text: th In conclusion, the 5 edition of the Annual Privacy Forum (APF) has been deemed successful as it managed not only to continue attracting well acknowledged experts in the areas of privacy and data protection but also to engage a large number or stakeholders and researchers. Within the two days, the organizers succeeded in promoting discussions and exchange of novel ideas, bridging the gap between research, business models and policy.

identifier: Annual Privacy Forum 2017

title: Annual Privacy Forum 2017

text: A brief overview

text: DECEMBER 2017 www.enisa.europa.eu European Union Agency For Network and Information Security Annual Privacy Forum 2017

text: | | Error! No text of specified style in document. | December 2017

text: About ENISA The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu. Contact For queries in relation to this paper, please use isdp@enisa.europa.eu For media enquires about this paper, please use press@enisa.europa.eu. Legal notice Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Copyright Notice © European Union Agency for Network and Information Security (ENISA), 2017 Reproduction is authorised provided the source is acknowledged. 02 Annual Privacy Forum 2017

text: Table of Contents 1. Introduction 4 2. Programme 5 Invited Talks 5 Panel Sessions 6 2.2.1 Privacy regulation in a global context considering new challenges like Artificial Intelligence 6 2.2.2 Towards a European Data Protection Certification Scheme 6 2.2.3 Practical Implementation of GDPR in Mobile Applications 6 2.2.4 Lawful Interception and PETs 6 Scientific Track 7 3. Conclusions 9 Annex A: APF Programme 10 Day 1 – June 7, 2017 10 Day 2 – June 8, 2017 11 Annex B: Call for Papers 13 Call for papers text 13 Programme Committee 14 03 Annual Privacy Forum 2017

text: 1. Introduction Electronic communication networks and interconnected digital services have become ubiquitous as they have permeated every fold of everyday life. At a time when automated profiling and electronic surveillance have become commodities, citizens and businesses alike may face limitations and threats when they have personal data processed or seek to protect their privacy on the internet or when using general communication services. Limitations in the transparency, the functionality and interconnectivity of online and communication services increase the risk of having personal data processed out of control of any accountable person or organisation or simply becoming exposed to all sorts of privacy threats. The recalibrated legal framework in the EU as manifested by the promulgation of the General Data Protection Regulation (GDPR) , is key in an effort to better control the processing of personal data. Additionally the recent EC proposal for a Regulation on Privacy and Electronic Communications is expected to give new impetus to the way privacy is protected in electronic communications. Even the best legislative efforts cannot keep up to speed with the pace of innovative technology and business models that challenge the way personal data is processed and privacy is protected across the EU and beyond; therefore examining what is at stake and where threats originate from becomes of paramount importance. In the light of GDPR and the recent EC proposal for a Regulation on Privacy and Electronic Communications, DG CONNECT, ENISA and the Law Faculty of the University of Vienna, Arbeitsgruppe Rechtsinformatikis organized the fifth edition of Annual Privacy Forum (APF) in Vienna, Austria on June 7 & 8, 2017. The event encouraged dialogue with panel discussions and provided room for exchange of ideas in between scientific sessions. This two-day conference was well attended by more than 100 participants in addition to more than 70 viewers through the web streaming service. http://eur-lex.europa.eu/eli/reg/2016/679/oj https://ec.europa.eu/digital-single-market/en/news/proposal-regulation-privacy-and-electronic-communications 04 Annual Privacy Forum 2017

text: 2. Programme Invited speeches Three keynote speakers were invited, namely Peter Fleischer, Google, Reinhard Posch, TU Graz & Austria Chief Information Officer and Rosa Barcelo , European Commission. Their details are listed below. Peter Fleischer has worked as Google’s Global Privacy Counsel since 2006. Based in Europe, Peter is Google’s longest serving privacy leader. He counsels Google teams on how to design privacy sensitive and legally compliant products. Peter has designed many of Google’s privacy compliance programs. He has met with thousands of privacy officials and leaders worldwide. Peter has managed scores of regulatory actions around the world, and appeared before some of the world’s highest courts. Prior to joining Google, Peter worked for 10 years at Microsoft, as EMEA privacy leader and Director of Regulatory Compliance. Peter is a graduate of Harvard College and Harvard Law School. Reinhard Posch is chairman of the board of trustees of the non-profit foundation Stiftung Secure Information and Communication Technologies SIC which has been donated by Graz University of Technology. Reinhard Posch was also Chair of the Board of ENISA, the European Network and Security Agency. Reinhard Posch takes part in groups installed by the European Commission to elaborate ICT and security strategies (e.g. „Future Internet Visionaries“, RISEPTIS). Being a member of the "Rat der IT Weisen" he has provided advice to Commissioners Kroes and Sefkovic in the area of IT-Security to assist the implementation of the Digital Agenda. The keynote of Ms. Barcelo was provided by a colleague of hers, due to last minute change in her agenda. 05 Annual Privacy Forum 2017

text: Rosa Barcelo works at the European Commission, in DG CONNECT (Unit H1 – Cybersecurity and Digital Privacy Unit) where she is Deputy Head of Unit. The Unit is responsible the review of the ePrivacy Directive (2002/58). It is also competent for legislative, policy and R&I actions to improve network and information security, such as the NIS Directive.Prior to taking up this job, Rosa worked for the European Data Protection Supervisor (2006-2011) and in DG JUSTICE Data Protection Unit of the European Commission. Rosa has worked as a private lawyer in the Brussels offices of Morrison and Foerster and DLA Piper where she advised clients on European privacy and data protection, electronic commerce and technology law. She also worked for some years in the academia (Belgium and Spain). She obtained her PhD in Law with a dissertation on electronic contracts and digital signatures. Panel Sessions Throughout the programme, four panel sessions were organized, targeting mainly topics and areas closely related to the Agency’s activities for 2017. An overview of the sessions is presented hereinafter. 2.2.1 Privacy regulation in a global context considering new challenges like Artificial Intelligence User interfaces - hardware and software - are produced for a global market. Artificial Intelligence (AI) tools with big data analytics allow more personalised services, resulting in a competitive advantage for respective companies. Therefore, privacy regulation must face these challenges and take into account that the global market must focus on privacy-friendly solutions. Ethics can play a strong role in this direction. 2.2.2 Towards a European Data Protection Certification Scheme In the Recitals of GDPR it is stated that “In order to enhance transparency and compliance with this Regulation, the establishment of certification mechanisms and data protection seals and marks should be encouraged, allowing data subjects to quickly assess the level of data protection of relevant products and services”. The objective of this panel was to identify and explore the challenges and opportunities of GDPR personal data protection certification mechanisms. 2.2.3 Practical Implementation of GDPR in Mobile Applications In the course of the GDPR implementation, one very important aspect is the practical application of the specific data protection obligations (e.g. purpose limitation, data minimization, transparency, consent, etc.) into technical and organisational controls that can be used to achieve and/or assess compliance. The aforementioned concern is especially crucial in the area of mobile applications (apps). The objective of this panel was to discuss the current software development practices and challenges specific to app developers with regard to the processing of personal data and explore the level of practical implementation of GDPR. 2.2.4 Lawful Interception and PETs With the increasing importance of information services in virtually every aspect of life, the need for strong protection mechanisms for private information arises. This need is addressed by a wide spectrum of tools providing confidentiality, integrity and anonymity, which play a key role in the prevention of cybercrime. On the flip, side these tools can be adapted and used with criminal intend and then pose a critical impediment to the detection, investigation and prosecution of criminals across all crime areas. This leaves law enforcement with a conflict where cryptographic tools that are used to prevent crime are also used by criminals to engage in crime. Experts from ENISA, EUROPOL and Academia discussed how to find practical 06 Annual Privacy Forum 2017

text: solutions for this issue, reflecting the state of the art in electronic criminal investigations and what types of new evidence can be used in investigations. Scientific Track As in previous years, half of the conference agenda was dedicated to presentations of new ideas from research. To identify these new ideas, a call for papers was published in early 2017. This call was advertised by the programme committee (PC) members and published at relevant platforms, e.g. wiki-CfP . The Program Committee (PC) presented in section B.2 was composed of senior academics, alongside legal and technical experts. The submission process was supported by EasyChair . In total, we received 41 submissions in response to our call for papers. Each paper was peer-reviewed by at least four members of the Program Committee. On the basis of significance, novelty, and scientific quality, 12 full research papers were selected and were presented to the event. Revised versions of these papers were published as postproceedings from Springer LNCS . http://www.wikicfp.com/cfp/ http://easychair.org/ http://www.springer.com/cn/book/9783319672793 07 Annual Privacy Forum 2017

text: 3. Organisational overview APF17 has been significant as it has become the first ever edition that has been funding neutral to the Agency. While a modest amount of appropriations in the order of 20 000 EUR has been put at the disposal of the organisers as has been the case in the past, the efficient organisational practices of all parties involved has rendered the event very attractive for sponsorships. The private sector, clearly motivated by the prominence of GDPR repeated events in this period, has provided adequate financial support. In addition, certain costs have been covered via third party funding which is available through public services in Vienna, such as a dinner sponsored by the City of Vienna. ENISA has bene reviewing its approach towards the APF to (a) include private sector representatives as local co-organisers to complement academic ones and (b) encouraging local actors to support the conference in a way that it becomes self-sufficient in funding. Clearly for extraordinary costs and a precautionary measure it is recommended to retain the option to support the organisation budget with a modest sum as it has been the case over the years. The next two editions of the APF are planned to be organised as follows: 1. In 2018, Barcelona, with the support of the Universidad Politecnica de Catalunya and Telefonica 2. In 2019, Rome Universita La Sapienza and a private sector partner TBD Suitable arrangements have bene made with for both cases. 08 Annual Privacy Forum 2017

text: 4. Conclusions Building on top of the experience accumulated all these five years, it is safe to say that the next edition of the Annual privacy Forum, which is expected to take place in June 2017, will continue attracting multidisciplinary experts, researchers and policy makers in the areas of privacy and data protection. 09 Annual Privacy Forum 2017

text: Annex A: APF Programme Day 1 – June 7, 2017

text: DAY 1. WEDNESDAY JUNE 07, 2017

text: 8:00 Registration & Coffee Dean Prof. Paul Oberhammer, University of Vienna 9:00 Opening Remarks Prof. Erich Schweighofer, University of Vienna Mr. Paulo Empadinhas, ENISA 9:15 Opening Keynote Mr. Wojciech Wiewiórowski, EDPS

text: Keynote

text: 9:45 "Technology and Privacy: how Google is preparing for the Mr. Peter Fleischer, Google

text: GDPR"

text: 10:30 Networking Coffee

text: Paper Session I

text: The GDPR and Big Data: leading the way for Big Genetic Kärt Pormeister Data?

text: Towards a Privacy-preserving Reliable European Identity Jorge Bernal Bernabe, Antonio Skarmeta Gomez, Nicolás 11:00 Ecosystem Notario, Julien Bringer and Martin David Forget Me, Forget Me Not - Redefining the Boundaries of the Right to be Forgotten to Address Current Problems Beata Sobkow and Areas of Criticism

text: A Refinement Approach for the Reuse of Privacy Risk Sourya Joyee De and Daniel Le Métayer Analysis Results 12:30 Lunch

text: Panelists

text: - Ms. Marit Hansen, Unabhängiges Landeszentrum für

text: Panel Session I : “Practical Implementation of GDPR in

text: Datenschutz

text: Mobile Applications”

text: - Mr. Arndt Gerdes, Huawei Technologies The objective of this panel is to discuss the current - Mr. Peter Kraus, EDPS 13:30 software development practices and challenges specific to - Mr. Peter Fleicher, Google app developers with regard to the processing of personal

text: Moderator

text: data and explore the level of practical implementation of Ms. Athena Bourka, ENISA GDPR.

text: 15:00 Networking Coffee

text: 15:30 Paper Session II

text: Annual Privacy Forum 2017

text: DAY 1. WEDNESDAY JUNE 07, 2017

text: A Gamified Approach to explore Techniques of Andreas Rieb, Tamara Gurschler and Ulrike Lechner Neutralization of Threat Actors in Cybercrime

text: Privacy by Design Data Exchange between CSIRTs Erich Schweighofer, Vinzenz Heußler and Peter Kieseberg

text: Mr X vs. Mr Y: the emergence of externalities in Maurizio Naldi and Giuseppe D'Acquisto differential privacy

text: Diffix: High-Utility Database Anonymization Paul Francis and Sebastian Probst Eide

text: Panelists

text: - Ms. Jelena Burnik, Slovenian DPA - Ms Bojana Bellamy, CIPL

text: Panel Session II: “Towards a European Data Protection

text: - Mr. Sebastian Meissner, EuroPriSe

text: Certification Scheme”

text: - Ms. Irene Kamara, Tilburg University (TILT), Vrije Universiteit Brussel (LSTS) 17:00 The objective of this panel is to identify and explore the - Mr. José M. del Álamo, TRUESSEC.EU challenges and opportunities of personal data protection certification mechanisms, seals or marks focusing also on existing initiatives and voluntary schemes

text: Moderator

text: Mr. Prokopios Drogkaris, ENISA

text: Dinner

text: Day 2 – June 8, 2017

text: DAY 2. THURSDAY JUNE 08, 2017

text: 8:30 Registration & Coffee

text: Keynote

text: Mr. Reinhard Posch, TU Graz & Austria Chief Information 9:00 “Data protection issues into the context of modern Officer

text: technology environments”

text: Keynote

text: Ms. Rosa Barcelo, European Commission “ePrivacy Regulation proposal”

text: 10:30 Networking Coffee

text: Panellists Panel Session III: “Privacy regulation in a global context”

text: - Ms. Caroline Goemans Dorny, Interpol (tbc) - Mr. Zoltán Précsényi, Symantec User interfaces - hardware and software - are produced for - Mr. Niko Härting, PinG a global market. AI tools with big data analytics allow more 11:00 - Mr. Maximilian Schrems, Privacy Activist personalized services, resulting in a competitive advantage for respective companies. Therefore, privacy regulation must face these challenges and take into

text: Moderator

text: account that the global market must focus on privacy- Mr. Erich Schweighofer, University of Vienna

text: Annual Privacy Forum 2017

text: DAY 2. THURSDAY JUNE 08, 2017

text: 12:30 Lunch

text: Paper Session III

text: Towards a Principled Approach for Engineering Privacy by Majed Alshammari and Andrew Simpson Design

text: PrivacyScore: Improving Privacy and Security via Crowd- Max Maaß and Dominik Herrmann Sourced Benchmarks of Websites 13:30 Vasiliki Diamantopoulou, Konstantinos Angelopoulos, Julian Privacy Data Management and Awareness for Public Flake, Andrea Praitano, José Francisco Ruiz, Jan Jürjens, Administrations: a Case Study from the Healthcare Michalis Pavlidis, Dimitri Bonutto, Andrès Castillo Sanz, Domain Haralambos Mouratidis, Javier García Robles and Alberto Eugenio Tozzi

text: Better Data Protection by Design through Multicriteria Decision Making: On False Tradeoffs between Privacy and Bettina Berendt Utility

text: 15:00 Networking Coffee

text: Panel Session IV: “Lawful interception and PETs” Panelists

text: - Mr. Philipp Amann, Europol EC3 The EC3-ENISA joint working group on encryption invites - Mr. Laurent Beslay, DG Joint Research Centre to discuss practical solutions for the conflict where - Mr. Stephan Krenn, AIT 15:30 cryptographic tools that are used to prevent crime are also used by criminals to engage in crime. We will reflect the state of the art in electronic criminal investigations and Moderator what types of new evidence can be used during the Mr. Stefan Schiffner, ENISA investigations.

text: 17:00 End of Event

text: privacyhub.wien - Annual Privacy Forum – OCG

text: Mr. Max Maaß

text: Invited Talk: “Eine praxisnahe Einführung in die

text: 18:00 PrivacyScore-Benchmarking-Plattform" (Practical Mr. Dominik Herrmann Introduction to the PrivacyScore Benchmarking Platform)

text: Annual Privacy Forum 2017

text: Annex B: Call for Papers Call for papers text In APF 2017 we invite papers presenting original work on the themes of data protection and privacy and their repercussions on technology business, government, law, society, policy and on law enforcement. An inter-disciplinary approach is high in demand to contribute to bridging the gap between research, business models and policy much like proposing new models and interpretations are. Research - Opinion Papers APF2017 seeks contributions from policy makers and implementers, Data Protection Authorities, industry, consultants, NGOs and civil society as well as law enforcement representatives. Opinion and interpretation papers are expected to reflect the views of the author(s). Submissions can be up to 8000 words long, excluding bibliography and appendices. Both research and opinion papers should deal with at least one of the following aspects:  Implementation aspects of "by design" and "by default" paradigms  Implementation and adoption of PETs in contemporary digital services  Modelling of data protection and privacy requirements, such as:  Machine readable representations and automatic evaluation of policies  Enabling transparency: technological and organizational challenges  Technical solutions for the enforcement and the implications of the subject’s right, e.g. right to erasure, access and correction.  Aspects of privacy impact and risk assessment  Technical solutions for data portability  Sustainable business models for privacy friendly online services  Information and consent in online environments: practical solutions and implementations  Privacy education, reliability and usability of PETs  Trust services for the protection of personal data - privacy aware trust services (i.e. electronic certificates, signatures, etc.)  Security measures for the protection of personal data  Economics of privacy and personal data  Legal, technical and organisational aspects of privacy and law enforcement  Ethical conditions to the applicable framework  Procedural issues  Issues of transatlantic interest Student Papers In order to encourage participation of young researchers, the submission of papers by students is encouraged. These papers will be treated as thoroughly as full papers, but can be shorter (up to 4000 words) and reflect novel thinking that might not have been fully elaborated just yet. Short Papers Annual Privacy Forum 2017

text: In addition to student papers, short papers are invited as this call is open to anyone who has a sketch of an idea, opinion or a call for collaboration. Short papers should be up to 4000 words and should not overlap with work published elsewhere. Review and Publication All submissions will be thoroughly reviewed by our PC members. We aim at minimal 3 average 4 reviews per Paper. Authors must submit their papers according to conditions and within the deadline communicated on the conference web site. Conference Chairs and Springer Publishers are currently negotiating the conditions for acceptance in Lecture Notes in Computer Science. Pre-proceedings will be published by the Austrian Computing Society and made available at the conference. Submissions of original work are invited; papers must not overlap substantially with work already published or simultaneously submitted to a journal or a proceedings bearing venue. Submissions can be up to 8000 words long, excluding bibliography and appendices. Shorter submissions are encouraged, as described elsewhere. Submissions must be drafted in English and they currently need to comply with the Springer LNCS style guide, which can be found at:  http://www.springer.com/computer/lncs?SGWID=0-164-6-793341-0  http://static.springer.com/sgw/documents/1121537/application/pdf/Springer_CS_Proceedings_Autho r_Guidelines_Jan_2013.pdf Programme Committee General Co chairs Prof. Dr. Erich Schweighofer, University of Vienna Prof. Dr. Kai Rannenberg, Goethe University Frankfurt Mr. Herbert Leitold, A-SIT Dr. Andreas Mitrakas, ENISA Program Committee Luis Antunes University of Porto Paul de Hert VUB Bojana Belamy Centre for Information Policy Roberto Di Pietro Bell Labs Leadership Josep Domingo‐Ferrer Universitat Rovira i Bettina Berendt KU Leuven Virgili Athena Bourka ENISA Prokopios Drogkaris ENISA Pompeu Casanovas UAB Hannes Federrath University of Hamburg Valentina Casola UNINA Mathias Fischer University of Muenster George Christou University of Warwick Lorena González Manzano Universidad Carlos Fanny Coudert KU Leuven III de Madrid Malcolm Crompton IIS Graham Greenleaf University of Sydney José María De Fuentes Universidad Carlos III Dominik Herrmann University of Siegen de Madrid Marko Hölbl University of Maribor Annual Privacy Forum 2017

text: Walter Hötzendorfer Research Institute, Heiko Roßnagel Fraunhofer IAO Vienna Kazue Sako NEC Sokratis Katsikas NTNU Peter Schartner Alpen‐Adria‐Universität Stefan Katzenbeisser TU Darmstadt Ingrid Schaumueller‐Bichl University of Dogan Kesdogan University of Regensburg Applied Sciences Upper Austria Peter Kieseberg SBA Research Stefan Schiffner ENISA Els Kindt KU Leuven Jetzabel Serna University of Frankfurt Sabrina Kirrane WU Wien Florian Skopik AIT Dariusz Kloza VUB Christoph Sorge University of Saarland Stefan Köpsell TU Dresden Morton Swimmer Trend Micro Chris Kuner VUB Christof Tschohl Research Institute, Vienna Gwendal Le Grand CNIL Patrick van Ecke University of Antwerp / DLA Daniel Le Métayer INRIA Jozef Vyskoc VaF Fabio Martinelli IIT‐CNR Edgar Weippl SBA Research Vashek Matyas Masaryk University Stefan Weiss Swiss Re Chris Mitchell Royal Holloway University of Diane Whitehouse IFIP working group 9.2 on London social accountability and ICT Gregory Neven IBM Research Bernhard C. Witt it.sec GmbH & Co. KG Sebastian Pape Goethe University Frankfurt Sven Wohlgemuth Independent Consultant Peter Parycek Danube University Krems Georgios Yannopoulos Law School of the Aljosa Pasic Atos Origin National and Kapodistrian University of Hans‐Jürgen Pollirer Secure Data Athens and Director of the Legal Informatics Joachim Posegga University of Passau Workshop. Charles Raab University of Edinburgh Harald Zwingelberg ULD Schleswig‐Holstein Vincent Rijmen KU Leuven

text: ENISA

text: Athens Office

text: 1 Vasilissis Sofias Marousi 151 24, Attiki, Greece PO Box 1309, 710 01 Heraklion, Greece Tel: +30 28 14 40 9710 info@enisa.europa.eu www.enisa.europa.eu


text: www.enisa.europa.eu European Union Agency For Network And Information Security

text: Annual Report Telecom Security Incidents 2017 August 2018

text: http://europa.eu/rapid/press-release_IP-18-4070_en.htm http://www.consilium.europa.eu/en/policies/electronic-communications-code/

text: See https://www.enisa.europa.eu/publications/impact-evaluation-article13a 4 See https://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidents-reporting/power-supply-dependencies/ 5 See http://www.enisa.europa.eu/media/press-releases/using-national-roaming-to-mitigate-mobile-network-outages201d-new-report-byeu-cyber-security-agency-enisa

text: See https://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidents-reporting/requirements-ecomms-vendors See https://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidents-reporting/protection-of-underground-infrastructure 8 See https://www.enisa.europa.eu/publications/security-measures See https://www.enisa.europa.eu/news/enisa-news/legacy-technologies-as-a-threat-to-eu2019s-telecommunicationsinfrastructure

text: Error! Bookmark not defined. The reform of the EU regulatory framework for electronic communications , which was adopted Error! Bookmark not in 2009 and transposed by most EU countries in 2011, added

text: Article 13

text: a to the Framework Directive defined. 11 .

text: Article 13

text: a addresses the security and integrity of public electronic communications networks and services. The legislation concerns National Regulatory Authorities (NRAs) and providers of public electronic communications networks and services (providers).

text: Article 13

text: a states that:  Providers of public electronic communications networks and services should take measures to guarantee security and integrity of their networks.  Providers must notify competent national authorities about breaches of security or loss of integrity that have had significant impact on the operation of networks or services.  National Regulatory Authorities should notify ENISA and national authorities abroad when necessary, for example in case of incidents with cross-border impact.  Annually, National Regulatory Authorities should submit a summary report to ENISA and the European Commission about the incidents.

text: EC Incident notification Annual reporting ENISA

text: Member state Member state

text: National National authority authority

text: Network or Network or Network or Network or Network or Network or service service service service service service provider provider provider provider provider provider

text: Figure 1: Incident reporting in

text: Article 13

text: a In late 2015 the European Commission started the process of revising the regulatory framework on electronic communications in order to “assess the current rules and to seek views on possible adaptations to the framework in light of market and technological developments, with the objective of contributing to the Digital Single Market Strategy” . A public consultation concerning the evaluation and review of the current regulatory framework ended in December 2015. In this context, ENISA along with the

text: Article 13

text: a Expert Group submitted an opinion on the evaluation and review of

text: Article 13

text: a and 13b of the Framework Directive, an area which is at the core of ENISA expertise and competence.

text: Here integrity means network integrity, which is often called availability or continuity in information security literature. https://ec.europa.eu/digital-single-market/en/news/public-consultation-evaluation-and-review-regulatory-frameworkelectronic-communications

text: See https://resilience.enisa.europa.eu/article-13/guideline-for-incident-reporting See https://resilience.enisa.europa.eu/article-13/guideline-for-minimum-security-measures See https://resilience.enisa.europa.eu/article-13/guideline_on_threats_and_assets

text: Table 1: Threshold for annual summary reporting based on a combination of duration and the percentage of the national user base Absolute thresholds Complementing the relative threshold, there is an absolute threshold: Incidents should be included in annual summary reporting if the product of duration and number of user connections affected exceeds 60 million user minutes, or 1 million user hours.

text: Figure 3: Countries involved in the annual summary reporting in 2017.

text: Figure 4: Impact on classic services (percentage)

text: Figure 5: Impact on other services (percentage)

text: Figure 6: Average number of user connections affected per incident per classic service (1000s).

text: Figure 7: Average number of user connections affected (1000s) - other services

text: Figure 8: Percentage of national user base affected on average per incident per service.

text: Figure 9: Impact on emergency calls.

text: Figure 10: Impact on interconnections (percentage)

text: Annual Report Telecom Security Incidents 2017

text: August 2018

text: Figure 11: Incidents per root cause category (percentage).

text: Figure 12: Third party failures and non-third party failures of all incidents (percentages).

text: Figure 13: Root cause categories for fixed telephony (percentage).

text: Figure 14: Root cause categories for fixed Internet (percentage).

text: August 2018

text: Figure 15: Root cause categories for mobile telephony (percentage).

text: Figure 16: Root cause categories for mobile Internet (percentage).

text: Figure 17: Root cause categories for other services (percentage).

text: Figure 18: Average number of user connections affected per incident per root cause (1000s)

text: Figure 19: Average duration of incidents per root cause category (hours).

text: August 2018

text: Figure 20: User hours lost per root cause category (hours).

text: Figure 21: Detailed causes of reported incidents (percentage)

text: Figure 22: Detailed causes for fixed telephony (percentage).

text: Figure 23: Detailed causes for fixed Internet (percentage).

text: August 2018

text: Figure 24: Detailed causes for mobile telephony (percentage).

text: Figure 25: Detailed causes for mobile Internet (percentage).

text: August 2018

text: Figure 26: Detailed causes for other services (percentage).

text: Figure 27: Average number of user connections affected per detailed cause (hours).

text: August 2018

text: Figure 28: Average duration of incidents per detailed cause category (hours).

text: Figure 29: User hours lost per detailed cause (hours).

text: Figure 30: Assets affected by the incidents (percentage).

text: Figure 31: Assets affected by system failures (percentages).

identifier: Annual report Telecom security incidents 2017

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: Annual report Telecom security incidents 2017

serie: rapporter

text: Annual Report Telecom Security Incidents 2017 AUGUST 2018

type: rubrik

text: About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

type: stycke

text: Contact

text: For contacting the authors, please use resilience@enisa.europa.eu. For media enquires about this paper, please use press@enisa.europa.eu.

text: Acknowledgements

text: For the completion of this report, ENISA has worked closely with a group of experts from National Regulatory Authorities and ministries from the EU and EFTA countries. Listing the organizations (in no particular order): PTS (SE), FICORA (FI), Ofcom (UK), ANACOM (PT), ComReg (IE), EETT (GR), ADAE (GR), Centre for Cyber Security - CFCS (DK), RTR (AT), ANCOM (RO), CRC (BG), Ministry of Economics, Finance and Industry (FR), Bundes-netzagentur (DE), BIPT (BE), Agentschap Telecom (NL), MINETUR (ES), MPO (CZ), CTO (CZ), CERT LT (LT), Teleoff (SK), ILR (LU), PECSRS (SI), MCA (MT), Ministry of Economic Development (IT), OCECPR (CY), Nkom (NO), RIA (EE), NMHH (HU), ITSIRI (LV), OEC (PL), AKOS (SI), OFCOM (CH), and HAKOM (HR).

text: Legal notice Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Copyright Notice © European Union Agency for Network and Information Security (ENISA), 2018 provided the source is acknowledged.

text: ISBN: 978-92-9204-257-8, DOI: 10.2824/017314

text: Table of Contents

text: Executive Summary 4

text: 1. Introduction 8

text: Article 13

text: a of the Framework Directive: ‘Security and Integrity’ 9

text: Article 13

text: a Expert Group and Annual Incident Reporting Procedure 10

text: 4. Analysis of the incidents 13 Impact of the incidents 14 Root cause categories 17 Detailed causes 23 Assets affected 28

text: 5. Conclusions 29 References 30

text: Executive Summary

text: Electronic communication providers in the EU have to notify significant security incidents to the national telecom regulatory authorities (NRAs) in each EU member state. Every year the NRAs report summaries about a selection of these notified incidents, the most significant incidents, based on a set of agreed thresholds. This document, the Annual Report on Telecom Security Incidents 2017, aggregates the incident reported in 2017, and provides a single EU-wide overview of telecom security incidents in the EU. Mandatory breach reporting has been part of the EU’s telecom regulatory framework since the 2009 reform of the telecom package:

text: Article 13

text: a of the Framework directive (

text: ) came into force in 2011. The breach reporting in

text: Article 13

text: a focuses on security incidents causing significant outages. The Commission recently proposed an update of the telecom rules. The new breach reporting requirements in Article 40 of the Electronic 1 2 Communications Code have a broader scope, including not only incidents causing outages, but also confidentiality breaches. Security breach reporting is also mandatory for trust service providers in the EU (under Article 19 of the EIDAS regulation), for Operators of Essential Services in the EU (under Article 14 of the NIS directive) and for Digital Service Providers (under Article 16 of the NIS directive) in the EU. Key statistics from the 2017 reporting This year’s annual incident report covers 169 incidents, reported by the NRAs across the EU. The reports come from the 28 EU countries and additionally 2 EFTA countries participated. 6 EU countries reported no incidents with significant impact, submitting so-called empty reports. We highlight some of the statistics:  Most incidents have an impact on mobile telephony and internet: In 2017 most incidents affected mobile telephony (51% of all reported incidents). Mobile internet and mobile telephony were the predominant affected services in the previous years also, except for 2014 when fixed telephony was the most affected.  Incidents with mobile telephony and mobile internet impact, on average, most users: Incidents affecting mobile internet or mobile telephony affected most users, on average around half a million users per reported incident, around 8% of the national user base. Over the past years we observe is a downward trend, meaning that the average size of reported incidents is decreasing. This could be due to the fact that many EU countries are adopting lower reporting thresholds.  System failures are the dominant root cause of reported incidents: Most incidents reported were caused by system failures (62% of the incidents) as a root cause. Often these are hardware failures or software bugs.

text:  Human errors affect (on average) a high number of user connections: In 2017 human errors was the root cause category involving most users affected per incident (around 1.2 million user connections on average).

text:  Incidents caused by malicious actions are rare: Only a small percentage of reported incidents (2.5% in 2017) was categorized as caused by malicious actions. This percentage reduced by half compared to the previous year (5.1% in 2016).  System failures are the dominant root cause: In 2017 most incidents were caused by system failures, i.e. more than 62 % had system failure as a root cause. This is in line with previous years (always between 60% and 80%). In the category system failures, software bugs and hardware failures were the most common causes. The assets failing in these cases are most often switches, routers, and power supplies.  Natural phenomena are causing more incidents: In 2017 a larger number of incidents (18%) were caused by natural phenomena, such as heavy snow/ice, storms and wild fires. This is significantly higher than 2016, 2015, and 2014 when natural phenomena accounted for around 5% of the incidents. Natural phenomena also cause the highest number of user hours lost, on average, per incident, with 56800 user hours. Natural phenomena will continue to be a concern for telecom providers across the EU, with extreme weather becoming more common due to climate change.  A fifth of the incidents are third party failures: Almost a fifth of the incidents (18%) are third party failures. This is similar to last year (22%). Third party failure incidents are interesting for NRAs to investigate further because often third-party failures involve other sectors, and are complex and costly to tackle for providers. Most of the incidents categorized as a third party failures are also categorized as caused by natural phenomena. A common incident scenario is when a natural disaster, like a storm or wildfire, disrupts the power grid infrastructure, which then impacts the mobile network infrastructure.  Mobile base stations and controllers the most affected assets: Overall, mobile base stations and controllers and mobile switches were the network components most affected by incidents (9% and 8% respectively).  Wild fires cause, on average, most impact in user hours: A good measure for the total impact is to multiply the number of users and the number of hours outage: this gives a total number of user hours. The diagram below shows the total number of user hours lost, per detailed cause, for the incidents reported in 2017.

text: Trends in 7 years of reporting Mandatory security incident reporting was introduced in the 2009 reform which came into force in 2011. ENISA has been collecting and aggregating incident reports since 2012. Looking back at the 7 years of annual incident reports, we can observe a number of multi-annual trends.  System failures dominate: Every year system failures are the most common root cause of reported incident, responsible for about 60-70% of the major outages.

text:  Natural phenomena trending upwards: There is an upward trend in the impact of natural phenomena on telecom services. Heavy storms, heavy floods, or wildfires cause by extreme drought, can severely impact the telecom infrastructure. Extreme weather is likely to increase due to climate change and this means that natural phenomena will continue to be a concern for the EU telecom sector.

text: Follow-up by NRAs and ENISA The NRAs are responsible for supervision the security telecom sector in each EU member state. ENISA supports the NRAs with common guidelines and collecting good practices. Incident reporting is a key pillar of this supervision.

text: Article 13

text: a and incident reporting are key in allowing the NRAs to understand trends and to work with the sector to address issues. This positive impact was confirmed also in an independent impact assessment analysing the impact of EU legislation on telecom security . As a follow up to the incident reporting, at the EU level, ENISA works with the NRAs and the private sector to analyse and address EU-wide issues and trends:  Power cuts are a common cause of outages. In 2013 ENISA analysed power supply dependencies , and issued recommendations regarding the sector’s ability to withstand and act efficiently after power cuts.  ENISA published an overview of good practices regarding to national roaming for increased resilience in mobile networks . A number of EU Member States have implemented such national roaming frameworks.

text:  Issues with ICT equipment were a major source of outages in 2012 and 2013. In 2014, ENISA published recommendations for providers about how to address security requirements when dealing with ICT equipment vendors and suppliers of outsourced services for core operations.  Cable cuts (due to civil works) were a prominent cause of incidents in the 2012 and 2013 annual incident reporting. In 2014, ENISA worked with NRAs to publish an overview of good practices and frameworks to reduce underground cable cuts .  In 2016, ENISA assessed, EU-wide, which security measures are implemented by telecom providers .  In 2018, ENISA published an EU state of play report on legacy protocols used for interconnections.

text: 1. Introduction

text: Electronic communication providers in the EU have to notify security incidents, with a significant impact on the continuity of electronic communication services, to the national telecom regulatory authorities (NRAs) in each EU member state. Every year the NRAs report a summary to ENISA, covering a selection of these incidents, i.e. the most significant incidents, based on a set of agreed EU-wide thresholds. This document, the Annual Security Incidents Report 2017, aggregates the incident reports reported in 2017, and gives a single EU-wide overview of telecom security incidents in the EU. th This is the 7 time ENISA publishes an annual incident report for the telecom sector. ENISA started publishing such annual reports in 2012. Mandatory breach reporting has been part of the EU’s telecom regulatory framework since the 2009 reform of the telecom package:

text: Article 13

text: a of the Framework directive (

text: Article 13

text: a focuses on security incidents causing significant outages. For example, consider an attack in which attackers wiretap undersea cables; if this attack causes no outages, then the security incident does not fall under the breach reporting requirements of

text: Article 13

text: a. The Commission recently proposed an update of the telecom rules. The new breach reporting requirements in (

text: Article 40

text: of) the Electronic Communications Code have a broader scope, including not only incidents causing outages, but also significant confidentiality breaches for example. Note that this document does not contain details about individual countries or individual incident reports and it does not contain any references to regions, countries or specific providers. This document is structured as follows: Section 2 and Section 3 briefly summarize

text: Article 13

text: a and the technical details of the implementation of the annual summary reporting, as agreed by the experts in the

text: Article 13

text: a Expert Group which involves different NRAs from different EU Member States and EFTA countries. Section 4 contains the statistical analysis of the incidents from 2017 and contains examples of incidents and Section 5 contains the conclusions.

text: Article 13

text: a of the Framework Directive: ‘Security and Integrity’

text: These incident reporting flows (incident notification and annual reporting) are shown in the diagram below. This document analyses the incidents from 2017 that have been reported to ENISA (the black dashed arrow).

text: Article 13

text: a Expert Group and Annual Incident Reporting Procedure

text: Article 13

text: a Expert group

text: In 2010, ENISA, Ministries and NRAs initiated a series of meetings (workshops, conference calls) to achieve a harmonised implementation of

text: Article 13

text: a of the Framework directive. In the following years, during these meetings, a group of experts from NRAs, now referred to as the

text: Article 13

text: a Expert Group, reached agreement on three nonbinding technical guidelines:

text:  Technical Guideline on Incident Reporting  Technical Guideline on Security Measures  Technical Guideline on Threats and Assets

text: The

text: Article 13

text: a Expert Group continues to meet 3 times per year to develop the technical guidelines and to discuss the implementation of

text: Article 13

text: a (for example, on how to supervise the electronic communications sector) and to share knowledge and exchange views about past incidents, and how to address them.

text: 3.1.2 Annual summary reporting by NRAs to ENISA

text: In spring 2012, the EC agreed with the EU Member States (in meetings of the Communications Committee, COCOM) to do the first round of annual summary reporting on the 2011 incidents impacting the continuity of supply of electronic communications services. The decision included a recommendation to use the reporting template agreed within the

text: Article 13

text: a Expert Group and published by ENISA. Following the COCOM meeting, ENISA implemented the technical procedure by deploying a basic electronic form based on the

text: Article 13

text: a Technical Guideline on Incident Reporting. There was also an agreement that in the coming years, annual reporting would be carried out by the end of February each year. In autumn 2012, ENISA developed an online incident reporting tool (called CIRAS), which replaced the electronic forms exchanged by email. CIRAS allows NRAs to exert greater control over the data reported and provides the NRAs with better access to data about incidents reported across the EU. Since 2015, ENISA is providing the possibility for the NRAs to extract graphs from CIRAS based on their search results. We briefly explain the main features of the incident reporting procedure, as described in the

text: Article 13

text: a Technical Guideline on Incident Reporting, which was developed in collaboration with the NRAs.

text: 3.1.3 Services and incidents in scope of reporting

text: There are four main services (aka classic services) in scope:  Fixed telephony  Mobile telephony  Fixed Internet access  Mobile Internet access Additionally NRAs can report about other services, such as SMS, MMS, Satellite TV, International roaming, RADIO broadcasting, TV broadcasting , Cable TV, IPTV, Video on demand, Public WIFI, Web based voice services, Webbased messaging services, and Public email services.

text: Providers are required to notify security incidents to NRAs, if there is a significant impact on the continuity of supply of electronic communications services. As mentioned, the mandatory reporting requirements in

text: Article 13

text: a focus on the continuity of the service.

text: 3.1.4 Thresholds for annual summary reporting

text: To facilitate an efficient and effective process of annual summary reporting from NRAs to ENISA, the NRAs agreed on a set of EU wide thresholds, based on the duration of an incident and the relative number of customers affected. Relative thresholds The relative threshold are based on the duration and the number of users of a service affected as a percentage of the national user base of the service. NRAs should include incidents in annual summary reporting, if the incident:  lasts more than an hour, and the percentage of users affected is higher than 15 %,  lasts more than 2 hours, and the percentage of users affected is higher than 10 %,  lasts more than 4 hours, and the percentage of users affected is higher than 5 %,  lasts more than 6 hours, and the percentage of users affected is higher than 2 %, or if it  lasts more than 8 hours, and the percentage of users affected is higher than 1 %. 1h 2h 4h 6h >8 <.. <.. <.. <.. h .< .< .< .< 2h 4h 6h 8h

text: 1%<...< 2% of user base

text: 2%<...< 5% of user base

text: 5%<...< 10% of user base

text: 10%<...< 15% of user base

text: > 15% of user base

text: 3.1.5 Annual summary reporting template

text: The annual summary reporting template for annual summary reporting contains fields for the services affected, the number of customers affected and the duration of the incident. The annual summary reporting template distinguishes 5 root cause categories:  Natural phenomena – This category includes incidents caused by severe weather, earthquakes, floods, pandemic diseases, wildfires, wildlife, and so on.  Human errors - This category includes incidents caused by errors committed by employees of the provider or outside the provider, during the operation of equipment or facilities, the use of tools, the execution of procedures, etc. E.g. an excavator cutting off a cable.  Malicious attacks - This category includes incidents caused by a deliberate act by someone or some organisation, e.g. a Denial of Service attack disrupting the service, or a cable theft.

text:  System failures – This category includes incidents caused by technical failures of a system, for example caused by hardware failures, software bugs or flaws in manuals, procedures or policies.  Third party failures – This category includes incidents caused by a failure or incident at a third party. The category is used in conjunction with one of the other four root cause categories. Optionally the template allows NRAs to indicate:  Detailed causes triggering the incident, either as “initial cause” or as “subsequent cause”, because incidents often involve a chain of events. For example, often a storm, leads to a power cut.  Assets affected by the incident, e.g. HLRs, routers and switches, underground cables etc. These assets are listed and described in the

text: Article 13

text: a Technical Guideline on Threats and Assets.

text: 4. Analysis of the incidents

text: In total, all 28 EU Member States and 2 EFTA countries participated in this process. Of these, 22 Member States and 2 EFTA countries reported in total 169 significant incidents and 6 countries reported there were no significant incidents. This is a small increase from the previous year where the same number of countries reported 158 significant incidents.

text: Examples of incidents We give some specific examples of incidents to give an idea of the kind of incidents that are notified to NRAs and then included in the annual summary reporting to ENISA:  A system failure caused a mobile internet outage for millions of users (duration: hours, connections: millions, cause: software bug): A software bug occurred in the Internal system component Software Deployment Manager (SDM) leading to the degradation of user authorization for mobile data and mobile voice. As a result end users had difficulties to access mobile services, both voice and data. Also customers abroad were affected (roaming services). Mobile switches and mobile user registers were affected by this bug. The provider removed the obstacles in accessing the services and for the prevention of similar incidents in the future, a mitigation plan was created in collaboration with software vendors.  System failure caused disruption in, both mobile and fixed, telephony and internet services as well SMS/ MMS services, affecting millions of users (duration: hours, connections: millions, cause: hardware failure): Outage of several network components used for delivering DSL in the subscriber access network resulted in the disruption of mobile and fixed telephony and internet access. The provider responded by raising the capacity of the remaining network components. A subsequent software upgrade resolved the issue completely.  An attempt at malware infection coming from a malicious action caused outage on fixed internet, fixed telephony, IPTV and DNS services for more than three days: (duration: days, connections: thousands, cause: Malicious action ): A worldwide attack of a botnet attempted to infect maintenance interfaces of customer premise equipments with malware. This attempt failed but the attack impacted a large number of fixed internet connections. The provider mitigated this attack by implementing filtering measures in order to prevent further attacks of this kind. Later the provider updated the firmware of the customer premises equipments (CPEs) and asked affected customers to disconnect their CPEs from the power supply, and switch them on again, in order to finalise the update.

text: The rest of this section contains statistical information. Note about statistical conclusions: Readers should be cautious when drawing conclusions from the statistics in this report. In particular, they should take into account that:  The scope of reporting major security incidents is restricted to incidents with an impact on the continuity of public electronic communication services and networks. There are many other types of incidents with an impact on security of services and networks, which are under the current telecom framework not in scope of annual reporting. For example, if attackers would wiretap undersea cables without causing any outages, then such a security incident would not be included in this process of annual reporting. The new breach reporting requirements in (

text: Article 40

text: of) the Electronic Communications Code have a broader scope, including not only incidents causing outages, but also confidentiality breaches for example. The scope of reporting includes major, or significant, incidents scoring above the agreed reporting thresholds (Table 1: Threshold for annual summary reporting based on a combination of duration and the percentage of the national user base  ). Smaller incidents are not reported at EU level, meaning that the view is skewed towards the larger incidents. Common incidents that get resolved quickly stay below the radar, so to speak.  National reporting thresholds are different across the EU. Every country has a different size. Thresholds have also been adapted over the years. Many countries started with relatively high thresholds, lowering them later on. For instance there is an increase in the number of reported incidents. This does not mean, for instance, that the telecom sector is getting less secure, or that the total number of incidents is increasing. In fact, over the years we have seen more incidents getting reported which are on average smaller in size.

text: Impact of the incidents

text: First, we look at which services are impacted by the reported incidents.

text: 4.1.1 Impact per service

text: For the third year in a row most of the reported incidents affected mobile internet. Both mobile internet and mobile telephony services had an increase on incidents compared to last year’s results.

text: Note that each incident can have an impact on more than one service (which is why the percentages in the chart add up to more than 100 %).

text: 4.1.2 Number of user connections affected

text: Mobile internet outages affect most user connections s, with an average of 600 thousand user connections affected per reported incident. Compared to the previous years this is a 50% decrease, which is significant.

text: Note that the averages in these diagrams include both small and large countries. These EU-wide averages, are not necessarily representative for the size of incidents occurring nationally.

text: 4.1.3 Percentage of the national user base affected

text: Mobile internet outages impact on average 8% of the national user base (a 14% decrease compared to 2016).

text: 4.1.4 Impact on emergency services

text: A third of the reported incidents had an impact on the reachability of emergency call-centres, i.e. 112.

text: 4.1.5 Impact on interconnections

text: In 7 % of incidents reported there was an impact on interconnections between providers. Compared to 2016 this figure is stable.

text: Root cause categories

text: In this section we look at the main root cause categories of reported incidents. For a description of the root cause categories, see section 3.1.5.

text: 4.2.1 Incidents per root cause category

text: This year, 62% of the reported incidents were caused by system failures or technical failures. For all reporting years, system failures has been the most common root cause category. In second place, for this year is root cause of human errors (18,3% of the reported incidents), a small increase compared with previous years. Natural phenomena as expected due to the wildfires consist of 17%.

text: 4.2.2 Third party failures

text: Around 18% of the incidents reported were categorized as third party failures, a slight decrease compared to the previous year (22.5%).

text: 4.2.3 Root cause categories per service

text: In this section, we look at the root causes for the services separately. As in 2016, also in 2017, system failures was the dominant root cause for all services, scoring more than half of the incidents reported per service. For mobile telephony and mobile internet, this was the case also in the previous years, whereas the dominant root cause for fixed telephony and fixed internet oscillated in the previous years between natural phenomena and system failures. Wildfires caused a significant increase in the number of incidents categorized under natural phenomena.

text: 4.2.3.1 Fixed Telephony 4.2.3.2 Fixed Internet 4.2.3.3 Mobile telephony 4.2.3.4 Mobile internet 4.2.3.5 Other services

text: System failures is also the main root cause for the other services besides the classic services, with a percentage of approximately 53%.

text: 4.2.4 Average number of user connections affected per root cause category

text: This year, human errors affected most user connections, on average about 1.2 million user connections per incident, which is a significant increase, compared to the previous year. A significant decrease was noted on malicious actions

text: 4.2.5 Average duration of incidents per root cause category

text: The reported incidents caused by natural phenomena had by far the longest recovery time on average per incident with a tremendous increase compared to last year. However, this extraordinary result is an exception due to the last year’s wildfires.

text: 4.2.6 User hours lost per root cause category

text: Natural phenomena also cause the highest number of user hours lost, on average, per incident, with 56800 user hours.

text: Detailed causes

text: Root cause categories are rather broad but give a good summary of the most common types of incidents. In this section we break down the root cause categories in a set of more detailed causes. An incident is often a chain of events and failures, involving multiple causes. For instance, an incident may be triggered by storm, heavy winds, which tear down power supply infrastructure, then cause a power cut, which in turn leads to an outage because base stations are without power. For this incident both heavy winds and power cuts are listed as detailed causes. In the annual summary reporting we keep track of these detailed causes.

text: 4.3.1 Detailed causes of all incidents

text: In 2017, the most common cause was hardware failure. This is part of a multi-year trend, because in previous years, hardware failure is always either the first or the second most common cause. Despite last year’s decrease, power cuts and cable cuts are again in the top four of most frequent causes. The cause “Other” saw an increase this year. A more in-depth analysis showed that these incidents are different types of system failures.

text: 4.3.2 Detailed causes per service

text: In this section, we show the detailed causes of incidents for each of the main four services (fixed telephony, fixed Internet, mobile telephony and mobile Internet) and for the other services. As in the previous year, also this year, Hardware failures were the most common causes for failures in all the main four services and for the other services as well.

text: 4.3.2.1 Fixed Telephony 4.3.2.2 Fixed Internet 4.3.2.3 Mobile Telephony 4.3.2.4 Mobile Internet 4.3.2.5 Other services

text: Half of the incidents (almost 50%) with an impact on other services (other than the four main services) were caused by power cuts (33%), hardware failures (21%) and software bugs (15%), see the graph below.

text: 4.3.2.6 Average number of user connections affected per detailed cause

text: On average software bugs cause incidents affecting most user connections.

text: 4.3.3 Average duration of incidents per detailed cause 4.3.4 User hours lost per detailed cause Assets affected

text: Also this year we received reports from NRAs about which components or assets of the electronic communications networks were affected by the incidents. This provides some more information about the nature of the outages and what assets of the infrastructure that were primarily involved in them.

text: 4.4.1 Assets affected overall

text: In 2017, mobile base stations and controllers, and switches and routers were the assets most affected by incidents.

text: 4.4.2 Affected assets in system failures

text: As for all previous reporting years, system failures (or technical failures), was the most common root cause category in 2017. In these system failures, the most common assets that failed were power supplies, switches and routers and other uncategorised assets. Also in the previous year mobile switches, and switches and routers were the most common assets to fail in this root cause category.

text: 5. Conclusions

text: In this report ENISA summarized and analysed the reports about 169 incidents which happened in 2017 affecting telecom networks and services in the EU. These reports were submitted by National Regulatory Authorities (NRAs) in 28 EU member states and 2 EFTA countries, as mandated by

text: Article 13

text: a of the Framework Directive Error! Bookmark not defined. (

text: ) . Looking at the 2017 incidents, and looking back at the previous years of incident reporting (2012-2016), we can draw the following conclusions:  Mobile telephony and internet remain the most affected services: In 2017 most incidents affected mobile telephony (51% of all reported incidents). Mobile internet and mobile telephony were the predominant affected services in the previous years also, except for 2014 when fixed telephony was the most affected.

text:  Incidents with mobile telephony and mobile internet impact, on average, most users: Incidents affecting mobile internet or mobile telephony affected most users, on average around half a million users per reported incident, around 8% of the national user base. Looking at the multiannual trend, there is a significant decrease compared to the data for 2016.  System failures are the dominant root cause: In 2017 most incidents were caused by system failures, i.e. more than 62 % had system failure as a root cause. This is in line with previous years (always between 60% and 80%). In the category system failures, software bugs and hardware failures were the most common causes. The assets failing in these cases are most often switches, routers, and power supplies.  Natural phenomena are causing more incidents: In 2017 a larger number of incidents (18%) were caused by natural phenomena, such as heavy snow/ice, storms and wild fires. This is significantly higher than 2016, 2015, and 2014 when natural phenomena accounted for around 5% of the incidents. Natural phenomena also cause the highest number of user hours lost, on average, per incident, with 56800 user hours. Natural phenomena will continue to be a concern for telecom providers across the EU, with extreme weather becoming more common due to climate change.  A fifth of the incidents are third party failures: Almost a fifth of the incidents (18%) are third party failures. This is similar to last year (22%). Third party failure incidents are interesting for NRAs to investigate further because often third-party failures involve other sectors, and are complex and costly to tackle for providers. Most of the incidents categorized as a third party failures are also categorized as caused by natural phenomena. A common incident scenario is when a natural disaster, like a storm or wildfire, disrupts the power grid infrastructure, which then impacts the mobile network infrastructure.

text: ENISA will continue to work closely with the

text: Article 13

text: a Expert Group and the telecom sector to discuss and analyse common security incidents and good practices to mitigate them. The ongoing update of the legal framework for electronic communications (the EECC) is an important step to help the NRAs in understanding the issues facing the sector. Telecom security remains a top-priority, because, although the sector is quite mature in terms of network and information security compared to other critical sectors, it is also increasingly critical. The EU’s digital economy relies on secure and resilient telecom networks and services. Improving resilience and security, while at the same time adopting new technology, phasing out the old technology, will be a key challenge in the future .

text: References

text: Related ENISA papers

text:  ENISA’s annual reports telecom security incidents in 2011, 2012, 2013, 2014, 2015, and 2016 can be found at: http://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidents-reporting/annual-reports  ENISA commissioned in an independent impact assessment about

text: Article 13

text: a “Impact evaluation on the implementation of

text: Article 13

text: a incident reporting scheme within EU”: https://www.enisa.europa.eu/publications/impact-evaluation-article13a  The

text: Article 13

text: a Expert Group technical guidelines on incident reporting, security measures, and threats and assets respectively: https://resilience.enisa.europa.eu/article-13  ENISA’s study 2013 on Power Supply Dependencies in the Electronic Communications Sector: http://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidents-reporting/power-supplydependencies  ENISA’s study 2013 on National Roaming for Resilience: http://www.enisa.europa.eu/activities/Resilienceand-CIIP/Incidents-reporting/national-roaming-for-resilience  ENISA’s study and guide 2014 to Electronic Communications Providers when procuring ICT products and outsourced services for core operations: https://www.enisa.europa.eu/activities/Resilience-and- CIIP/Incidents-reporting/requirements-ecomms-vendors  ENISA’s study 2014 on information sharing systems for announcing civil works in order to protect underground communications infrastructure from cable cuts: https://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidents-reporting/protection-ofunderground-infrastructure  ENISA’s whitepaper from 2012 on cyber incident reporting in the EU shows

text: Article 13

text: a and how it compares to some other security articles mandating incident reporting and security measures: http://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidents-reporting/cyber-incident-reportingin-the-eu  For the interested reader, ENISA’s 2009 paper on incident reporting shows an overview of the situation in the EU 6 years ago: http://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidents-reporting/goodpractice-guide-on-incident-reporting/good-practice-guide-on-incident-reporting-1

text: EU legislation

text: Article 13

text: a of the Framework directive of the EU regulatory framework for electronic communications: http://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX:32009L0140  The full EU regulatory framework for electronic communications (incorporating the Framework Directive including

text: Article 13

text: a) right after the 2009 reform: https://ec.europa.eu/digital-agenda/sites/digitalagenda/files/Copy%20of%20Regulatory%20Framework%20for%20Electonic%20Communications%202013 %20NO%20CROPS.pdf  The NIS directive, that also contains incident notification provisions for operators of essential services (OESs) and digital service providers (DSPs): http://eur-lex.europa.eu/legalcontent/EN/TXT/?uri=uriserv:OJ.L_.2016.194.01.0001.01.ENG&toc=OJ:L:2016:194:TOC

text: ENISA

text: European Union Agency for Network and Information Security 1 Vasilissis Sofias Marousi 151 24, Attiki, Greece

text: Heraklion Office

text: Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

text: Catalogue Number: TP-AD-18-001-EN-N

text: 1 Vasilissis Sofias Str, Maroussi 151 24, Attiki, ISBN: 978-92-9204-257-8 Greece Tel: +30 28 14 40 9710 DOI: 10.2824/017314 info@enisa.europa.eu www.enisa.europa.eu