text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Reproduction is authorised provided the source is acknowledged. © European Union Agency for Network and Information Security (ENISA), 2013

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: 4.1 Examples of incidents 6

text: 4.2 Impact 8

text: 4.2.1 Incidents per service 8 4.2.2 Number of users affected per incident per service 8 4.2.3 Percentage of the national user base affected 9 4.2.4 Impact on emergency services and interconnections 10

text: 4.3 Root cause categories 11

text: 4.3.1 Incidents per root cause category 11 4.3.2 Average duration of incidents per root cause category 11 4.3.3 Average number of user connections affected per root cause category 12

text: 4.4 Detailed causes 13

text: 4.4.1 Detailed causes 13 4.4.2 Detailed causes per service 14 4.4.3 Average duration of incidents per detailed cause 15

text: 4.5 Impact in user hours 16

text: 4.5.1 User hours lost per root cause category 16 4.5.2 User-hours lost per detailed cause 16

text: 4.6 Assets affected 17

text: 4.6.1 Assets affected overall 17 4.6.2 Affected assets by system failures 17

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text:  Providers of public electronic communications networks and services should take measures to guarantee security and integrity of their networks.

text:  Providers must report to competent national authorities about significant breaches of security or integrity.

text:  National Regulatory Authorities should notify ENISA and national authorities abroad when necessary, for example in case of incidents with cross-border impact.

text:  Annually, National Regulatory Authorities should submit a summary report to ENISA and the European Commission (EC) about the incidents.

text: EC Incident notification Incident reporting ENISA

text: Member stateMember state Member stateMember state National National authority authority

text: Network or Network or Network or Network or Network or Network or service service service service service service provider provider provider provider provider provider

text: Figure 1: Incident reporting in

text: Article 13

text: a.

text: Here integrity means network integrity, which is often called availability or continuity in information security literature.

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: Here we follow the definition agreed in the COCOM meetings.

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: Figure 2 Threshold for annual summary reporting based on a combination of duration and the percentage of the national user base.

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: Number of countries reporting significant incidents

text: Number of countries 9 18 reporting no significant incidents Number of countries without

text: Article 13

text: a implementation

text: Figure 3 Countries involved in the annual summary reporting over 2012.

text: IMS = IP Multimedia Core Network Subsystem, a functional architecture designed to enable providers to deliver a wide range of real-time, packet-based services.

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: 10 0 Fixed telephony Fixed Internet Mobile Telephony Mobile Internet

text: Figure 4 Incidents per service (percentage)

text: 0 Fixed telephony Fixed Internet Mobile Telephony Mobile Internet

text: Figure 5 Average number of users affected per incident per service (1000s).

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: 6 4 2 0 Fixed telephony Fixed Internet Mobile Telephony Mobile Internet

text: Figure 6 Number of users affected per incident per service (percentage).

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: Not affected

text: Figure 7 Impact on emergency calls.

text: Affected Not affected

text: Figure 8 Impact on interconnections

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: Third party failure

text: System failures

text: Malicious actions

text: Human errors

text: Natural phenomena

text: Figure 9 Incidents per root cause category (percentage).

text: Third party failure

text: System failures

text: Malicious actions

text: Human errors

text: Natural phenomena

text: Figure 10 Average duration of incidents per root cause category (hours).

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: Third party failure

text: System failures

text: Malicious actions

text: Human errors

text: Natural phenomena

text: Figure 11 Average number of user connections affected per incident per root cause

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: Figure 12 Detailed causes of reported incidents

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: 35 30 25 20 15 Fixed Telephony 10 Fixed Internet 5 Mobile Telephony 0 Mobile Internet

text: Figure 13 Detailed causes per service

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: Figure 14 Average duration of incidents per detailed causes (hours).

text: Figure 15 Average number of user connections affected per incident per detailed cause (1000s).

text: Note that ENISA does not have comparable data from the 2011 incidents.

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: Third party failure

text: System failures

text: Malicious actions

text: Human errors

text: Natural phenomena

text: Figure 16 Average user-hours lost per incident per root cause category.

text: Figure 17 Average impact in user/hours of incidents per detailed cause.

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: Figure 18 Assets affected by the incidents (percentages).

text: Fig 1. Assets affected by system failures (percentages).

text: Figure 19 Assets affected in case of system failures (percentages).

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: Natural phenomena

text: Human errors Malicious actions System failures

text: Third party failures

text: Figure 20 Root cause categories for fixed telephony.

text: Natural phenomena Human errors

text: Malicious actions System failures 60 Third party failures

text: Figure 21 Root cause categories for fixed Internet.

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: Natural phenomena Human errors Malicious actions System failures

text: Third party failures

text: Figure 22 Root cause categories for mobile telephony

text: Natural phenomena

text: Human errors

text: Malicious actions System failures

text: Third party failures

text: Figure 23 Root cause categories for mobile Internet.

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: Hardware failure 3 Software bug

text: Cyber attack

text: Power cut Cable cut 10 Bad maintenance Other 10 Cable theft

text: Power surges

text: Figure 24 Detailed causes for fixed telephony.

text: Hardware failure Software bug

text: Overload 5 35 Cyber attack 5 Power cut 5 Cable cut 5 Bad maintenance Other

text: Bad change 15 Cable theft Power surges

text: Figure 25 Detailed causes for fixed Internet.

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: Hardware failure

text: Software bug

text: Power cut

text: Cable cut

text: maintenance Other

text: Bad change

text: Figure 26 Detailed causes for mobile telephony.

text: Hardware failure Software bug Overload

text: 3 Cyber attack

text: Power cut 36 Cable cut

text: Bad maintenance 3 Other

text: Bad change

text: Flood Heavy snowfall Storm

text: Human error

text: Policy/procedure flaw

text: Figure 27 Detailed causes for mobile Internet.

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: PSTN 6 VoIP

text: 2 0 Hardware Software bug Cable cut Power cut Cyber attack Overload Power surges failure

text: Figure 28 Detailed causes for incidents affecting PSTN and VoIP (percentage).

text: 10000 Impact PSTN 8000 5588 Impact VoIP

text: Hardware Software Cable cut Power cut Cyber Overload Power failure bug attack surges

text: Figure 29 Impact in users hours of incidents per detailed cause, for PSTN and VoIP.

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

text: Analysis of

text: Article 13

text: a annual incident reports

text: August 2013

identifier: Annual Incident Reports 2012

title: Annual Incident Reports 2012

text: Analysis of Article 13a annual incident reports

text: August 2013

text: Annual Incident Reports 2012

text: About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Authors

text: Dr. Marnix Dekker, Christoffer Karsberg, Matina Lakka

text: Contact

text: For contacting the authors please email to resilience@enisa.europa.eu For media enquires about this paper, please email to press@enisa.europa.eu.

text: Acknowledgements

text: For the completion of this report ENISA has worked closely with a group of experts from National Regulatory Authorities and ministries from across Europe. Listing the organizations (in not particular order): PTS (SE), Ministry of Economic Affairs (NL), FICORA (FI), Ofcom (UK), ANACOM (PT), ComReg (IE), EETT (GR), ADAE (GR), Centre for Cyber Security - CFCS (DK), RTR (AT), ANCOM (RO), CRC (BG), Ministry of Economics, Finance and Industry (FR), Bundesnetzagentur (DE), BIPT (BE), MITYC (ES), MPO (CZ), CTO (CZ), CERT LT (LT), TRASR (SK), ILR (LU), PECSRS (SI), MCA (MT), Ministry of Economic Development (IT), OCECPR (CY), NPT (NO), ETSA (EE), NMIAIAD (HU), ITSIRI (LV), OEC (PL), APEK (SI), Teleoff (SK), OFCOM (CH), HAKOM (HR)

text: Legal notice

text: Page ii

text: Annual Incident Reports 2012

text: Executive summary

text: Yearly ENISA publishes an annual report about significant incidents in the electronic communications sector, which are reported to ENISA under Article 13a of the Framework Directive (

text: ). This report covers the incidents that occurred in 2012. This report provides an aggregated analysis of the incident reports about severe outages, looking at the impact of incidents, root cause categories and detailed causes. It does not include details about individual countries, individual providers, or individual incidents. In total 18 countries reported 79 significant incidents, 9 countries reported no significant incidents., Below we summarize the main conclusions that can be drawn from the incident reports.  Most incidents affected mobile telephony or mobile Internet (about 50 % of the incidents respectively). Incidents affecting mobile telephony or mobile Internet also affected most users (around 1,8 million users per incident). This is consistent with the high penetration rate of mobile telephony and mobile Internet.  In 37 % of the incidents there was an impact on the emergency number 112.  For most incident reports the root cause was “System failures” (75 % of the incidents). This was the most common root cause category also for each of the four services (fixed and mobile telephony and fixed and mobile Internet). In the category “System failures”, hardware failures were the most common cause, followed by software bugs. The assets most often affected by system failures were switches (e.g. routers and local exchange points) and home location registers.  Incidents categorized with root cause third party failures, mostly power supply failures, affected around 2.8 Million user connections on average. Incidents involving the detailed cause overload affected around 9.4 million user connections on average.  Incidents caused by natural phenomena (mainly storms and heavy snowfall) lasted the longest: around 36 hours on average.  Incidents caused by overload followed by power failures respectively had most impact in terms of number of users affected times duration.  Overall, switches and home location registers were the network components or assets most affected by incidents. ENISA, together with the National Regulatory Authorities (NRAs) of the different EU Member States, discusses specific incidents in more detail in the

text: Article 13

text: a Expert Group. Where needed ENISA drafts technical guidance for NRAs and providers about mitigating incidents. For example, following last year’s report, ENISA is now drafting recommendations on power supply dependencies and national roaming for resilience. ENISA publishes an annual report to provide industry and government bodies in the EU with data about significant incidents. The next annual report will be published in summer 2014, covering incidents that occurred in 2013. We thank the regulators and the EC for a fruitful collaboration and we are looking forward to leveraging this kind of reporting to further improve the security and resilience of the electronic communication networks in the EU electronic communications sector and more generally for supervision of security in other critical sectors.

text: Page iii

text: Annual Incident Reports 2012

text: Table of Contents Executive summary iii 1 Introduction 1 2

text: Article 13

text: a of the Framework Directive: ‘Security and Integrity’ 2 3

text: Article 13

text: a Expert Group and Incident Reporting Procedure 3 4 Analysis of the incidents 6 5 Conclusions 18 References 19 Annex A: Incident causes split out per service 20 Annex B: VoIP versus PSTN 24

text: Page iv

text: Annual Incident Reports 2012

text: 1 Introduction

text: For the second time in the EU significant security incidents were reported to ENISA and the European Commission, under

text: Article 13

text: a of the Framework Directive (

text: ), a new article introduced in the 2009 reform of the EU legal framework for electronic communications. In this document, ENISA analyses the 79 incident reports of severe outages of electronic communication networks or services that were submitted for 2012. This year’s reports were also compared with last year’s annual reporting. The Executive Summary of this report provides a snapshot of this analysis. Note that in this document ENISA does not provide details from the individual incident reports. The analysis is only an aggregation in terms of averages and percentages across the EU. ENISA does not make any references here to specific countries or specific providers. The incidents are discussed in more detail in the

text: Article 13

text: a Expert Group. This document is structured as follows. Section 2 and Section 3 briefly summarize

text: Article 13

text: a and the details of the technical implementation of

text: Article 13

text: a, as agreed in the

text: Article 13

text: a Expert Group by the different NRAs of the EU Member States. Section 4 analyses the incidents which were reported, and this paper concludes with some general conclusions (Section 5) which follow from the incidents. For the interested reader, the annex contains data about root causes and detailed causes per service as well as the detailed causes and impact for Circuit Switched Telephony and VoIP respectively.

text: Page 1

text: Annual Incident Reports 2012

text: Article 13

text: a of the Framework Directive: ‘Security and Integrity’

text: The reform of the EU legal framework for electronic communications, which was adopted in 2009 and was transposed by most EU countries around May 2011, adds

text: Article 13

text: a to the Framework

text: Directive.

text: Article 13

text: a addresses the security and integrity of public electronic communications networks and services. The legislation concerns National Regulatory Authorities (NRAs) and providers of public electronic communications networks and services (providers).

text: Article 13

text: a states:

text: The incident reporting flows are shown in the diagram below. This document analyses the incidents that have been reported to ENISA and the EC (the black dashed arrow).

text: Page 2

text: Annual Incident Reports 2012

text: Article 13

text: a Expert Group and Incident Reporting Procedure

text: In 2010, ENISA, Ministries and NRAs initiated a series of meetings (workshops, conference calls) to achieve a harmonised implementation of

text: Article 13

text: a of the Framework directive. In these meetings, a group of experts from NRAs, called the

text: Article 13

text: a Expert Group, reached agreement on two nonbinding technical documents providing guidance to the NRAs in the EU Member States :  Technical Guidelines for Incident Reporting and  Technical Guidelines for Minimum Security Measures. The

text: Article 13

text: a Expert Group continues to meet several times a year to discuss the implementation of

text: Article 13

text: a (for example, on how to supervise the electronic communications sector) and to share knowledge and exchange views about past incidents, and how to address them.

text: 3.1 Technical Guidelines on Incident reporting

text: The last two years, NRAs have used version 1.0 of the Technical Guidelines on Incident Reporting. At the end of last year, in agreement with NRAs, ENISA amended and improved the reporting thresholds and the incident reporting template, to be used for the 2013 reporting. This was done in a separate document, describing the procedure for 2013 reporting. From January 2013 the NRAs will be using version 2.0 of the Technical Guideline on Incident Reporting.

text: 3.1.1 Services in scope

text: NRAs should report incidents affecting the following communication services and networks:  Fixed telephony (e.g. PSTN, VoIP over DSL, Cable, Fiber, et cetera),  Mobile telephony (e.g. GSM, UMTS, LTE, et cetera ),  Fixed Internet access (e.g. Dial up, DSL, Cable, Fiber, et cetera),  Mobile Internet access (e.g. GSM, UMTS, LTE, et cetera) NRAs may also report about incidents affecting other types of services.

text: 3.1.2 Security incidents in scope

text: NRAs should report security incidents, which had a significant impact on the continuity of supply of electronic communications networks or services.

text: 3.1.3 National user base

text: NRAs should provide estimates of the total number of users of each service in their country.  For fixed telephony and Internet, NRAs should use the number of subscribers or access lines in their country.  For mobile telephony, NRAs should use the number of active telephony SIM cards.  For mobile Internet, NRAs should sum up :

text: 1. The number of standard mobile subscriptions, which offer both telephony and Internet access, and which have been used for Internet access recently (e.g. in the past 3 months).

text: 2. The number of subscriptions dedicated for mobile Internet access, which are purchased separately, either standalone or on top of an existing voice subscription.

text: Page 3

text: Annual Incident Reports 2012

text: 3.1.4 Thresholds

text: The threshold for annual summary reporting is based on the duration and the number of users of a service affected as a percentage of the national user base of the service. NRAs should send an incident report, as part of the annual summary reporting, if the incident  lasts more than an hour, and the percentage of users affected is more than 15%,  lasts more than 2 hours, and the percentage of users affected is more than 10%,  lasts more than 4 hours, and the percentage of users affected is more than 5%,  lasts more than 6 hours, and the percentage of users affected is more than 2%, or if it  lasts more than 8 hours, and the percentage of users affected is more than 1%. The threshold should be understood ‘per service’. In other words, if one incident involves impact on multiple services, then for one of the services the threshold should be passed. NRAs may also report incidents with an impact below the threshold.

text: 1 2 4 6 >8 h h h h <... <... <... <... h <2 <4 <6 <8 h h h h

text: 1%<...< 2% of user base

text: 2%<...< 5% of user base

text: 5%<...< 10% of user base

text: 10%<...< 15% of user base

text: > 15% of user base

text: 3.1.5 Root cause categories

text: In the incident reports five categories of root causes have been distinguished.  Natural phenomena – This category includes incidents caused by natural disasters. For instance storms, floods, heavy snowfall, earthquakes, and so on.  Human errors - This category includes incidents caused by errors committed by employees of the provider.  Malicious attacks - This category includes incidents caused by an attack, a cyber-attack or a cable theft e.g.  System failures – This category includes incidents caused by a failure of hardware or software.  Third party failures – This category includes incidents caused by a failure or incident at a third party.

text: Page 4

text: Annual Incident Reports 2012

text: 3.1.6 Reporting procedure

text: In spring 2012 the European Commission agreed with the EU Member States (in meetings of the Communications Committee, COCOM) to do the first round of annual summary reporting on the 2011 incidents. The decision included a recommendation to use the reporting template agreed within the

text: Article 13

text: a Expert Group and published by ENISA. Following the COCOM meeting, ENISA implemented the technical procedure by deploying a basic electronic form based on the

text: Article 13

text: a guidelines for incident reporting. There was also an agreement that in the following years, annual reporting would be carried out by the end of February each year. In the automn of 2012 ENISA developed an online incident reporting tool (called CIRAS), which replaces the electronic forms exchanged by email. The goal of CIRAS is to allow NRAs more control over the data reported and to improve the collection and aggregation of incident reports.

text: Page 5

text: Annual Incident Reports 2012

text: 4 Analysis of the incidents

text: In total, all 28 EU Member States participated in this process. 18 countries reported in total 79 significant incidents, 9 countries reported there were no significant incidents and 1 country hadn’t implemented incident reporting yet.

text: In this section the 79 reported incidents are aggregated and analysed. First, some examples of incidents are given (in Section 4.1), then the impact per service is analysed (in Section 4.2), then the impact per root cause category is analysed (Section 4.3), and in Section 4.4 detailed causes are examined. In Section 4.5 impact as a product of user connections affected and duration of the incidents is analysed and in Section 4.6 the components or assets affected by the incidents are considered. At this point there is a need to stress that statistical conclusions based on these numbers should be drawn with care. The smaller incidents are not reported at an EU level and this means that the view is biased towards the larger incidents. Another remark is that the reporting to ENISA has only been carried out for two years, and this is not enough to draw conclusions on trends. However, where there are data from 2011, diagrams are displayed as a comparison.

text: 4.1 Examples of incidents

text: In this section, we give some anonymized examples of inccidents, to give an idea of the different incidents that have been reported over the last two years.

text: 4.1.1 Overload caused VoIP outage (hours, thousands, system failure)

text: In the shift from a temporary to a permanent network solution, voice over IP service were lost for 400 000 users. Basically the IMS became overloaded as a result of too many simultaneous registrations of customer devices. The provider had to limit registrations and was handling full traffic again after 14 hours.

text: Page 6

text: Annual Incident Reports 2012

text: 4.1.2 Faulty upgrade halted IP-base traffic (hours, millions, human error)

text: An upgrade in a core router went seriously wrong, and caused a drop of all IP based traffic for the provider causing many services to go down, including the emergency number 112. This incident led to an outage of 17 hours affecting 3 million users. The provider downgraded to make the network stable. The post incident action was to change the routines for upgrades including new procedures for suppliers and integrators.

text: 4.1.3 Cable theft causing fibre optic cable break (hours, thousands, malicious attack)

text: A fiber optic cable was cut off due to a cable theft attempt. The incident affected 70 000 fixed telephony users and 90 000 fixed Internet users for 10 hours. During repairs a temporary path was established.

text: 4.1.4 DDoS attacks on DNS affected mobile Internet (hours, millions, malicious attack)

text: A series of Distributed Denial of Service attacks targeted a provider’s domain name service. Up to 2,5 million mobile Internet users were affected during 1-2 hours. The attacking IP-addresses were tracked and blocked, the load balancing units were restarted and the traffic could be recovered. As post-incident actions additional DNS servers were installed, configuration changes were made on firewalls and hardware was expanded to withstand similar attacks.

text: 4.1.5 Big storm affecting power supply causing large scale outage (days, millions, natural disaster)

text: A severe storm hit several countries. The storm had a major impact on the power grid infrastructure and to a limited extent also on mobile network equipment (like mobile base stations). The prolonged power cuts eventually caused many mobile base stations to run out of power. As a result around a million users were without mobile communication services for 24 hours, and in some cases up to two weeks.

text: 4.1.6 Configuration error (hours, millions, configuration error)

text: An employee of a fixed telephony provider made a configuration error. The error prevented fixed telephony users to make outgoing international phone calls to Western European countries for 4 hours. The incident was resolved after a reconfiguration and a reboot.

text: 4.1.7 Vandalism by former employee affected DSL (days, thousands, malicious attack)

text: A former employee of a provider deliberately set fire to a switching system, which was used for providing fixed Internet service to around 10.000 subscribers. The incident was resolved by replacing the switch. Around 36 hours later the fixed Internet service was working again.

text: 4.1.8 Faulty software update affected mobile telephony (hours, thousands, software failure)

text: A provider applied a regular software update at a Home Location Register (HLR) which turned out to be faulty. The failure at the HLR impacted mobile telephony and Internet services. The incident affected about half of the provider’s customers and lasted around 8 hours.

text: 4.1.9 Submarine cable cut from anchorage (hours, thousands, third party)

text: A ship’s anchoring damaged one of four submarine cables connecting two islands. Contingency plans were triggered quickly, which meant that only a smaller number of users were affected.

text: Page 7

text: Annual Incident Reports 2012

text: 4.2 Impact

text: This section focusses on the impact of the incidents on the electronic communication services.

text: 4.2.1 Incidents per service

text: Figure 4 shows which percentage of incidents affected which services. Most incidents have an impact on two or more services (which is why the percentages in the chart add up to 152%).

text: 48 49 37 25

text: Most incidents (around 48%) affected mobile telephony or mobile Internet. This would suggest that mobile services are more at risk of large-scale outages. We drew a similar conclusion last year.

text: 4.2.2 Number of users affected per incident per service

text: Figure 5 shows the average number of users affected, per incident, per service (in 1000s).

text: 1800 1800 1700 400 300

text: Page 8

text: Annual Incident Reports 2012

text: Incidents affecting mobile telephony and mobile Internet involve on average 1,8 million users. This is partly due to the fact that mobile telephony has more customers (on average 110% of the population for mobile telephony, compared to 50% for fixed telephony). Note that the EU averages in this calculation are not always representative for the sizes of incidents that could occur nationally regarding users affected, because of differences in national network topologies. Also, since the thresholds for reporting to ENISA and the EC are based on the percentage of national users affected, smaller outages are underrepresented in the EU averages.

text: 4.2.3 Percentage of the national user base affected

text: Figure 6 shows the percentage of the national user base affected, on average per incident, per service.

text: 16 10 10 9 8

text: On average, incidents affecting mobile internet affect 16% of the users. This is more than the percentages for the mobile telephony and the fixed communication services. This would suggest that, not only mobile Internet services are more vulnerable, but also that a larger portion of the users is affected in the incidents that were reported.

text: Page 9

text: Annual Incident Reports 2012

text: 4.2.4 Impact on emergency services and interconnections

text: In figures 7 and 8 we show the impact on emergency services and interconnections respectively.

text: Emergency Calls

text: 63 37

text: In 37 % of the incidents there was impact on emergency calls - i.e. the possibility for users to contact emergency call-centres using the emergency number 112.

text: Interconnections

text: 11 89

text: In 11 % of the incidents there was an impact on interconnections to other providers.

text: Page 10

text: Annual Incident Reports 2012

text: 4.3 Root cause categories

text: This section shows the impact of incidents, per root cause category.

text: 4.3.1 Incidents per root cause category

text: Figure 9 shows the percentage of incidents per root cause category.

text: 13 76 8 5 6

text: Most of the incidents fall in the rootcause category ‘System failures’ (76%). Note that the numbers add up to more than 100% because for a few incidents multiple root cause categories were indicated.

text: 4.3.2 Average duration of incidents per root cause category

text: Figure 10 shows the average duration of incident per root case category.

text: 13 9 4 26 36

text: Page 11

text: Annual Incident Reports 2012

text: Natural phenomena need the longest recovery time compared with the other root cause categories: an average of 36 hours. Also incidents in the root cause category ‘Human Error’ needed long recovery time, 26 hours in average.

text: 4.3.3 Average number of user connections affected per root cause category

text: Figure 11 shows the average number of affected user connections in each incident for a certain root cause category. Note that a single user could have access to multiple services, so in certain incidents the affected users are counted multiple times. For this reason we count the number of user connections affected per service.

text: 2808 2330 1528 447 557

text: Although incidents caused by natural phenomena lasted longest (36 hours on average), the number of user connections in these cases was relatively limited (on average 560.000 connections) compared to other root cause categories. The incidents caused by third party failures affected most connections (around 2.8 Million), and they lasted fairly long (on average 13 hours). A high proportion of these incidents (60%) were caused by failures related to power supply. It is difficult to draw conclusions on why the number of affected connections was so high this year. There were some incidents that generated a very high number of affected user connections, mainly five incidents on mobile networks that affected a range of 4 million to 50 million user connections.

text: Page 12

text: Annual Incident Reports 2012

text: 4.4 Detailed causes

text: In this section, instead of looking at the five root cause categories, we examine initial causes and subsequent causes triggering the incident. For example, when a storm led to a power cut which leads to a network outage, then for this incident both power cut and storm are counted as detailed causes. We call them: “detailed causes”.

text: 4.4.1 Detailed causes

text: Figure 12 shows the detailed causes of incidents. 40

text: 38 23 15 13 11 9 6 6 4 3 5 1 1 1 1 1 1 1

text: Hardware failure was the most common cause, followed by software bugs.

text: Page 13

text: Annual Incident Reports 2012

text: 4.4.2 Detailed causes per service

text: Figure 13 shows the causes of incidents per service.

text: For incidents in all four services, hardware failure was the most common cause. The second most common cause for fixed telephony was software bug. Half of those incidents affected VoIP. For fixed Internet, cyber attack was the second most common cause. For mobile telephony and mobile internet the second most common cause was a software bug.

text: Page 14

text: Annual Incident Reports 2012

text: 4.4.3 Average duration of incidents and number of user connections affected per detailed cause

text: Figure 14 shows the average duration of the incidents, per detailed cause .

text: 84 72 72 50 36 22 20 14 10 9 8 8 8 8 6 5 3 3

text: Incidents caused by bad weather, mainly storms and heavy snowfall, had the longest duration.

text: Figure 15 shows the average number of user connections affected, per detailed cause.

text: 10000 9410 4295 4000 3147 2000 1803 1465 1000 1000 450 429 386 300 271 192 153 64 28 6

text: Overload was the cause affecting by far most user connections, more than 9 million connections on average per incident. In second and third place came software bugs with 4 million affected connections and power cuts with 3 million connections.

text: Page 15

text: Annual Incident Reports 2012

text: 4.5 Impact in user hours

text: This year we also show the impact of the incidents in terms of the product of connections affected and the duration of the incident: We abbreviated this as “user-hours lost”.

text: 4.5.1 User hours lost per root cause category

text: Figure 16 shows the average impact in user-hours from incidents per root cause category.

text: 36502 19842 5858 11393 20283

text: The root cause category third party failure had most impact in terms of user-hours lost followed by natural phenomena.

text: 4.5.2 User-hours lost per detailed cause

text: Figure 17 shows the impact from the detailed causes in user-hours.

text: Overload is the detailed cause that has most impact in terms of user hours lost, followed by power cuts followed and software bugs.

text: Page 16

text: Annual Incident Reports 2012

text: 4.6 Assets affected

text: This year we also detail which components or assets of the electronic communications networks were affected by the incidents.

text: 4.6.1 Assets affected overall

text: Figure 18 shows overall what assets were affected by the incidents.

text: Switches were the assets most affected, followed by user and location and mobile network base stations.

text: 4.6.2 Affected assets by system failures

text: System failures is the most common root cause category. In Figure 19 we show which assets were affected in these incidents.

text: System failures most often affected switches, user and location registers and base stations.

text: Page 17

text: Annual Incident Reports 2012

text: 5 Conclusions

text: In this document ENISA summarized how the incident reporting scheme, mandated by

text: Article 13

text: a of the Framework Directive (

text: ), was implemented across the EU and analysed the incident reports. ENISA and the EC received as part of the second round of reporting: 79 reports about major incidents that occurred in 2012. From the 79 significant incidents reported to ENISA and the EC, the following conclusions can be drawn.  Mobile networks most affected: Most incidents affected mobile telephony or mobile Internet (about 50 % of the incidents respectively).  Mobile network outages affect many users: Incidents affecting mobile telephony or mobile Internet affected most users (around 1,8 million users per incident). This is consistent with the high penetration rate of mobile telephony and mobile Internet.  Emergency Service are affected by incidents: In 37 % of the incidents there was impact on emergency calls using the emergency number 112.  System failures are the most common root cause: Most incidents were caused by root causes in the category “System failures” (75 % of the incidents). This was the most common root cause category also for each of the four services (fixed and mobile telephony and fixed and mobile Internet). In the category “System failures”, hardware failures were the most common cause, followed by software bugs. The assets most often affected by system failures were switches (e.g. routers and local exchange points) and home location registers.  Third party failures and overload affect many users: Incidents categorized with the root cause third party failures, mostly power supply failures, affected around 2.8 Million user connections on average. Incidents involving the detailed cause overload affected around 9.4 million user connections on average.  Natural phenomena cause long lasting incidents: Incidents caused by natural phenomena (mainly storms and heavy snowfall) lasted around 36 hours on average.  Overload and power failures have most impact: Incidents caused by overload followed by power failures respectively had most impact in terms of number of users times duration.  Switches and home location registers most affected by incidents: Overall, switches and home location registers were the network components most affected by incidents. ENISA, in the context of the

text: Article 13

text: a Expert Group, will discuss specific incidents in more detail with the NRAs, and if needed, discuss and agree on mitigating measures. ENISA would like to take this opportunity to thank the NRAs, the European Member States and the European Commission for the fruitful collaboration, which has allowed for an efficient and rapid implementation of the incident reporting process. We believe that this process (

text: Article 13

text: a) is a good example for supervision of cyber security in other sectors. In fact, the proposal for a cyber security directive, rececntly proposed by the EC, explicitly mentions that the Framework directive was used as a model, and Article 14 of that proposal is very similar to

text: Article 13

text: a. ENISA is looking forward to leveraging this kind of reporting to assist the EU Commission and the Member States in further improving the security and resilience of the electronic communication networks in the EU.

text: Page 18

text: Annual Incident Reports 2012

text: References Related ENISA papers

text:  The

text: Article 13

text: a WG technical guidelines on incident reporting and on minimum security measures: https://resilience.enisa.europa.eu/article-13  ENISA’s report about the 2011 incidents, reported under

text: Article 13

text: a: http://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidents-reporting/annualreports/annual-incident-reports-2011  ENISA’s whitepaper on cyber incident reporting in the EU shows

text: Article 13

text: a and how it compares to some other security articles mandating incident reporting and security measures: http://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidentsreporting/cyber-incident-reporting-in-the-eu  For the interested reader, ENISA’s 2009 paper on incident reporting shows an overview of the situation in the EU 4 years ago.

text: EU legislation

text: Article 13

text: a of the Framework directive of the EU legislative framework on electronic communications: http://ec.europa.eu/information_society/policy/ecomm/doc/140framework.pdf  The electronic communications regulatory framework (incorporating the telecom reform): http://ec.europa.eu/information_society/policy/ecomm/doc/library/regframeforec_dec200 9.pdf  An overview of the main elements of the 2009 reform: http://ec.europa.eu/information_society/policy/ecomm/tomorrow/reform/index_en.htm  In 2013 the European Commission issued a European Cyber Security Strategy and proposed a directive on Cyber Security. Article 14 of the proposed directive is similar to

text: Article 13

text: a, requiring operators to take appropriate security measures and to report significant incidents.

text: Page 19

text: Annual Incident Reports 2012

text: Annex A: Incident causes split out per service

text: This section shows the root cause categories and causs split out per service.

text: A.1 Root cause categories per service (percentage)

text: Figures 20, 21, 22 and 23 show the root cause categories of incidents split out per service. The diagrams show that for each service most incidents had a root cause in the category ‘system failures.

text: Fixed telephony

text: 7 14 76

text: Fixed Internet

text: 5 5 15 25

text: Page 20

text: Annual Incident Reports 2012

text: Mobile Telephony

text: 11 3 87

text: Mobile Internet

text: 15 10 5 13 64

text: Page 21

text: Annual Incident Reports 2012

text: A.2 Detailed causes per service

text: In Figure 24, 25, 26, 27 we show the detailed causes, split out per service.

text: The data shows that for all services, except fixed Internet, most incidents were caused by hardware failures followed by software bugs. For fixed Internet most incidents were caused by hardware failures followed by cyber attacks.

text: Fixed Telephony

text: 3 3 3 7 17

text: Fixed Internet

text: 5 5 10

text: Page 22

text: Annual Incident Reports 2012

text: Mobile Telephony

text: 3 3 3 3 3 32 3 3 16 Bad 21 13

text: Mobile Internet

text: 3 3 3 3 10 13 15 13

text: Page 23

text: Annual Incident Reports 2012

text: Annex B: VoIP versus PSTN

text: In this section fixed telephony is split in traditional circuit switched fixed telephony (PSTN) and fixed IP based telephony (VoIP).

text: Figure 28 shows the detailed causes, for PSTN and VoIP services.

text: 14 14 10 10 10 10 8 7 3 3 3 3

text: Both PSTN and VoIP were mostly affected by hardware failures. VoIP was more affected by software bugs, power cuts and cyber attacks, wereas PSTN was more affected by cable cuts.

text: Figure 29 shows the impact per detailed cause in user hours, for PSTN an VoIP services.

text: 16538 12000 11128 10753 6000 4691 1271 135 372 135 112 112

text: For PSTN, the detailed cause with most impact, in terms of user hours, was software bugs, followed by overload. For VoIP the impact of overload was highest, followed by software bugs.

text: Page 24

text: Annual Incident Reports 2012

text: European Union Agency for Network and Information Security (ENISA)

text: Annual Incident Reports 2012,

text: Analysis of

text: Article 13

text: a incident reports

text: ISBN 978-92-9204-066-6 doi: 10.2824/15669 Catalogue Number: TP-03-13-439-EN-N

text: © European Union Agency for Network and Information Security(ENISA), 2013 Reproduction is authorised, provided the source is acknowledged

text: Page 25

text: Annual Incident Reports 2012

text: ISBN Number

text: Catalogue number

text: ENISA

text: European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

text: Athens Office

text: 1 Vass. Sofias & Meg. Alexandrou Marousi 151 24, Athens, Greece

text: PO Box 1309, 710 01 Heraklion, Greece Tel: +30 28 14 40 9710 info@enisa.europa.eu Page 26 www.enisa.europa.eu


text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Reproduction is authorised provided the source is acknowledged. © European Union Agency for Network and Information Security (ENISA), 2014 ISBN: 978-92-9204-095-6, ISSN: 2363-2097, DOI: 10.2824/32965

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: 3.1 Incident reporting procedure 3

text: 4.1 Impact of incidents 7

text: 4.2 Root cause categories 11

text: 4.3 Detailed causes 18

text: 4.4 Assets affected 25

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: EC Incident notification Annual reporting ENISA

text: Member state Member state National National authority authority

text: Network or Network or Network or Network or Network or Network or service service service service service service provider provider provider provider provider provider

text: Figure 1: Incident reporting in

text: Article 13

text: a.

text: Here integrity means network integrity, which is often called availability or continuity in information security literature. 2

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Figure 2 Threshold for annual summary reporting based on a combination of duration and the percentage of the national user base.

text: Reference is made to the definition agreed in the COCOM meetings. 4

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Number of countries reporting significant incidents

text: Number of countries reporting no significant incidents

text: Number of countries without

text: Article 13

text: a implementation

text: Figure 3: Countries involved in the annual summary reporting over 2013.

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Fixed telephony Fixed Internet Mobile Telephony Mobile Internet

text: Figure 4: Incidents per service (percentage)

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Figure 5: Average number of user connections affected per incident per service (1000s).

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Figure 6: Percentage of national user base affected on average per incident per service.

text: Affected Not affected

text: Figure 7: Impact on emergency calls.

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Affected Not affected

text: Figure 8: Impact on interconnections

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Natural phenomena

text: Human errors

text: Malicious actions

text: System failures 5

text: Figure 9: Incidents per root cause category (percentage).

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Non third party failures Third party failures

text: Figure 10: Third party failures and non-third party failures of all incidents (percentages).

text: Natural phenomena 45 Human errors Malicious actions System failures

text: Figure 11: Third party root causes (percentage).

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Natural phenomena 2011

text: Human errors Malicious actions 7

text: System failures

text: Figure 12: Root cause categories for fixed telephony (percentage).

text: Natural phenomena 47 Human errors

text: Malicious actions 18 System failures

text: Figure 13: Root cause categories for fixed Internet (percentage).

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Natural phenomena 2011 Human errors Malicious actions

text: System failures

text: Figure 14: Root cause categories for mobile telephony (percentage).

text: Natural phenomena Human errors Malicious actions 10

text: System failures

text: Figure 15: Root cause categories for mobile Internet (percentage).

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: System failures 7

text: Malicious actions 53

text: Human errors 9

text: Natural phenomena 54

text: Figure 16: Average duration of incidents per root cause category (hours).

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014 which may all fail in the same incident. So the number of user connections impacted is often a multiple of the number of users impacted.

text: System failures 1500 Malicious actions 110 Human errors 690 Natural phenomena 430

text: Figure 17: Average number of user connections affected per incident per root cause (1000s)

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: System failures 1100 Malicious actions 5600 Human errors 6000 Natural phenomena 23000

text: Figure 18: Average user hours lost per incident per root cause category.

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Figure 19: Detailed causes of reported incidents (percentage)

text: The list of causes has been fine-tuned if compared with past editions of this Report. For example, the cause hardware/software failure (2011) was split in 2012, and the causes software misconfiguration, hardware misconfiguration, fire and wildfire were added for the 2013 reporting. 18

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Figure 20: Detailed causes for fixed telephony (percentage).

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Figure 21: Detailed causes for fixed Internet (percentage).

text: Figure 22: Detailed causes for mobile telephony (percentage).

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Figure 23: Detailed causes for mobile Internet (percentage).

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: 2012 Figure 24: Average duration of incidents per detailed cause (hours).

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Figure 25: Average number of user connections affected per incident per detailed cause (1000s).

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Figure 26: Average user hours lost per incident per detailed cause.

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Figure 27: Assets affected by the incidents (percentage).

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Figure 28: Assets affected by system failures (percentages).

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: PSTN VoIP

text: PSTN VoIP

text: Figure 29: Detailed causes for incidents affecting PSTN and VoIP (percentage).

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

text: Analysis of

text: Article 13

text: a annual incident reports

text: September 2014

identifier: Annual Incident Reports 2013

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: Annual Incident Reports 2013

serie: rapporter

text: Analysis of Article 13a annual incident reports

type: rubrik

text: September 2014

type: stycke

text: Annual Incident Reports 2013

text: About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Authors

text: Christoffer Karsberg, Christina Skouloudi, Dr Marnix Dekker

text: Contact

text: To contact the authors please email to resilience@enisa.europa.eu. For media enquires about this paper, please email to press@enisa.europa.eu.

text: Acknowledgements

text: For the completion of this report ENISA has worked closely with a group of experts from National Regulatory Authorities and ministries from across Europe. Listing the organizations (in no particular order): PTS (SE), Ministry of Economic Affairs (NL), FICORA (FI), Ofcom (UK), ANACOM (PT), ComReg (IE), EETT (GR), ADAE (GR), Centre for Cyber Security - CFCS (DK), RTR (AT), ANCOM (RO), CRC (BG), Ministry of Economics, Finance and Industry (FR), Bundesnetzagentur (DE), BIPT (BE), MITYC (ES), MPO (CZ), CTO (CZ), CERT LT (LT), TRASR (SK), ILR (LU), PECSRS (SI), MCA (MT), Ministry of Economic Development (IT), OCECPR (CY), NPT (NO), ETSA (EE), NMHH (HU), ITSIRI (LV), OEC (PL), AKOS (SI), Teleoff (SK), OFCOM (CH), and HAKOM (HR).

text: Legal notice

text: Page ii

text: Annual Incident Reports 2013

text: Executive summary

text: Every year, ENISA publishes an annual report about significant incidents in the electronic communications sector, which are reported to ENISA under Article 13a of the Framework Directive (

text: ), by the National Regulatory Authorities (NRAs) of the different EU Member States. This report covers the incidents that occurred in 2013 and it gives an aggregated analysis of the incident reports about severe outages across the EU. This report does not include details about individual countries or providers. The main statistical data is as follows:  90 major incidents reported: This year, in total 19 countries reported 90 significant incidents and 9 countries reported no significant incidents.  Mobile networks most affected: Approximately half of the major incidents had an impact on mobile Internet and mobile telephony.  Mobile network outages affect many users: Incidents affecting mobile Internet or mobile telephony affected most users (around 1.4 million users and 700 000 users respectively per incident). This is consistent with the high penetration rates of mobile telephony and Internet.  Impact on emergency calls: A fifth of the major incidents had an impact on the emergency calls (aka 112 access).  System failures are the most common root cause: Most major incidents were caused by “System failures” (61 % of the incidents). o Looking more in detail at this root cause category, the most common detailed causes were “software bugs” and “hardware failures”. o The assets most often affected were switches (e.g. mobile switching and routers) and base stations and controllers.  System failures affect the most user connections: Incidents categorized with the root cause system failure, affected around 1.5 million user connections on average per incident. o Looking more in detail, the detailed causes affecting most user connections were “software misconfiguration”, “software bugs”, and “power surges”.  Natural phenomena and malicious actions cause long lasting incidents: Incidents caused by natural phenomena (heavy snowfall, storms, etc.) and malicious actions (arson, cable theft, etc.) lasted on average more than 50 hours.  Natural phenomena and system failures have most impact: Multiplying number of user connection and duration, one obtains a measure for total impact, or ‘total user hours lost’. Natural phenomena had on average most impact, followed by system failures. o Looking more in detail, Power cuts, heavy snowfall, cable cuts and storms, respectively, impacted most user hours.  Base stations and switches were most affected: Overall, base stations, switches and mobile switching were the assets most affected by incidents. ENISA, together with the EC and NRAs in the EU Member States, will discuss specific incidents in more detail within the

text: Article 13

text: a Expert Group. Where needed, ENISA may publish technical guidance about mitigating specific types of incidents. This year, for example, following the 2012 incidents, ENISA has been working on recommendations for providers about how to manage security requirements for vendors and outsourcing partners they use for their core operations. The next annual report will be published in summer 2015, for the 2014 incidents.

text: Page iii

text: Annual Incident Reports 2013

text: Table of Contents

text: Executive summary iii 1 Introduction 1 2

text: Article 13

text: a of the Framework Directive: ‘Security and Integrity’ 2 3

text: Article 13

text: a Expert Group and Incident Reporting Procedure 3 4 Analysis of the incidents 6 5 Conclusions 28 References 29

text: Page iv

text: 1 Introduction

text: This is the third iteration of this report, which summarises significant security incidents reported to ENISA and the European Commission (EC), under

text: Article 13

text: a of the Framework Directive (

text: ), a new article introduced in the 2009 reform of the EU legal framework for electronic communications. This year ENISA and the EC received 90 incident reports from NRAs, about severe outages in the EU’s electronic communication networks or services which occurred in 2013. This report provides an aggregate analysis of these 90 incidents. Please note that in this document we do not provide details from the individual incident reports. The analysis is only an aggregation in terms of averages and percentages across the EU, and it does not contain references to specific countries or specific providers. Individual incidents are discussed in more detail with the NRAs in the

text: Article 13

text: a Expert Group. This document is structured as follows: Section 2 and Section 3 briefly summarize

text: Article 13

text: a and the details of the technical implementation of

text: Article 13

text: a, as agreed in the

text: Article 13

text: a Expert Group by the different NRAs of the EU Member States. Section 4 analyses the incidents from 2013 which were reported to ENISA and the EC and provides examples of incidents. The Executive Summary (at the start of this document) provides a snapshot of this analysis and the conclusions.

text: Annual Incident Reports 2013

text: Article 13

text: a of the Framework Directive: ‘Security and Integrity’

text: The reform of the EU legal framework for electronic communications, which was adopted in 2009 and was transposed by most EU countries around May 2011, adds

text: Article 13

text: a to the Framework Directive.

text: Article 13

text: a addresses the security and integrity of public electronic communications networks and services. The legislation concerns National Regulatory Authorities (NRAs) and providers of public electronic communications networks and services (providers).

text: Article 13

text: a states:  Providers of public electronic communications networks and services should take measures to guarantee security and integrity of their networks.  Providers must notify competent national authorities about breaches of security or loss of integrity that have had significant impact on the operation of networks or services.  National Regulatory Authorities should notify ENISA and national authorities abroad when necessary, for example in case of incidents with cross-border impact.  Annually, National Regulatory Authorities should submit a summary report to ENISA and the European Commission about the incidents. These incident reporting flows (incident notification and annual reporting) are shown in the diagram below. This document analyses the incidents from 2013 that have been reported to ENISA and the EC (the black dashed arrow).

text: Annual Incident Reports 2013

text: Article 13

text: a Expert Group and Incident Reporting Procedure

text: In 2010, ENISA, Ministries and NRAs initiated a series of meetings (workshops, conference calls) to achieve a harmonised implementation of

text: Article 13

text: a of the Framework directive. In these meetings, a group of experts from NRAs, called the

text: Article 13

text: a Expert Group, reached agreement on two nonbinding technical documents providing guidance to the NRAs in the EU Member States:  Technical Guidelines for Incident Reporting and  Technical Guidelines for Minimum Security Measures. The

text: Article 13

text: a Expert Group continues to meet several times a year to develop the technical guidelines and to discuss the implementation of

text: Article 13

text: a (for example, on how to supervise the electronic communications sector) and to share knowledge and exchange views about past incidents, and how to address them.

text: 3.1 Incident reporting procedure

text: In spring 2012, the Commission agreed with the EU Member States (in meetings of the Communications Committee, COCOM) to do the first round of annual summary reporting on the 2011 incidents. The decision included a recommendation to use the reporting template agreed within the

text: Article 13

text: a Expert Group and published by ENISA. Following the COCOM meeting, ENISA implemented the technical procedure by deploying a basic electronic form based on the

text: Article 13

text: a guidelines for incident reporting. There was also an agreement that in the coming years, annual reporting would be carried out by the end of February each year. In autumn 2012, ENISA developed an online incident reporting tool (called CIRAS), which replaces the electronic forms exchanged by email. CIRAS allows NRAs to exert greater control over the data reported and provides the NRAs with better access to data about incidents reported across the EU. We briefly explain the main features of the incident reporting procedure, as described in the technical guideline which was developed in collaboration with the NRAs.

text: 3.1.1 Services in scope

text: NRAs should report incidents affecting the following communication services and networks:  Fixed telephony (e.g. PSTN, VoIP over DSL, Cable, Fibre, etc.),  Mobile telephony (e.g. GSM, UMTS, LTE, etc.),  Fixed Internet access (e.g. DSL, Fibre, Cable, etc.),  Mobile Internet access (e.g. GPRS/EDGE, UMTS, LTE, etc.) NRAs may also report about incidents affecting other types of services.

text: 3.1.2 Security incidents in scope

text: NRAs should report security incidents, which had a significant impact on the continuity of supply of electronic communications networks or services.

text: 3.1.3 National user base

text: NRAs should provide estimates of the total number of users of each service in their country.  For fixed telephony and Internet, NRAs should use the number of subscribers or access lines in their country.  For mobile telephony, NRAs should use the number of active telephony SIM cards.

text: Annual Incident Reports 2013

text:  For mobile Internet, NRAs should sum up :

text: 1. The number of standard mobile subscriptions, which offer both telephony and Internet access, and which have been used for Internet access recently (e.g. in the past 3 months).

text: 2. The number of subscriptions dedicated for mobile Internet access, which are purchased separately, either standalone or on top of an existing voice subscription.

text: 3.1.4 Thresholds

text: The threshold for annual summary reporting is based on the duration and the number of users of a service affected as a percentage of the national user base of the service. NRAs should send an incident report, as part of the annual summary reporting, if the incident:  lasts more than an hour, and the percentage of users affected is higher than 15 %,  lasts more than 2 hours, and the percentage of users affected is higher than 10 %,  lasts more than 4 hours, and the percentage of users affected is higher than 5 %,  lasts more than 6 hours, and the percentage of users affected is higher than 2 %, or if it  lasts more than 8 hours, and the percentage of users affected is higher than 1 %.

text: >8 1h 2h 4h 6h <. <. <. <. h ..<2 ..<4 ..<6 ..<8 h h h h

text: 1%<...< 2% of user base

text: 2%<...< 5% of user base

text: 5%<...< 10% of user base

text: 10%<...< 15% of user base

text: > 15% of user base

text: The threshold should be understood ‘per service’. In other words, if one incident involves impact on multiple services, then for one of the services the threshold should be passed in order to trigger the reporting mechanism. NRAs may also report incidents with impact graded below the threshold. For 2013, we introduced a new optional threshold for annual summary reporting, based on absolute impact, in order to allow NRAs in large Member States to include larger incidents but that would not exceed the relative thresholds. NRAs may optionally include incidents when the product of duration and number of user connections affected exceeds 180 million user minutes, or 3 million user hours. For next year’s reporting, about the 2014 incidents, this absolute threshold has been lowered and becomes mandatory.

text: Annual Incident Reports 2013

text: 3.1.5 Root cause categories

text: In the incident reports four categories of root causes have been distinguished plus one category that is used in conjunction with one of the other four categories.  Natural phenomena – This category includes incidents caused by severe weather, earthquakes, floods, pandemic diseases, wildfires, wildlife, and so on.  Human errors - This category includes incidents caused by errors committed by employees of the provider or outside the provider, during the operation of equipment or facilities, the use of tools, the execution of procedures, etc. E.g. an excavator cutting off a cable.  Malicious attacks - This category includes incidents caused by a deliberate act by someone or some organisation, e.g. a cyber-attack or a cable theft.  System failures – This category includes incidents caused by failures of a system, for example hardware failures, software failures or flaws in manuals, procedures or policies.  Third party failures – This category includes incidents caused by a failure or incident at a third party. This category is used in conjunctions with one of the other root cause categories.

text: Annual Incident Reports 2013

text: 4 Analysis of the incidents

text: In total, all 28 EU Member States participated in this process. Of these, 18 countries and one EFTA Member State reported in total 90 significant incidents, 9 countries reported there were no significant incidents and one country had not implemented incident reporting yet. The two pie charts to the right show the situation the previous two years. In the rest of this report we show, besides the data about the 2013 incidents, figures and diagrams from the previous two years, to allow the reader to make a comparison.

text: In this section the In this section, the 90 reported incidents are aggregated and analysed. First, the impact per service is analysed (in Section 4.1 ), then the impact per root cause category is analysed (Section 4.2), and in Section 4.3 detailed causes are examined. In Section 4.3 impact as a product of user connections affected and duration of the incidents is analysed and in Section 4.5 the components or assets affected by the incidents are considered. Throughout the text we provide anonymized descriptions (in blue italic) of actual large-scale incidents which occurred in 2013.

text: Note about statistical conclusions: Readers should be cautious when drawing conclusions from the statistics in this report. In particular, they should take into account that: 1. The scope of reporting major security incidents is restricted to incidents with an impact on the continuity of public electronic communication services and networks. There are many other types of incidents with an impact on security of services and networks which are not in scope of annual reporting. For example, if attackers would wiretap undersea cables without causing any outages, then such a security incident would not be included in the annual reporting. 2. We are still in the early phases of implementation of

text: Article 13

text: a. There are still changes and improvements in the way national and EU reporting is being implemented. Statistical conclusions about multi-annual trends should therefore be drawn with care.

text: 3. The scope of reporting includes only major, or significant, incidents scoring above the agreed thresholds. Smaller incidents are not reported at an EU level and this means that the view is skewed towards the larger incidents.

text: Annual Incident Reports 2013

text: 4.1 Impact of incidents

text: We focus first on the impact of incidents on the electronic communications networks and services.

text: 4.1.1 Impact per service

text: Approximately half of the reported incidents affected mobile internet or mobile telephony, as was the case in 2012 and in 2013.

text: 53 48 29 19

text: Most incidents have an impact on two or more services (which is why the percentages in the chart add up to 149 %). National thresholds for reporting are per service and a percentage of the total national user base for that service. So this would suggest that mobile services are more at risk of large outages than fixed services.

text: Faulty network update caused mobile telephony and mobile Internet to fail (duration: hours,

text: connections: millions, cause: system failure): A planned network upgrade was done at night for mobile phone call services. After the upgrade, customers’ call and data services failed. Because the change was made to call and not data services, the cause of the failure was difficult to locate. The problem occurred to users under one Radio Network Controller (RNC), but not all of them, which rendered locating the cause even harder.

text: Annual Incident Reports 2013

text: 4.1.2 Number of user connections affected

text: Mobile Internet outages affected on average 1.4 million user connections per incident. Incidents with an impact on mobile telephony affected on average 700 000 user connections.

text: 1400 700 200 100

text: The difference between fixed and mobile may partly be due to the fact that some of the impacted components, we call them assets, in the mobile networks, were more centrally located parts of the networks as compared to the failed assets for fixed services, thus affecting more user connections per incident. EU averages shown here are not representative of the size of incidents nationally. The averages in these diagrams include both small and large countries. Nationally, the average size of incidents can be very different, depending on the size of the population and/or the national network topology.

text: Annual Incident Reports 2013

text: 4.1.3 Percentage of the national user base affected

text: Mobile Internet outages impacted about 9 % of the national user base for mobile Internet user connections on average, a significant portion of the national user base. Each year there has been a drop in failed user connections for all services, but it should be noted that a larger share of smaller incidents have been reported year by year. All three years, mobile Internet has been reported to suffer the most impact in terms of affected user connections compared to the other services.

text: 9 5 5 4

text: Faulty upgrade in router caused mobile Internet to fail (duration: hours, connections: thousands,

text: cause: system failure): Disruption of connection of mobile data sessions was caused by a failed upgrade of hardware and software in a router.

text: 4.1.4 Impact on emergency services

text: One fifth of the incidents involved an impact on emergency calls - i.e. the possibility for users to contact emergency call-centres using the emergency number 112. Compared to previous years this figure is at its lowest.

text: 21 79

text: Annual Incident Reports 2013

text: 4.1.5 Impact on interconnections

text: In 4 % of the incidents there was an impact on interconnections between other providers. This is the lowest figure since annual summary reporting started.

text: 4 96

text: Annual Incident Reports 2013

text: 4.2 Root cause categories

text: Now we look at the main root cause categories of reported incidents. Root cause categories are very broad categories for incidents.

text: 4.2.1 Incidents per root cause category

text: In 2013 about 61 % of the incidents were ‘System failures’, 19 % caused by ‘human errors’. Only 6 % was categorized as ‘malicious actions’. Over the last 3 years the root cause category ‘System failures’ has been the most common root cause category.

text: 14 12 19 6

text: Hardware failure caused interruptions to mobile Internet services (duration: hours, connections:

text: thousands, cause: system failure): A hardware failure on the transmission node (router) caused the interruption of all data traffic between the Gateway GPRS Support Node (GGSN) and gateway router. All mobile users who during the time of failure tried to access the Internet were affected.

text: Annual Incident Reports 2013

text: 4.2.2 Third party failures

text: About 11 % of the incidents reported were categorized as ‘third party failures’ (see Figure 10).

text: 11 89

text: We analyse these third party failures in more detail and show the corresponding root cause category in these cases (see Figure 11). Third party failures have similar root causes as incidents which are not categorized as third party failures.

text: 18 27 9

text: Cable cut caused mobile outage (duration: hours, connections: thousands, cause: third party and

text: human error): Mobile telephony and mobile Internet services were disrupted for thousands of users for several hours when another operator was installing a cable and cut a cable of the former operator. At the same time as the fault was located, the redundant connection also failed. The interface unit of the redundant connection was reset, which returned the services for customers. The cable cut was fixed and the traffic was rerouted back to the original route.

text: Annual Incident Reports 2013

text: 4.2.3 Root cause categories per service

text: Here we look at the root causes for each of the four services separately: fixed telephony, fixed Internet access, mobile telephony and mobile Internet access.

text: In 2013, most of the incidents with an impact on fixed telephony and fixed Internet were caused by natural phenomena. Most of the incidents with an impact on mobile telephony and mobile Internet were categorized as System failures.

text: Fixed telephony

text: 27 38 31

text: Fixed Internet

text: 24 12

text: Annual Incident Reports 2013

text: Mobile Telephony

text: 11 3

text: 58 12

text: 2 87

text: Mobile Internet

text: 21 3 58 17 5

text: Annual Incident Reports 2013

text: 4.2.4 Average duration of incidents per root cause category

text: Incidents caused by natural phenomena had a long recovery time on average per incident (54 hours). This year the average incident duration for malicious actions was also high (53 hours). It should be mentioned, however, that the figure was skewed by one particular incident which took very long to resolve (164 hours). Overall natural phenomena caused the longest outages for all three years.

text: DDoS attack on DNS servers causing Internet unavailability (duration: days, connections: thousands,

text: cause: malicious action): The DNS of some Internet service providers were DDoS attacked causing Internet access to be practically unavailable for 150 000 users for 2 hours.

text: Theft attempt caused cable cut to carrier network (duration: days, connections: thousands, cause:

text: malicious action): An attempted theft of copper resulted in the cutting of 12 cables, each containing over 100 fibres. The incident occurred on the same street as the Point of Presence (PoP) site for the national carrier network resulting in a failure of all resilient service options.

text: Storm shut down Power supply causing mobile networks to fail (duration: days, connection:

text: thousands, cause: natural phenomena and third party failure): A storm hit the country damaging trees, affecting the power grid and all mobile networks within the storm area. The impact was limited to urban areas but its effect was more long lasting in rural areas. The base stations ran out of battery and were left without power. Also some fixed lines were affected.

text: 4.2.5 Average number of user connections affected per root cause category

text: We now show the number of user connections affected per incident for each of the different root cause categories. We are showing user connections affected and not users affected, because a single consumer often has access to multiple services, for example fixed telephony and mobile telephony,

text: Annual Incident Reports 2013

text: System failures affected most user connections; on average over 1.5 million user connections per incident. Comparing with the analysis of the duration, this means that incidents caused by malicious actions lasted very long (over 50 hours) but the number of user connections impacted in these incidents was relatively limited (on around 100 000 user connections).

text: Annual Incident Reports 2013

text: 4.2.6 User hours lost per root cause category

text: Last year we started to look at the impact in terms of user hours lost. Taking into account both the number of user connections affected and the duration of the incident yields a measure for the total impact of an incident. We call it ‘user hours lost’. Natural phenomena had most impact in terms of user hours lost. This suggests that this is the category of outages which affects most users most of the time. At the same time, it is important to remember that these numbers are only representative of large scale incidents, because small incidents remain below the thresholds.

text: Severe storm affecting power supply and mobile networks causing large scale mobile outage

text: (duration: days, connections: thousands, cause: natural phenomena and third party failure): A deep low-pressure with storms and hurricane winds caused power outages, damaged transmission lines to mobile sites and damaged access networks. Hundreds of GSM and LTE sites and thousands of UMTS sites were affected, with some lasting longer than 72 hours.

text: Annual Incident Reports 2013

text: 4.3 Detailed causes

text: Root cause categories are rather broad. In this section we look at the detailed causes of incidents. The detailed causes give a better overview of what are technically the causes of incidents. To explain the difference between root cause categories and detailed causes: Take for example an incident in which a storm leads to a power cut which leads to an outage. For this incident both storm and power cut are detailed causes.

text: 4.3.1 Detailed causes of all incidents

text: In 2013, the most common causes of incidents were ‘software bug’ and ‘hardware failure’. This was also the case for the previous two years. Also ‘power cut’ was among the top four causes during all three years. For the 2013 reporting, we added ‘software misconfiguration’ as a cause, which turned out to be a significant cause of incidents .

text: Outage for mobile Internet users caused by hard disc failure (duration: hours, connections:

text: thousands, cause: hardware failure): A hard disc failure occurred on one of the Serving GPRS Support Nodes (SGSN) when swapping over to a backup image on a redundant disc. All connectivity was lost to the SGSN leaving hundreds of thousands subscribers without mobile Internet access for eight hours.

text: Annual Incident Reports 2013

text: 4.3.2 Detailed causes per service

text: Now we split up the data about detailed causes for each of the four services (fixed telephony, fixed Internet, mobile telephony and mobile Internet) - see figures 20, 21, 22 and 23 below. Many incidents with an impact on fixed telephony and fixed Internet were caused by power cuts, and many incidents with an impact on mobile Internet and mobile telephony were caused by hardware failures and software bugs but also power cuts was a significant cause of failure.

text: Annual Incident Reports 2013

text: Annual Incident Reports 2013

text: Annual Incident Reports 2013

text: 4.3.3 Average duration of incidents per detailed cause

text: Last year we started to look at average duration of incidents, user connections affected and impact in terms of duration times the user connections affected for the detailed causes. Incidents caused by Fire and Heavy Snowfall had the longest duration (86 and 62 hours respectively) followed by power cuts (53 hours) and Storms (47 hours).

text: Snowstorms caused mobile service outages (durations: days, connections: thousands, cause: heavy

text: snowfall): The weather conditions were unusually bad for five days causing outages to mobile communications in 50 villages and smaller towns. 150 2G base stations and 50 3G stations all in all went down.

text: Annual Incident Reports 2013

text: 4.3.4 Average number of user connections affected per detailed cause

text: Software bugs were the cause affecting most user connections (more than 2.4 million connections on average per incident) followed by power surges and bad maintenance with 2 million and 1.2 million affected connections respectively.

text: Software bug caused outage for millions of mobile Internet users nationally (duration: hours,

text: connections: millions, cause: software bug): Mobile data transmission services failed for three million users for several hours caused by the database for tariff management running out of memory space. Due to a software bug, no memory storage alerts were submitted and the services provided by the database could not be automatically restarted.

text: Annual Incident Reports 2013

text: 4.3.5 User hours lost per detailed cause

text: Power cuts are the detailed cause that had most impact in terms of user hours lost, followed by heavy snowfall and cable cut. Also in 2012 Power cuts had high impact. Cyber-attacks did not have any significant impact on electronic communications during 2013.

text: Power failure caused service failure for virtual mobile operator (duration: hours, connections: thousands, cause: power failure):

text: Loss of primary and secondary power to the data centre of a Mobile Virtual Network Operator caused a loss of voice and data connections. After reinstating the primary circuit breaker, power was restored and subsequent actions returned the equipment to full service.

text: Annual Incident Reports 2013

text: 4.4 Assets affected

text: For the second year we received reports from NRAs about which components or assets of the electronic communications networks were affected by the incidents. This provides some more information about the nature of the outages and what assets of the infrastructure that were primarily involved in them.

text: 4.4.1 Assets affected overall

text: Base stations and controllers were the assets most affected, followed by Switches. Also in 2012 Base stations and Switches were in the top three in terms of assets affected.

text: Power cuts due to bad weather shut down mobile base stations (duration: days, connections:

text: thousands, causes: power cut): A severe storm caused long lasting power cuts leading to mobile communication base stations shutting down. Also communication cables had physical breaks. Over 200 2G and 100 3G base stations became non-operational for about four days.

text: Annual Incident Reports 2013

text: 4.4.2 Affected assets in system failures

text: System failure was the most common root cause category for all incidents in 2013. In these system failures the most often affected assets were the Mobile Switching Centres (MSC), the switches and routers, and the base stations.

text: Switching server failure caused mobile outage (duration: hours, connections: thousands, cause:

text: system failure): Due to a failure in a switching server, mobile communications (2G and 3G) became unavailable in a large part of the country.

text: Annual Incident Reports 2013

text: 4.4.3 VoIP versus PSTN

text: We also split the service fixed telephony into traditional circuit switched fixed telephony (PSTN) and fixed IP based telephony (VoIP) to see what are the common detailed causes. Both PSTN and VoIP were mostly affected by storms. PSTN was also affected by hardware failure, and on third place power cuts and flood, whereas VoIP was evenly affected by hardware failure, software bugs, bad change and flooding. Figure 29 shows the overall picture of the causes, for incidents affecting PSTN and VoIP services.

text: Annual Incident Reports 2013

text: 5 Conclusions

text: In this Report ENISA summarized how the incident reporting scheme, mandated by

text: Article 13

text: a of the Framework Directive (

text: ), was implemented across the EU and analysed incident reports from 2013. ENISA and the Commission received as part of the third round of reporting from the National Regulatory Authorities 90 reports about major incidents that occurred in 2013. From the 90 significant incidents reported to ENISA and the European Commission, the following conclusions can be drawn.  Mobile networks most affected: Most incidents affected mobile Internet followed by mobile telephony (53 % and 48 % respectively).  Mobile network outages affect many users: Incidents affecting mobile Internet or mobile telephony affected most users (around 1.4 million users and 700 000 users respectively per incident). This is consistent with the high penetration rate of mobile telephony and mobile Internet.  Emergency Services are affected by incidents: In 21 % of the incidents there was impact on emergency calls using the emergency number 112.  System failures are the most common root cause: Most incidents were caused by root causes in the category system failures (61 % of the incidents). This was the most common root cause category for mobile networks. In the category system failures, software bugs and hardware failures were the most common causes. The assets most often affected by system failures were switches (e.g. mobile switching and routers) and base stations and controllers.  System failures affect many users: Incidents categorized with the root cause system failures, affected around 1.5 million user connections on average per incident. Incidents involving the detailed cause software bug affected around 2.5 million connections on average per incident.  Natural phenomena and malicious actions cause long lasting incidents: Incidents caused by natural phenomena (mainly storms and heavy snowfalls) and malicious actions lasted on average 54 and 53 hours respectively.  Power cuts and heavy snowfall have most impact: Incidents caused by power cuts followed by heavy snowfall respectively had most impact in terms of number of user connections affected multiplied by the duration of the incident.  Base stations and Switches most affected by incidents: Overall, base stations, switches and mobile switching were the network components most affected by incidents. Based on the annual summary reporting of 2011 and 2012 incidents, ENISA analysed in 2013 the dependencies in the electronic communications sector on power supply and issued recommendations regarding the sector’s ability to withstand and act efficiently after power cuts. ENISA also studied in 2013 national roaming for increased resilience in mobile networks. This year, based on the annual summary reporting of 2012 and 2013 incidents, ENISA is issuing recommendations for providers about how to manage security requirements for vendors and outsourcing partners they use for their core operations. Based on the 2012 and 2013 summary reporting ENISA is also studying national initiatives to reduce the number of under-ground cable breaks caused by mistakes. ENISA, in the context of the

text: Article 13

text: a Expert Group, will discuss specific incidents in more detail with the NRAs, and if needed, discuss and agree on mitigating measures. ENISA would like to take this opportunity to thank the NRAs, Ministries and the European Commission for a fruitful collaboration and we look forward to leveraging this kind of reporting to further improve the security and resilience of the electronic communications sector in the EU and more generally for supervision of security also in other critical sectors. The next annual report will be published in summer 2015, for the 2014 incidents.

text: Annual Incident Reports 2013

text: References Related ENISA papers

text:  The

text: Article 13

text: a EG technical guidelines on incident reporting and on security measures: https://resilience.enisa.europa.eu/article-13  ENISA’s reports about the 2011 and 2012 incidents, reported under

text: Article 13

text: a: http://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidents-reporting/annualreports  ENISA’s study 2013 on Power Supply Dependencies in the Electronic Communications Sector: http://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidentsreporting/power-supply-dependencies  ENISA’s study 2013 on National Roaming for Resilience: http://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidents-reporting/nationalroaming-for-resilience  ENISA’s whitepaper on cyber incident reporting in the EU shows

text: Article 13

text: a and how it compares to some other security articles mandating incident reporting and security measures: http://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidentsreporting/cyber-incident-reporting-in-the-eu  For the interested reader, ENISA’s 2009 paper on incident reporting shows an overview of the situation in the EU 5 years ago: http://www.enisa.europa.eu/activities/Resilience-and- CIIP/Incidents-reporting/good-practice-guide-on-incident-reporting/good-practice-guide-onincident-reporting-1

text: EU legislation

text: Article 13

text: a of the Framework directive of the EU legislative framework on electronic communications: http://ec.europa.eu/information_society/policy/ecomm/doc/140framework.pdf  The electronic communications regulatory framework (incorporating the telecom reform): http://ec.europa.eu/information_society/policy/ecomm/doc/library/regframeforec_dec200 9.pdf  An overview of the main elements of the 2009 reform: http://ec.europa.eu/information_society/policy/ecomm/tomorrow/reform/index_en.htm  In 2013 the European Commission issued a European Cyber Security Strategy and proposed a directive on Cyber Security. Article 14 of the proposed directive is similar to

text: Article 13

text: a, requiring operators to take appropriate security measures and to report significant incidents.

text: Annual Incident Reports 2013

text: TP -AD -14 -001 -EN -N

text: ENISA

text: Athens Office

text: ISBN: 978-92-9204-095-6 1 Vass. Sofias & Meg. Alexandrou Marousi 151 24, Athens, Greece ISSN: 2363-2097 DOI: 10.2824/32965

text: PO Box 1309, 710 01 Heraklion, Greece Tel: +30 28 14 40 9710 30 info@enisa.europa.eu www.enisa.europa.eu