hours, connections: millions, cause: software bug): A software bug occurred in the Internal system component SDM leading to the degradation

text: of user authorization mobile data and mobile voice. As a result end users had difficulties to access mobile services, both voice and data locally and also abroad (roaming services). Mobile switches and mobile user registerss were affected by this bug. Provider removed the obstacles in accessing the services and for the prevention of similar incidents in the future, a mitigation plan was created in collaboration with software vendors.

text: Other services

text: Apart from the four main services, the most affected services are SMS (16,5), Cable TV (7,6%) and MMS (7%).

text: 4.1.2 Number of user connections affected

text: Mobile Internet outages affected most user connections compared to the other services, with an average of 1.3 million user connections affected per reported incident. Also in past reporting years mobile internet failures affected most user connections, and mobile telephony failures came in second place, see Annex A.

text: Note that the averages in these diagrams include both small and large countries, so EU averages shown in the diagram above are not necessarily representative for the size of incidents occurring nationally. The average size of

text: national incidents can be very different, depending on the size of the population and the national network topology. What is interesting to note is the comparison between the affected services in terms of affected user connections.

text: The evolution of the number of affected connections can be seen in Annex A.

text: Other services

text: The average number of connections affected for Radio broadcasting is 2 million. As for MMS (1.3 million) and SMS (1.2 million) services is in the same range as mobile telephony/mobile internet underlining the interconnection between the two.

text: 4.1.3 Percentage of the national user base affected

text: Mobile Internet outages impacted on average 14% of the national user base for mobile Internet user connections, which is a slight increase compared to the previous years, see annex A.3. All five years, mobile Internet has been reported to suffer the most impact in terms of percentage of its national user base compared to the other services.

text: 4.1.4 Impact on emergency services

text: In more than 20% of incidents reported, emergency calls were impacted - i.e. the possibility for users to contact emergency call-centres using the emergency number 112.

text: 4.1.5 Impact on interconnections

text: In 7 % of incidents reported there was an impact on interconnections between providers. Compared to previous year also this figure has decreased, see Annex A.

text: Root cause categories

text: In this section we look at the main root cause categories of reported incidents. For a description of the root cause categories, see section 3.1.5.

text: 4.2.1 Incidents per root cause category

text: This year, almost 73% of the reported incidents were caused by system failures or technical failures, a ratio which is consistent compared to all the previous years, see Annex B. For all reporting years, system failures has been the most common root cause category. In second place, for this year is root cause of human errors 11,4% of the reported incidents, also consistent with previous years. Malicious actions and natural phenomena caused the least of the incidents (both with 5,1%).

text: System failure caused disruption in all classic services and SMS/ MMS services affecting millions of users (duration: hours, connections: millions, cause: hardware failure): System failure caused outage of network components using

text: technology for DSL in the subscriber access network. Provider raised the capacities of network components in order to provide electronic communications service. As a next step a software upgrade of several selected network components was applied.

text: 4.2.2 Third party failures

text: About 22.5% of the incidents reported were categorized as third party failures, a significant increase compared to the previous year (14.8%), see Annex B.

text: 4.2.3 Root cause categories per service

text: In this section we look at the root causes for each of the four services separately: fixed telephony, fixed Internet access, mobile telephony and mobile Internet access. As in 2015, also in 2016, system failures was the dominant root cause for all services, scoring more than half of the incidents reported per service. For mobile telephony and mobile internet, this was the case also in the previous years, whereas the dominant root cause for fixed telephony and fixed internet oscillated in the previous years between natural phenomena and system failures, see Annex B.

text: 4.2.3.1 Fixed Telephony 4.2.3.2 Fixed Internet 4.2.3.3 Mobile telephony 4.2.3.4 Mobile internet 4.2.3.5 Other services

text: System failures is also the main root cause for other services besides the classic services, with a percentage of approximately 71%.

text: 4.2.4 Average number of user connections affected per root cause category

text: Also this year, system failures affected most user connections, on average about 2.0 million user connections per incident. In the previous year, system failures affected on average 1.6 million user connections.

text: 4.2.5 Average duration of incidents per root cause category

text: The reported incidents caused by natural phenomena had the longest recovery time on average per incident (400 hours). Excluding last year’s result where malicious action was the root cause with the longest incidents on average, natural phenomena tend to cause the longest incidents in terms of duration. For the evolution in time of the average duration pls. check Annex B.

text: 4.2.6 User hours lost per root cause category Detailed causes

text: Root cause categories are rather broad but give a good summary of the most common types of incidents. In this section we break down the root cause categories in predefined detailed causes of incidents. An incident is often not only triggered by one cause but often by multiple causes and a chain of causes. For instance, an incident may initially be triggered by heavy winds, which tear down power supply infrastructure causing a power cut, which in turn leads to an outage. For this incident both heavy winds and power cut are detailed causes. These detailed causes are equally represented in the statistics, because both causes may be addressed by the provider in terms of security measures.

text: 4.3.1 Detailed causes of all incidents

text: In 2016, the most common causes of incidents were hardware failures and software bugs. This can now be considered a trend as this has been the case all the previous years, with the first position being occupied by one or the other. Also power cuts and cable cuts seem to slightly decrease and leave their place from the top four causes of the last four years. Many detailed causes of incidents reports do not fall under a specific category and form the category of “Other” which has a significant position in the overall chart. However, analysing further these detailed causes we see that most of them describe a cause that resulted to a system failure. Even though most of the causes in Other category in generic terms fall either under Software bug or Faulty software change/update, we detail some that seem interesting: billing platform failure, connectivity failure, maintenance, scheduled work failure, STP error, redundancy failure, etc.

text: Hardware failure resulted in unavailability of services for more than a million users (duration: hours, connections: millions, causes: system failure): Outage of network components using technology for DSL in the subscriber access

text: network resulted to disruption of all classic services as well as SMS and MMS services. Provider responded to the incident by raising the capacities of network components in order to provide elelctronic communications service. Followed a software upgrade of several selected network components to resolve the issue completely.

text: 4.3.2 Detailed causes per service

text: In this section we show the detailed causes of incidents for each of the main four services (fixed telephony, fixed Internet, mobile telephony and mobile Internet) and for the other services. As in the previous year, also this year, Hardware failures were the most common causes for failures in all the main four services and for the other services as well.

text: 4.3.2.1 Fixed Telephony 4.3.2.2 Fixed Internet 4.3.2.3 Mobile Telephony 4.3.2.4 Mobile Internet 4.3.2.5 Other services

text: More than 50% of the incidents affecting other services, except the four main services, were caused by Hardware failures, Power cuts and Cable cuts, with 26%, 16% and 12% respectively. Cable cuts and Software bugs had the same percentage in this case.

text: 4.3.2.6 Average number of user connections affected per detailed cause category 4.3.3 Average duration of incidents per detailed cause category 4.3.4 User hours lost per detailed cause

text: An attempt at malware infection coming from a malicious action caused outage on fixed internet, fixed telephony, IPTV and DNS services for more than three days: (duration: days, connections: thousands, cause: Malicious action ): A worldwide attack of a botnet attempted to infect maintenance interfaces of customer premises equipments

text: with a malware. This attempt failed but caused a restricted access to electronic communications services. Provider mitigated this attack by implementing filtering measures in order to prevent further malicious attacks of this kind. Provider updated remotely the firmware in customer premises equipments (CPEs) and asked affected customers to disconnect CPEs from the power supply, and switch them on in order to finalise the update.

text: Analysis of arising cybersecurity trends/issues

text: For the reporting years 2012-2016, annual reports included in total 614 incident reports with 425 incident reports (69% of total incident reports) coming from system failures. On the other side, only 34 incident reports (5,5% of total incident reports) are a result of malicious actions. Approximately 76,5% of the malicious actions consist of cybersecurity attacks, namely Denial of Service attacks, malware / viruses and network hijacks, while the rest concern deliberate damages to physical infrastructure. During all the reporting years only 3 reported incidents were caused by malware. The proportion of malicious actions (especially cybersecurity related incidents) among the total number of incidents reported remains low due to the focus of the current regulation on the “availability” of services and networks, meaning mostly disruptions.

text: Considering the above we may conclude that malicious actions (especially cyber-attacks) are not necessarily focused on creating disruptions in Telecom, a conclusion that has already been presented in previous versions of this report. But, what we also can conclude is that, under the current form of Art. 13a within the Electronic Telecommunication Framework Directive, we do not have a very good overview of the cyber-attacks affecting the telecommunication infrastructure in EU. Although the present incident reporting scheme currently does not allow us to see the whole picture, external sources (public reports, statistics, online articles etc.) on Telecom incidents confirm an increasing trend as regards cyber-attacks. According to PwC’s Global State of Information Security, 2016 , IT security incidents in the telecom sector increased 45% in 2015 compared to the year before.

text: However, for the first time in the six year analysis of annual incident reports we see malware as the detailed cause, with the most impact in terms of average duration and user hours lost. Interestingly, the same terms of impact were trending in last year’s report but for root cause of malicious actions. It is of high importance to underline that cybersecurity related detailed causes appeared to result the most user hours lost for both years of 2015 and 2016.

text: According to Gartner, 8.4 billion connected things will be in use worldwide in 2017, an increase of 31 percent compared to 2016, and it is estimated that connected devices will reach 20.4 billion by 2020. The increasing spread of digital technologies, the burst of emerging technologies, such as Software Defined Networks (SDN), Network Function Virtualization (NFV) and IoT can lead to a growth in the number of cybersecurity attacks. The DSM strategy recognizes the importance of the paradigm shifts the digital sector is undergoing and aims to tackle regulatory fragmentation and build a more effective regulatory institutional framework.

text: In the light of the DSM strategy for Europe and based on the objective of ensuring a high-level of security of networks and services in telecommunication, the European Commission has drafted a new Proposal for the European Electronic Communications Code (EECC) . The new proposal of EECC will extend the incident reporting mechanism and will cover the entire threat landscape of telecommunications in EU by introducing:

text: a) a comprehensive definition of security in telecom. The revised definition of security puts in scope, apart from the availability, also the confidentiality, integrity and authenticity of services and networks.

text: b) a wider scope to include also number-independent interpersonal communications services,also called Over-The- Top (OTTs), and

text: c) new parameters for measuring significance of incidents. Parameters to determine significant incidents, expand

text: from user connections affected by the breach and duration of the breach, also to geographical spread, the extent to which the functioning service is disrupted, and to societal and economic impact.

text: The new EECC is expected to be adopted in 2018.

text: Additionally, regulations with substantial improvements on security that facilitate the coverage of the entire spectrum of the rapidly changing digital society have been adopted recently. The NIS Directive and GDPR will affect the regulatory obligations in the Telecom sector, requiring new procedures and more dimensions of information security compliance. The NIS Directive will introduce new requirements in the area of security measures and incident notification for Digital Service Providers (DSP) and Essential Services Operators (ESO). The NIS Directive and the new EECC converge on the incident reporting as many cloud services of

text: DSPs and digital infrastructure of ESOs share common resources coming from telecom providers.

text: The ePrivacy Directive and the GDPR, which provide together the legal framework to ensure digital privacy for EU citizens, will also affect the electronic communications sector.

text: The harmonisation level between all relevant security related EU level regulations has certainly increased in recent years. The providers will have to consider all these three legal acts when building their cyber security and compliance policies.

text: Assets affected

text: Also this year we received reports from NRAs about which components or assets of the electronic communications networks were affected by the incidents. This provides some more information about the nature of the outages and what assets of the infrastructure that were primarily involved in them.

text: 4.5.1 Assets affected overall

text: In 2016, mobile base stations and controllers, mobile switches and switches and routers were the assets most affected by incidents. For more details on the timeline of assets affected please see Annex D.

text: 4.5.2 Affected assets in system failures

text: As for all previous reporting years, system failures (or technical failures), was the most common root cause category in 2016. In these system failures, the most common assets that failed were mobile switches, switches and routers and other uncategorised assets. Also the previous year mobile switches, and switches and routers were the most common assets to fail in this root cause category.

text: 5. Conclusions

text: In this report ENISA summarized and analysed the outage incidents that were sent by the National Regulatory Authorities (NRAs) from member states and EFTA countries to ENISA and the European Commission in 2017 concerning incidents in 2016, as mandated by

text: Article 13

text: a of the Framework Directive (

text: In 2016, analysing the 158 significant incidents reported to ENISA and the EU Commission, the following conclusions

text: can be drawn, first looking at services and network assets affected and then at the causes of the incidents.  Mobile internet remains the most affected service: In 2016 most incidents affected mobile internet (48% of all reported incidents). Mobile internet and mobile telephony were the predominant affected services in the previous years also, except for 2014 where fixed telephony was the most affected.  Mobile services outages have affected in average more users than other: Incidents affecting mobile Internet or mobile telephony affected most users (around 1.3 million users and 1.1 million users respectively per incident). On average 14% of national user base was affected by incidents on mobile internet services.  System failures are the dominant root cause of incidents affecting availability: Most incidents were caused by system failures or technical failures (more than 70 % of the incidents) as a root cause. This has been the dominant root cause for all the reporting years so far. System failures was also the most common root cause for all the main services when looking at them separately and also the main root cause for all services, both classic and other services. In the system failures category, software bugs and hardware failures were the most common causes. The assets most often affected by system failures were switches and routers, and mobile base stations.  Third party failures continue to affect a considerable part of the total number of incidents: 21.5% of all incidents were caused by third party failures, a significant increase from last year (15,2%). Third party failure incidents are of high importance as they represent incidents completely out of the control of the provider. Therefore, such kind of incidents are complex and difficult to tackle. System failures followed by human errors were the most common cause category for third party failures also.  Malware is causing increasingly long lasting incidents: In last year’s analysis incidents caused by malicious actions (e.g. malware and DDoS), although we didn’t have too many of them, had most impact in terms of duration. This year, a single incident of malware caused the most impact in terms of average duration and user-hours lost. This change is strongly related to large DDoS attacks of last year. Last 2 years of reporting have certainly showed that cyber-attacks can also aim at creating long lasting disruptions in Telecom.

text: As the legal landscape affecting the Telecom industry has undergone recent updates, it is our opinion that the new improvements will certainly contribute to a more secured and harmonised telecommunications environment across Europe . Covering a wider range of threats and types of incidents that can affect telecommunications can be key in better understanding the challenges within the sector, and dealing with their main causes. The electronic telecommunication industry has reached a certain level of maturity among other IT related sectors, but the threat level is still high, maintained by the importance of the sector, as an infrastructure provider for the digital economy.

text: ENISA, in the context of the

text: Article 13

text: a Expert Group , will continue discussing specific incidents in more detail with the NRAs, and if needed, discuss and agree on mitigating measures. ENISA will also continue to give support to other sectors that are developing network and information security incident reporting schemes. ENISA would like to take this opportunity to thank the NRAs, Ministries and the European Commission for a fruitful collaboration and we look forward to leveraging this kind of reporting to further improve the security and resilience of the electronic communications sector in the EU and more generally for supervision of security also in other critical sectors.

text: References

text: Related ENISA papers

text:  ENISA’s reports about the 2011, 2012, 2013, 2014, 2015 incidents, reported under

text: Article 13

text: Article 13

text: Article 13

text: Article 13

text: a and how it compares to some other security articles mandating incident reporting and security measures: http://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidents-reporting/cyber-incident-reportingin-the-eu  For the interested reader, ENISA’s 2009 paper on incident reporting shows an overview of the situation in the EU 6 years ago: http://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidents-reporting/goodpractice-guide-on-incident-reporting/good-practice-guide-on-incident-reporting-1

text: EU legislation

text: Article 13

text: a of the Framework directive of the EU regulatory framework for electronic communications: http://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX:32009L0140  The EU regulatory framework for electronic communications (incorporating the Framework Directive including

text: Article 13

text: ENISA European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece Athens Office 1 Vasilissis Sofias Marousi 151 24, Athens, Greece

text: PO Box 1309, 710 01 Heraklion, Greece ISBN: 978-92-9204-222-6 DOI: 10.2824/21700 Tel: +30 28 14 40 9710 info@enisa.europa.eu www.enisa.europa.eu


text: www.enisa.europa.eu European Union Agency For Network And Information Security

text: Annual Privacy Forum 2016

text: October 2016

text: Annual Privacy Forum 2016

text: October 2016

text: Annual Privacy Forum 2016

text: October 2016

text: Annual Privacy Forum 2016

text: October 2016

text: Annual Privacy Forum 2016

text: October 2016

text: Annual Privacy Forum 2016

text: October 2016

text: http://www.wikicfp.com/cfp/ http://easychair.org/

text: Annual Privacy Forum 2016

text: October 2016

text: Annual Privacy Forum 2016

text: October 2016

text: th In conclusion, the 4 incarnation of the annual privacy forum was a full success. Nevertheless, there is always room for improvement. Hence, we recommend for future APF

text: Annual Privacy Forum 2016

text: October 2016

text: Annual Privacy Forum 2016

text: October 2016

text: Annual Privacy Forum 2016

text: October 2016

text: Day 1. Wednesday, September 07, 2016

text: 8:30 Registration & Coffee

text: 9:00 Opening Ceremonies

text: Manfred Schubert-Zsilavecz, VP, Goethe University Frankfurt, Udo Helmbrecht, ED, ENISA, Wojciech Wiewiórowski, EDPS

text: 9:15 Opening Keynote: Data Protection in the Digital World

text: Thomas Kremer, Deutsche Telekom, Board member for Data Privacy, Legal Affairs and Compliance

text: 10:45 Paper Session: eIDAS and Data Protection Regulation

text:  A Lifecycle for Data Sharing Agreements: How it works out

text: José Francisco Ruiz and Anil Ozdeniz, Atos

text: Marinella Petrocchi, Ilaria Matteucci and Gianpiero Costantino, Institute of Informatics and Telematics (IIT) CNR

text: Carmela Gambardella and Mirko Manea, Hewlett Packard Enterprise

text:  Process for Data Protection Impact Assessment under the European General Data Protection Regulation

text: Felix Bieker, Marit Hansen, Hannah Obersteller and Martin Rost, ULD

text: Michael Friedewald, Fraunhofer Institute for Systems and Innovation Research (ISI)  Bring your own Identity - Case Study from the Swiss Government

text: Gion Sialm, Federal Office of Information Technology, Systems and Telecommunication FOITT

text: Silvia Knittl, CSC Deutschland Consulting GmbH  The E-Waste Privacy Challenge

text: Barbara Krumay, Vienna University of Economics and Business

text: 13:30 Panel I: Online Privacy Tools for the General Public Moderator: Athena Bourka, ENISA

text: Claude Castelluccia, INRIA Diego Naranjo, EDRI

text: Annual Privacy Forum 2016

text: October 2016

text: Marit Hansen, ULD Rolf Wendolsky, JonDos

text: We will focus on the available technologies, the type and reliability of information that is provided to end users, the potential of assessment (and comparison) of different tools, as well as the level of general user awareness on PETs. 14:45 Networking Coffee

text: 15:15 Paper Session: IoT and Public Clouds

text:  Challenges of the Internet of Things: Possible Solutions from Data Protecy and 3DPrivacy

text: Luca Bolognini and Camilla Bistolfi, Italian Institute for Privacy

text:  Smart Meters as non-Purpose Built Surveillance Tools

text: Jonida Milaj and Jeanne Pia Mifsud Bonnici, University of Groningen

text:  Consumer Privacy on Distributed Energy Markets

text: Niklas Büscher, Technische Universität Darmstadt. Stefan Schiffner, ENISA. Mathias Fischer, Universität Münster

text:  Selected Cloud Security Patterns to Improve End User Security and Privacy in Public Clouds presented Thomas Länger and Solange Ghernaouti, Swiss Cybersecurity Advisory and Research Group (SCARG). Henrich C. Pöhls, Passau

text: Univ.

text: 16:45 State of the Net: Mikko Hypponen, F-Secure, Chief Research Officer

text: 19:00 Social Event and Signature ceremony for MoU between ENISA and F-Secure

text: Day 2. Thursday, September 08, 2016

text: 8:30 Registration & Coffee

text: 9:00 Paper Session: Privacy Policies and Privacy Risk Representation

text:  PrivacyInsight: The Next Generation Privacy Dashboard

text: Christoph Bier, Kay Kühne and Jürgen Beyerer, Fraunhofer Institute of Optronics, System Technologies and Image Exploi-

text: tation (IOSB)  A Framework for Major Stakeholders in Android Application Industry to Manage Privacy Policies of Android

text: Apps Shi-Cho Cha, Tzu-Ching Liu, Sih-Cing Syu, Li-Da Chien and Tsung-Ying Tsai, National Taiwan University of Science and Tech-

text: nology. Chuang-Ming Shiung, Criminal Investigation Bureau Taiwan  Qualitative Privacy Description Language - Integrating Privacy Concepts, Languages, and Technologies

text: Jasper van de Ven and Frank Dylla, Bremen University

text:  An Information Privacy Risk Index for mHealth Apps presented by Thomas Brüggemann

text: Thomas Brüggemann and Joel Hansen, University of Cologne. Tobias Dehling and Ali Sunyaev, University of Kassel

text: 10:45 Panel II: Processing Personal Data Moderator: Prokopios Drogkaris, ENISA

text: Giuseppe D’Acquisto, Italian Data Protection Authority Fernando Pocas Da Silva, EU-LISA

text: Oliver Grün, European Digital SME Alliance Marie Charlotte Roques Bonnet, Microsoft EMEA

text: 13:30 Panel III: Developing and maintaining a PETs maturity repository Moderator: Stefan Schiffner, ENISA

text: Meiko Jensen, FH Kiel, Wojciech Wiewiórowski, EDPS TBA, iTTi

text: The panel will explore the possibilities of a community portal for maturity assessments. The prototype for the platform will be presented and its test run will be launched. Further, it will be discussed how to find a permanent host for such a platform.

text: Annual Privacy Forum 2016

text: October 2016

text: 15:00 Closing Keynote: Observations on privacy and data protection from a security perspective

text: Jacoba Sieders, ABN AMRO, Global Head Identity & Access Management 15:45 End of Event

identifier: Annual Privacy Forum 2016

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: Annual Privacy Forum 2016

serie: rapporter

text: Final Report

type: rubrik

text: OCTOBER 2016 About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

type: stycke

text: Contact

text: For contacting the authors please use isdp@enisa.europa.eu For media enquires about this paper, please use press@enisa.europa.eu.

text: Acknowledgements

text: We thank all participants and PC members that made APF 2016 a success.

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Copyright Notice

text: © European Union Agency for Network and Information Security (ENISA), 2016 Reproduction is authorised provided the source is acknowledged.

text: Table of Contents

text: 1. Introduction 4

text: 2. Programme 5

text: Invited talks 5

text: Panels 6

text: 2.2.1 Online privacy tools for the general public 6 2.2.2 Appropriate security measures for the processing of personal data 6 2.2.3 Developing and maintaining a PET maturity repository 7

text: Scientific track 7

text: 3. Cooperation agreement and other practical arrangements 8

text: 4. Conclusion and Recommendations 9

text: Annex A: Example of Annex 10

text: Call for Papers 10

text: A.1.1 Call text 10 A.1.2 Programme Committee 11

text: Programme 12

text: Budget break down 14

text: 1. Introduction

text: Nowadays electronic communication networks and digital services are an essential part of an increasing number of everyday commodities. In the era of automated profiling and electronic surveillance, citizens face a serious threat against their right to privacy and informational self-determination, especially when using the internet and mobile services. The lack of transparency regarding the functionality and interconnection of such services increases the risk of uncontrollable processing of personal data. In this regard, the upcoming Data Protection Regulation will be a useful instrument to protect the privacy of individuals. However, for its successful implementation, this new framework needs to be enforced by proper technologies and encompassed with sustainable business models along with mechanisms to promote privacy awareness and help users to understand the value of their data.

text: In light of the data protection regulation and the European digital agenda, DG CONNECT, EDPS, ENISA and, Goethe University Frankfurt organized APF 2016 (http://privacyforum.eu/). APF 2016 was held 7 & 8 September at Goethe University Frankfurt am Main, Germany. The event encouraged dialog with key note speakers, panel discussions, and provided room for exchange of ideas in between scientific sessions. The proceedings, LNCS 9857 , are available online; a print version was distributed to relevant stakeholders (participants and management board).

text: There conference was attended by more than 100 registered participants.

text: 2. Programme Invited talks

text: Three speakers from industry were invited, namely Thomas Kremer, Deutsche Telekom AG, Mikko Hypponen, F-Secure, and Jacoba Sieders ABN AMRO Bank. Keynotes aimed to fuel the discussion from a practical perspective, while the closing note aimed to give home work to researchers and policy makers. The invited speakers are listed below.

text: Dr. Thomas Kremer has been the Board of Management member responsible

text: for Data Privacy, Legal Affairs and Compliance at Deutsche Telekom AG since June 2012. He was the interim Chief Human Resources Officer from January 2014 to March 2015.

text: Previously, he worked for ThyssenKrupp AG where he became General Counsel of the holdings' legal department in 2003, and Chief Compliance Officer of the ThyssenKrupp Group in 2007. In 2009, Thomas Kremer assumed leadership of the newly formed Corporate Center Legal & Compliance. He was appointed Executive Vice President (Generalbevollmächtigter) in 2011.

text: In addition to his experience in industry, Thomas Kremer worked as a research assistant at the University of Bonn, where he gained a doctorate in law in 1994. Moreover, he is engaged in the governmental commission German Corporate Governance Codex (Deutscher Corporate Governance Kodex DCGK). Since November 2015 he is chairman of the network safety association "Deutschland sicher im Netz" (Making Germany safe on the Net

text: Mikko Hypponen is the Chief Research Officer of F-Secure. He's been with the

text: company since 1991.

text: Mr. Hypponen has written on his research for the New York Times, Wired and Scientific America and he appears frequently on international TV. He has lectured at the universities of Stanford and Cambridge and he has delivered the most watched computer security talk on the internet.

text: Mr. Hypponen is a member of the board of the Nordic Business Forum and a member of the advisory board of T2.

text: Jacoba Sieders. As executive within the ABN AMRO Corporate Information Security Office,

text: Jacoba has final accountability for digital identity and the online and mobile access control for customers, employees and partners for the bank’s data and infrastructure. Next to that she holds the research and innovation portfolio for the domain. Since seventeen years she has been running security and identity management in three major global banks, and she is experienced in designing data protection frameworks and governance from the security and identity perspective. Today’s main topics on her agenda are API banking, data centric security, identity management for block chain and hybrid clouds, inter-bank identity programs, the Payment Services Directive II requirements, and the new concepts for authentication which ABN AMRO is developing. Jacoba is a member of the advisory board of the independent European think-tank ID-Next and is regularly peaking on the topic.

text: Panels

text: The 3 panels aimed to promote ENISA’s projects. With APF late in the year, they could be seen as a first peer review of the relevant projects. However, since we want to move APF to an earlier time of the year, in the future panel discussions will evolve more into kick-off or brain storming discussions nevertheless tightly coupled to ENISA WP activities. Moreover, they could be used to aim for a more multiannual strategy, evaluating past years projects and collecting ideas for how to continue a certain work stream.

text: 2.2.1 Online privacy tools for the general public

text: It is widely recognised that one of the most serious concerns today is the preservation of privacy when using internet and mobile applications. This concern has given rise to an increasing appearance of online tools, often open-source and/or freeware, affirming that they can offer certain privacy-preventive functionality, such as for example secure communication, encryption, protection against tracking, anonymous browsing, etc. However, in many cases the functionality of such tools is not as expected, for example due to lack of transparency on the tool’s development and operation or lack of proper maintenance mechanisms. Privacy enhancing technologies (PETs) that fail to offer what they promise can be very dangerous, as the false sense of protection can compromise the users’ personal data and negatively affect or even out in harm’s way their personal life.

text: Against this background, ENISA has been engaged over the last years in the development and practical implementation of a systematic approach for the assessment and presentation of online privacy tools for the general public (the PETs control matrix). Starting from the aforementioned work, the scope of this panel is to examine the availability of reliable online privacy tools today, the information that is provided to end users, the potential of self-assessment of privacy tools (by PETs developers), as well as the level of awareness of web and mobile users on PETs.

text: 2.2.2 Appropriate security measures for the processing of personal data

text: Information risk management is an integral part of an organization’s management process that deals with the identification, treatment, communication and acceptance of IT security risks. It involves the selection and implementation of measures justified by the identified risks and the reduction of those risks to acceptable levels. It also comprises continuous monitoring of risks and risk communication. Several methodologies and frameworks have been proposed and have been adopted by organizations during the last decade but none of them was oriented on the protection of personal data.

text: Under the European legal framework, personal data can only be collected under specific conditions, for a legitimate purpose. Furthermore, organisations which collect, process and store personal data must protect it from misuse and they are obliged to ensure that technical and organisational measures are undertaken so as to protect the personal data with an appropriate level of security. Data subjects should have the same level of protection, regardless of the size of the organisation or the amount of personal data it processes. In 2014,

text: Article 29

text: Data Protection Working Party has acknowledged that this protection can be done on in a scalable manner and has issued a statement on the role of a risk-based approach in data protection legal frameworks.

text: Such a risk-based approach should enable organizations to identify and assess the risks, likelihood and impact, and prioritize the events that could compromise the integrity and confidentiality of personal data. Following the risk assessment, it should also support organizations to select appropriate security and organizational measures and control to mitigate the identified risks, the potential impact and reduce the probability of occurrence.

text: 2.2.3 Developing and maintaining a PET maturity repository

text: In recent years ENISA contributed to the definition of privacy and security by design, i.e. answering the question what the practical implications of these terms are. In the course of this work, ENISA developed a methodology that allows to compare different Privacy Enhancing Technologies (PETs) with regard to their maturity, i.e., their technology readiness and their quality concerning the provided privacy notion. This methodology was turned into a structured process and a community tool was developed.

text: The panel presented this tool for the first time to a wider expert public. Further, we discussed possibilities on how such a repository can be build and maintained

text: Scientific track

text: As in previous years, half of the conference agenda was dedicated to presentations of new ideas from research. To identify these new ideas, a call for papers was published in February 2016. This call was advertised by the programme committee (PC) members and published at relevant platforms, e.g. wiki-CfP . The PC presented in section A.1.2 was composed of 50 senior academics, about 30% legal and 70% technical experts (computer science, electrical engineering). The review was single blind (reviewer knew authors, but authors did not know their reviewer) and a conflict of interest policy was enforced: a CoI was considered if reviewer and author were 1) academic siblings, 2) co-authors in the last 2 years or 3) in economic dependency from each other. The submission process was supported by EasyChair .

text: We received 32 submissions in response to our call for papers, see appendix. Each paper was peer-reviewed by at least four members of the international programme committee. Based on significance, novelty and scientific quality, we selected six full research papers. In order to support less experienced researchers, an additional seven papers were selected to undergo shepherding, i.e. a PC member was in close contact with the authors advising how to improve the paper. Six papers of those seven eventually met our quality standards and accepted for presentation and publication.

text: The first session, eIDAS and Data Protection regulation, discussed topics concerning data life cycle agreements, processes for privacy impact assessment and electronic IDs in a policy and organizational context. The second session, IoT and Public Clouds, discussed privacy and legal aspects in IoT, Cloud computing and their associated technological domains. Finally, the third session, Privacy Policies and Privacy Risk Representation, took the user on board, discussing privacy indicators to better communicate to users privacy policies and potential privacy risks. The proceedings, LNCS 9857, are available online.

text: 3. Cooperation agreement and other practical arrangements

text: As legal basis, we set up a cooperation agreement with the local co-organizer, which essentially stated that ENISA will cover loses of the local co-organizer up to 20k. Cost above this limit need to be covered by fees and sponsorships.

text: The conference fee was set at euro 400, and discounted for early bird registration to Euro 250 and Euro 200 for students.

text: This year’s search for sponsors was less successful than other years. We acquired 2 sponsors: one trust and the USEMP project, both contributing up to Euro 2000. The fact that we signed a MoU with f-secure was an inhibiting factor for other sponsors, thus we would expect more success in the following years.

text: Over all, with planning well in advance, we would expect that APF could be transformed into a self-sustaining event, with costs covered by fees and sponsorship.

text: 4. Conclusion and Recommendations

text:  Early planning. is crucial for call for papers, keynotes and advertisement. The next conference and local organiser should be announced at closure of the event, the call for papers should be online not later than 10 month before the event. Hence, best-suited project life cycle is about 13 months, with early partnerships set between European institutions, local organisers and sponsors. We strongly advice multiannual planning.  Keep the CfP. The paper track makes the event more interesting for industry participants. From their feedback, we know that they come for two reasons. Firstly to meet the policy makers and secondly to hunt for new talent.  Multi-disciplinary approach. Compared to earlier APFs, in 2016 the APF was reaching out to industry (key notes) and to the legal community (30% of PC from law schools). However, there is still room for improvement. A stronger involvement of others discipline needs to be encouraged. We advise to invite a legal expert to the PC chair and to consider cooperating with other agencies, e.g. FRA.  Financial model. APF could become self-sustainable. It would be recommendable to explore how sponsors could be better involved.  Location. A co-organizer with its own conference facilities is highly recommendable.  Date. The conference date needs to be selected careful. Especial competing events such as

text: ESORICS, PETS, INFO Hiding need to be considered.

text: Annex A: Example of Annex Call for Papers A.1.1 Call text

text: The 2016 edition of the annual privacy forum is organized in the light of the upcoming data protection regulation and the European digital agenda. We invite papers covering original work on the technological, economic, legal and societal aspects of the challenges that will come up with the implementation of the new framework. We particularly invite multidisciplinary papers that make it explicit how the presented work can contribute to bridging the gap between research and policy.

text: To encourage contributions from policy makers, representatives of competent authorities (such as Data Protection Authorities), industry experts, NGOs, and civil society associations, we also invite opinion papers from all stakeholders on the above mentioned topics. Opinion papers will reflect the opinion/position of the author(s) on the selected privacy-related topic.

text:  Implementation aspects of ‘by design’ and 'by default' paradigms  Implementation and adoption of PETs in today’s digital services  Modelling of data protection and privacy requirements, such as: machine readable representations and automatic evaluation of policies  Enabling transparency: technological and organizational challenges.  Technical solutions for the enforcement and the implications of the subject’s right, e.g. right to erasure, access and correction.  Aspects of privacy impact and risk assessment  Technical solutions for data portability  Sustainable business models for privacy friendly online services  Information and consent in online environments: practical solutions and implementations  Privacy awareness, reliability and usability of PETs  Trust services for the protection of personal data - privacy aware trust services (i.e. electronic certificates, signatures, etc.)  Security measures for the protection of personal data  Economics of privacy and personal data

text: All submissions will be thoroughly reviewed by our PC members. We aim at minimal 3 average 4 reviews per paper. Furthermore, papers will be published in the proceedings of the conference, which will appear in Springer’s LNCS series

text: A.1.2 Programme Committee

text: General Co chairs

text: Prof. Dr. Kai Rannenberg, Goethe University Frankfurt Dr. Demosthenes Ikonomou, ENISA, Athens

text: Scientific Program Committee Chairs

text: Dr. Jetzabel Serna, Goethe University Frankfurt Dr. Stefan Schiffner ENISA, Athens

text: Program Committee

text: Sven Wohlgemuth, Independent Consultant Bernhard C. Witt, it.sec GmbH & Co. KG Diane Whitehouse, IFIP working group 9.2 on social accountability and ICT Andreas Westfeld, HTW Dresden Stefan Weiss, Swiss Re Jozef Vyskoc, VaF Carmela Troncoso, IMDEA Software Institute Morton Swimmer, Trend Micro Jan Schallaböck, iRights.Law Angela Sasse, UCL Kazue Sako, NEC Heiko Roßnagel, Fraunhofer IAO Vincent Rijmen, KU Leuven Charles Raab, University of Edinburgh Christian W. Probst, Technical University of Denmark Joachim Posegga, University of Passau Siani Pearson, HP Labs Aljosa Pasic, Atos Origin Peter Parycek Danube, University Krems Sebastian Pape, Goethe University Frankfurt Jakob Illeborg Pagter, Alexandra Institute Gregory Neven, IBM Research Chris Mitchell, Royal Holloway University of London Vashek Matyas, Masaryk University Fabio Martinelli, IIT-CNR Daniel Le Métayer, INRIA Gwendal Le Grand, CNIL Stefan Köpsell, TU Dresden Sabrina Kirrane, WU Wien Els Kindt KU, Leuven Dogan Kesdogan, University of Regensburg Florian Kerschbaum, SAP Stefan Katzenbeisser, TU Darmstadt Sokratis Katsikas, NTNU Marko Hölbl, University of Maribor Marit Hansen, ULD Schleswig-Holstein

text: Lorena González Manzano, Universidad Carlos III de Madrid Simone Fischer-Hübner, Karlstad University Mathias Fischer, University of Muenster Hannes Federrath, University of Hamburg Thomas Engel, University Luxembourg Prokopios Drogkaris, ENISA Josep Domingo-Ferrer, Universitat Rovira i Virgili Roberto Di Pietro, Bell Labs José María De Fuentes, Universidad Carlos III de Madrid Malcolm Crompton, IIS Fanny Coudert, KU Leuven George Christou, University of Warwick Claude Castelluccia, INRIA Rhone-Alpes Valentina Casola, UNINA Pompeu Casanovas, UAB Bettina Berendt, KU Leuven Luis Antunes, University of Porto

text: Programme Budget break down

text: The final costs breakdown is being prepared by the local co-organisers.

text: ENISA

text: European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

text: Athens Office

text: 1 Vasilissis Sofias Marousi 151 24, Athens, Greece

text: PO Box 1309, 710 01 Heraklion, Greece Tel: +30 28 14 40 9710 info@enisa.europa.eu www.enisa.europa.eu

type: vagledning

utgivare: enisa