Draft:European Union's Critical Maritime Infrastructure Protection

Critical maritime infrastructures refer to the essential components of the maritime sector that play a vital role in global trade, transportation, and security, making them potential targets for malicious activities..

The sabotage of the Nord Stream 2 pipelines in 2022 has shed light on the vulnerability of European critical maritime infrastructures to disruption, fostering broader concerns regarding the European Union's maritime security strategy. In this respect, the incident underscores the potential for malicious intents that can considerably undermine the EU's energy security through targeted attacks on critical maritime infrastructures. Despite increased efforts in recent years dedicated to securing these infrastructures, the Union nevertheless encounters difficulties that undermine its overall resilience in this domain. In the EU context, critical maritime infrastructures are generally merged with broader frameworks on critical infrastructures as a whole and the elaboration of according frameworks has developed at a slow pace in the last decades.

Historical and contextual evolution

For the past 20 years, the EU has broadened its scope to prioritize the security and safety of its citizens. Following the Madrid train bombing in 2004, the EU rethought about the protection of its critical infrastructures with a strong emphasis on counter-terrorism measures. As a result, in the Directive 2008/114/EC of 8 December 2008, the European Council defined European Critical Infrastructures as:

“[A]sset[s], system[s] or part thereof located in Member States which is essential for the maintenance of vital societal functions, health, safety, security, economic or social well-being of people, and the disruption or destruction of which would have a significant impact in a Member State as a result of the failure to maintain those functions".

Stretching from food safety regulations to counter-terrorism measures, this framework was rather an all-hazard approach. When it comes to maritime security more specifically, the European executive has progressively identified 4 distinctive yet intrinsic elements within the broader European Union Maritime Security Strategy framework:

1. Production of energy;
2. Energy transportation;
3. Ports protection;
4. Communication facilities.

Tracing the evolution of what the EU refers to as European critical infrastructures, the document emphasized the energy sector and transports, thereby excluding communications facilities. Due to their invisibility, they have gained importance only in the recent years, ultimately topping the EU’s security priorities following the sabotage of Nord Stream pipelines in 2022. Additionally, more recent academic literature tends to support this conceptual approach centered around these 4 elements of critical maritime infrastructures.

Conceptualization of European Critical Infrastructure Protection

The European Commission acknowledges a wide range of threats which Critical Infrastructures are particularly subject to – “both natural and man-made, unintentional and with malicious intent”. Some academic literature shows that the European Union used to prioritize robustness through a careful analysis and endorsement of “if” scenarios (echoing to the precautionary principle), neglecting resilience. In recent years however, the EU has shifted in this sense by gradually putting greater emphasis on adaptability and recovery in addressing disruptions to critical infrastructures. Academic literature also points out the fact that catastrophes are inevitable. This issue appears of particular relevance in the context of interdependence. Indeed, optimistic narratives may argue that the integration of vital infrastructures in Europe, accelerated by the push for a unified market, has fostered a remarkable prosperity throughout the European continent. However, this very interdependence amplifies the risk of transnational crises in the event of infrastructure failures. Accordingly, both scholars and stakeholders acknowledge the growing susceptibility of large-scale systems to catastrophic disruptions. From an organizational perspective, the Green Paper on a European program for critical infrastructure protection issued in 2005 may raise concerns with regards to the endorsement of the principle of subsidiarity. Indeed, under a common framework, Member States nevertheless retain responsibility for national Critical Infrastructure Protection.

Submarine communications cables

Undersea cables are the essential infrastructures of the digital era, spanning 750,000 miles to support global digital communication needs. Despite their critical role in facilitating up to 99% of transoceanic digital communication, including financial transactions and internet traffic, they remain relatively unknown to the public and policymakers. In this respect, the EU now recognizes the importance of securing communication channels, including submarine cables, in the face of growing cyberattacks. As such, the maritime sector has become a particularly vulnerable target of cyberattacks considering the potentially immense impact on the market in case of infrastructure failures . In light of raised concerns regarding potential disruptions to submarine cables, particularly due to the recent geopolitical tensions such as Russia's actions in Ukraine, the European Union has shown particular urge to strengthen the security and resilience of submarine cable infrastructures through increased public funding and coordinated efforts. Various European bodies, including the Council and the Commission, have initiated measures to assess risks, enhance preparedness, and foster international cooperation in safeguarding critical infrastructure. However, challenges remain, including the need for a comprehensive EU-wide assessment of risks, improved governance of cable technologies, and secure repair and maintenance protocols.

Ports protection and public-private partnerships

In the past decades, the importance of port infrastructures has been on the raise, for they foster states’ economic development through reduced shipping time and costs, as well as improved access to domestic and foreign markets. With increasing global trade volumes and the emergence of transnational players in the shipping market, there has been a growing demand for adequate hinterland and port infrastructure, leading to numerous large-scale port projects worldwide. As projects require significant capital expenditures, public sector actors seek private funding for implementation and service provision. Notably, states have progressively delegated authority over ports protection in the light of increased privatization of critical infrastructures. As such, critical infrastructure protection measures encounter considerable hurdles, especially with regard to the control of governments over privately owned critical infrastructures. In this respect, there are discussions on whether relying on private actors or increasing regulation to ensure the resilience of critical infrastructures in the European context. On the one hand, as privatization remains on the rise, collaboration between the public sector and the private entities involved appears necessary. At the other end of the spectrum, challenges considerably undermine coordination and critical infrastructure protection more broadly. Notably, enforcement issues and divergence of interests stand on top of the list and may only be overcome by achieving a fair degree of mutual trust and reciprocal transparency and accountability

Recommendations

1. Detaching Critical Maritime Infrastructure Protection from the broader Critical Infrastructure Protection domain because it has its specific issues, so to identify them better, elaborate clearer policy recommendations, and establish stronger measures.
2. Due to interdependence, the EU should endorse an alternate strategy to the subsidiary principle which does not appear up to the task; on the contrary, it undermines Member States' collaboration and crisis responsiveness.
3. In light of rapidly emerging geopolitical tensions and threat landscapes, continuous monitoring of critical maritime infrastructures is required. Such a strategy may solve the issue of attribution to a certain extent in case of intentional accidents.
4. More research should be made on to what extent EU’s energy external dependency may impact on the level of vulnerability of its critical maritime infrastructures.