Osnova strategie kybernetické bezpečnosti České republiky

INTERNATIONAL COOPERATION

As in previous years, in 2014 NSA continued to carry out bilateral and multilateral international cooperation.

1. European Union

Even in 2014, NSA’s main topic at the European level was information and network safety. The Directive on network and information security⁴ (hereinafter „NIS Directive“) was introduced by the European Commission on 7 February 2013 in connection with the joint communication of the European Commission and the High Representative of the Union for Foreign Affairs and Security Policy on the EU’s Cyber Security Strategy.

From the very beginning, NSA has proactively participated in the negotiations taking place in the Working Group on Telecommunications and the Information Society of the Council. The directive was intensely debated in 2014; a consensus, however, has not been reached, and further negotiations will therefore take place in 2015. For this purpose, from midOctober 2014 a socalled informal trilogue with the European Parliament was set up, with its main goal to unite the opinions of European Parliament and the Council.⁵ NSA’s aim is to promote the position of the Czech Republic which consists mainly of focusing on CII protection and preventing a significant expansion of the Directive’s impact on private entities.

In order to prepare instructions for the above-mentioned working group negotiations, NSA has established a departmental coordination group at the end of 2013 to facilitate cooperation with other relevant bodies. This departmental coordination group has actively engaged in discussing the NIS directive, as well as other documents and regulations. The group contributed to the opening of communication channels between NSA and other governmental bodies.

2. European Network and Information Security Agency (ENISA)

The European Agency for Network and Information Security (hereinafter "ENISA") is tasked with providing advice to the European Commission and the EU Member States on development and implementation of cyber security related policies, coordination of measures to secure their networks and information systems, building of CERT capabilities in the individual Member States through organization of courses and training events, and to run a world-wide database on national cyber security strategies. Finally, ENISA organizes one of the largest pan-European cyber security exercises Cyber Europe.⁶

The Czech Republic participates in ENISA’s formal and informal meetings. Two NSA representatives are members of the Board of Directors⁷ where they are responsible for approval of the work plan and budget. In autumn 2014, an NCSC employee was invited to become member of a small ENISA working group created to promulgate the crafting and implementation of national cyber security strategies. He will along with other experts take part in consultations and preparation of methodical and support materials for development of strategic cyber security documents.

The Czech Republic actively cooperates with and benefits from ENISA’s support to build its cyber security capabilities. Besides participation in the above mentioned Cyber Europe exercise, representatives of the Czech GovCERT.CZ along with representatives of the Police of the Czech Republic („Police“) attended an ENISA course held at NCSC headquarters, concerning CII and handling cyber security incidents targeting mobile devices.

3. North Atlantic Treaty Organization (NATO)

On 14 March 2012, NSA director and NATO representatives signed a Memorandum of Understanding concerning cyber defence. Given the changing security paradigm, work has begun on a harmonized version of the Memorandum that specifies the conditions of cooperation within the allied cyber defence framework.

4. Organization for Security and Co-operation in Europe (OBSE)

Cyber security topics are also discussed within the Organization for Security and Cooperation in Europe (hereinafter „OSCE“). Specifically, the OSCE Participating States decided to strengthen the effort in dealing with security and use of information and communication technologies through the Decision of the Permanent Council no. 1039 of 26 April 2012, in line with all OSCE commitments and in cooperation with relevant international organizations. The first set of so-called Confidence Building measures (hereinafter „CBMs“) was thus developed to build trust in cyber-space with the aim of strengthening international cooperation, transparency, predictability and stability as well as limiting the risks of misunderstanding, escalation and creation of conflict that could stem from the use of information and communication technologies.

The Czech Republic supports development of cyber CBMs as a prerequisite for formalization of relations between states, mostly through active implementation of the first set of cyber CBMs and through active participation in discussion about the second set of such measures. Taking into account the cooperative nature of the second CMBs set, the Czech Republic prefers a solution built on voluntary basis, mutual trust and cooperation between states.

The Czech Republic was among the first OSCE Participating States to share relevant information pursuant to respective cyber CBMs through the regularly updated POLIS OSCE system. An NSA representative (so-called capital-level expert) held a presentation at two of the three meetings of the Informal Working group 1039 on implementation of the cyber CBMs. He presented both the current state of implementation of the cyber CBMs in the Czech Republic and the state of cyber security in general along with documents related to the strategic, legislative and organizational framework of cyber security.

5. Central European Cyber Security Platform (CECSP)

Czech Republic has achieved a major success in the field of increasing security and resiliency of CII through cooperation of regional CERTs when the Central European Cyber Security Platform, or CECSP, was founded in May 2013 out of Czech and Austrian initiative.

In April 2014, under the Austrian presidency, third strategic-level meeting took place to assess the progress in cooperation in the cyber security area. The priority of this meeting was adoption of the CECSP Working Plan for next three years and agreement on rules and principles of cooperation within the platform. In December 2014, a technical-level meeting took place and the presidency was handed over to Hungary. At that last meeting, a shared mailing list⁸ was established, a shared-access documents directory set up and work began on a „CECSP contact list“. The partners confirmed the intention to seek common positions on cyber issues and discussed the results and benefits of their first joint cyber exercise that took place in June 2014 under the Hungarian presidency. Last but not least, the type and date of the next CECSP exercise⁹ were discussed.

6.