Committee on Transport and Tourism Ordinary meeting Public hearing on Sovereignty of EU transport infrastructure, assets, and technologies
Legend
Transcript markers
- text Sentence being played
- text Search result
- text Intervention cited by the link you opened
Click a sentence to play the video from that moment. Select text to quote it with the speaker, timestamp and link.
More options
TRAN European Parliament
Follow its sittingsSpeaker 3
Now when we look at the transport sector, it's not monolithic, and I'm not going to, you know, you know that better than I do. There are subsectors. And when we look at the criticality and maturity of these subsectors, they are in different places. Now this is a slide that highlights where the different subsectors in transport are placed, as we see that, so the cybersecurity authority in Europe. The lower axis, the horizontal axis, represents maturity, and the vertical axis represents criticality.
Maturity changes slowly over time, and we are there to help the entities in the sectors to, of course, increase their maturity. But the majority depends on a number of issues. How efficient they are in applying the policy framework, how good and capable are the national and European regulators, and how good and capable are, of course, the entities themselves in the subsector. Criticality might change over time, depending on the context. You may have seen that in the course of the Russian war of aggression towards Ukraine that, for example, the rail sector, the credit quality of the rail sector has increased due to this.
Why is this slide important for us? It's because it shows which are the subsectors, and specifically in transport, which are in the risk zone. And when we say risk zone, that means their criticality is higher than their maturity. So there is something that they need to do about it. And we see that there are two subsectors, which from our analysis are in the risk zone.
It's maritime and rail at this particular moment in time. Maritime because of gaps in governance, in cyber expertise, access management, and vulnerability management. And rail because of really cybersecurity assessments, incident response, business continuity, disaster recovery testing are rarely applied or inconsistently applied across the sector entities. One of the big issues across all sub sectors, but definitely in transport where it's quite operational technology heavy, is vulnerability management. And vulnerabilities are essentially weaknesses in systems which have digital components.
They can be software weaknesses. They can be hardware weaknesses. And if the weakness is found, that's what the threat actors normally exploit. And when we look at technology and the resilience of technology, that is one of the biggest problems, systematic problems that the technology that is used is riddled with vulnerabilities. And in the transport sector, oftentimes, in order to patch a vulnerable technology or a product, it takes time.
And oftentimes, the entities in the sector actually need to take this product or technology offline in order to do that. So that complicates matter even more. And the vulnerability patching in the transport sector takes a lot of time. So 62% of entities in the transport sector take more than three months to patch vulnerabilities. Now if I would ask you how long it will take for a threat actor to exploit a vulnerability, it is not in months.
It's in days. The current average is 1 to 2 days. So here is the first big threat and first big risk, actually. It is very difficult for entities in the transport sector to patch vulnerabilities. And vulnerability management is one of the big challenges facing the sector.
Next slide, please. When we look at the threat landscape, transport is the fifth most targeted sector across all the different sectors that are covered under the NIS two directive. The most targeted is the air. You see that also in the red column. So almost half of the cyber incidents that we have observed have targeted the air sector.
When we look at who are the threat actors, and of course, quite a lot of this is hacktivist campaigns. Hacktivism is a politically motivated cyber threat group who operates on the basis of their ideological reasons. And their modus operandi, the method that they employ the most is the distributed denial of service attacks. It is of low impact, but it creates a lot of noise. And it is something that constantly needs, you know, you need to deal with.
You need to have the capacities there to make sure that it doesn't have an impact, etc. So it's annoying, but it doesn't really impact your business oftentimes. The other two, which are rather worrisome, are, of course, ransomware actors and state nexus groups who pose an operational challenge, but also pose strategic risks to transport sector operators. Especially when we look at state nexus groups, we see that they position themselves oftentimes in critical areas to steal technology, to steal intellectual property, but also to be there in order to use their prepositioning to disrupt services if necessary for their political aims. So worrisome from the cybersecurity perspective, of course, is that the lines between these different threat groups are blurring.
We see more and more cooperation between ransomware gangs and state nexus operators. They cooperate and collaborate, exchange technologies, methods, and procedures. And this is, of course, problematic because the most capable ones are normally the state nexus operators. And if there is a technology transfer from them to the Randsommer gangs, the Randsommer gangs will become more efficient in doing what they do. So that's something that one definitely needs to keep in mind.
Next slide, please. My question is what have the public authorities at the European level done in order to counter these threats? The first issue for INSA is always that we never operate alone. We operate in concert, in coordination with the authorities of the sectors and subsectors. We have a very strong collaboration with the EU agencies of the sector, European Railway Agency, EMSA and EASA, but also, of course, DG Move, the European Commission.
We also have strong collaboration with the sector entities themselves, and we are very happy about this, and that some of these representatives are today also in the panel. We help the sector by giving them specific guidance on how to implement the horizontal cybersecurity legislation in their sector specific context, but also help the sector by clarifying and helping them to understand better risks that the sector face. So we run a number of risk assessments at unit level, which are dedicated to the sector. Some of them are also explained in the slides to understand better the transport sector risk. And what are the transport sector risks?
Of course, I, you know, there are threat actors. But one of the big issues, of course, facing the transport sector is the transport sector is heavily dependent on non-EU vendors. So it's a supply chain risk, something that we must take increasingly seriously. And I think that would also be the very focus of the hearing today in this setting. Next slide, please.
More practically, my agency, Eneesa, also runs the European Cybersecurity Reserve, which means that when member states request assistance, Eneesa can help them together with private sector service providers, which are trusted, to respond to specific incidents and help entities in the transport sector to manage incidents or help them with the incident recovery or help them with raising their resilience. So in the past years, we have provided such services for more than 16 entities in the transport sector and more than 16 member states. We run trainings and exercises. And I'm also happy to report that this year in Cyber Europe, which is the largest cyber exercise in Europe, we dedicate that very much to the transport sector, rail sector in particular. Next slide, please.
What more can be done? I end my presentation where I started. The big issue in Europe, the systematic issue, is vulnerability management, helping the sectors to understand better vulnerabilities, helping to understand them, which are the critical ones, what is the best way of tackling these, what are the most trusted service providers and automated systems that one can apply in order to automate vulnerability management as far as possible. This is where Eneesa can help them. And I think that's where we are also looking at in our future challenges, when it comes to the new mandate of the agency.
That's it for me. Thank you very much, and happy to take any questions you have.
Speaker 1
Thank you very much, Mr. Le Passard, for your intervention. And respecting the time limit, much appreciated. So we can jump to our second speaker on the first panel. It's Mr. Van Der Putten.
You have the floor for 15 minutes.
Speaker 7
Thank you for this opportunity to be here and to speak. I am here as a researcher, and I'm here to speak in particular about China and European seaports because, as a researcher, my work is on China. I'm a China specialist, and I have been doing research specifically on Chinese influence in European seaports over the past years, together with colleagues from Klingen Dahl Institute in The Hague and Erasmus University in Rotterdam. And I would like to highlight a few things for the discussion. First of all, the risks that potentially come from Chinese involvement in European seaports.
Speaker 6
And then second, what is being done about these risks? And third, is there any room left for further steps? So, first about the risks. And if I look at China as the involvement of China in European seaports, you can think basically of three categories of involvement. Chinese companies can be users of the European ports.
Chinese companies can be investors and therefore owners of parts of European ports. And Chinese companies can be suppliers of equipment that is used in the ports. So if we look at how this, not so much the involvement of China, but the way that we in Europe look at Chinese involvement in European seaports, how it has evolved over the past 20 years or so, I think you could say that until around 2009, the Chinese involvement was limited, but there was Chinese involvement, which was not regarded as anything that needed specific attention. So that was, let's say, a worry-free time that existed until about 2009. And then from 2009 onwards until about 2016, Chinese investment in European seaports began to attract attention, but not so much primarily as a security risk or as a sovereignty problem, but primarily as a potential solution to financial difficulties that existed in the years after 2009 because of the financial crisis.
I think the well-known case is Chinese investment in Greece, in Piraeus, in two phases: first in 2009 and then the second phase started in 2016. And I think that period between 2009 and 2016, I think the main worry was more about Greece and the financial trouble that Greece was in, and the relationship between Greece and the other European EU countries. And China was being regarded as a country that could help out. So that's a very different time because now, after 2016, the view and the mood on Chinese involvement in European ports changed very much, very quickly. I think after 2016, very rapidly, a lot of attention started to be paid to potential economic security risks that resulted from Chinese involvement.
Piraeus was often mentioned as an example, but of course, there are Chinese investors in many other European seaports. Actually, in all the major European seaports, or almost all of them, there is a Chinese involvement through investment. But then, of course, like I said, there's also Chinese companies using the ports, and the ports using Chinese-made equipment and technology. I think in that phase that started in 2016, let's say, where the mood has changed and where people started to focus much more on the security risk side, I think that resulted in a number of things, a number of instruments that were created over the years that are available today, where the focus has been very much on, I would say, the bilateral economic security risks. So that is the risks that result directly from China itself.
So the things that China could do to use European vulnerabilities to harm Europe. And I would say there are three main categories of such risks. First one is that the loss of sensitive information or the theft of technology, sensitive technology. That is one category. Second category is the potential for coercion. So if the idea is that if a particular port or maybe an entire country or maybe even the entire EU is dependent on certain Chinese involvement in important seaports, that China could use this dependency to coerce actors in Europe to act in accordance with Chinese interests.
And the third category, the third risk category, would be the possibility that China uses, so the Chinese government would use its involvement in European seaports to cause damage, to harm Europe. So I think a lot of work has been done, thinking through these risks, looking, assessing them, coming up with instruments. I think this is an ongoing process. I think, although much has been done still, it's not finished. Much remains to be done and much remains to be also understood about the potential risks, also because the relationship with China is evolving all the time geopolitically, but also in terms of the involvement and the technology and the role technology, the role that China plays in technology is increasing all the time.
So this is something that is ongoing, and I think it's important and good. But then I would say that much more recently, let's say, starting from last year, a new phase started where the awareness in Europe is increasingly that risks to European sovereignty result not only from the bilateral relationship between Europe and China, but also trilaterally, also in the context of The United States, the role of The United States, the dependencies that we have on the U. S. And the geopolitical rivalry that the United States has with China. So increasingly, I think there's an awareness in Europe also that Chinese involvement in European seaports could also play a role in our relationship with the United States.
S. Let's say, actions relating to that involvement could also play a role in our relationship with China. So it's becoming more complicated. So the bilateral security issues are still there. They're still very important, but they are now increasingly being seen in a more complicated context that involves the broader geopolitical environment in which, of course, Russia and Ukraine also play a role.
Now I think if I bring, if I don't want to sound too optimistic about these vulnerabilities. I think the presentation we just heard from mister Lepassard, where he showed very clearly that the maritime transport infrastructure in terms of cyber risks is in a risk zone. It is there's more criticality and less maturity compared to the other three elements he mentioned in his presentation. So I think that especially the cyber domain is a particular vulnerability. But my feeling is that, by and large, if I look at what is happening, and if I look at the capacities that the European Union has, and if I look at the capacities that China has and the motivation on the Chinese side, I think Europe is by and large capable of dealing with a lot of these problems.
So we're not there yet, but I think Europe has that capability. Where I think the biggest problems exist fundamentally more in the present and also in the longer term, because there the capacity of Europe is much more limited, I think, is, first of all, if we look at the motivation on the Chinese side, we should also ask the question, what would China want from us? Why would China use our maritime infrastructure vulnerabilities? Yes, I think it has been pointed out quite often, the theft of sensitive information or, let's say, the collection of sensitive information and theft of technology is something that plays a major role in the EU-China relationship. I think that is there.
But I don't know, I'm not so sure that is really a core fundamental vulnerability on the European side. It's vulnerability, but I'm not so sure if the size of the damage is really as big as some other issues. The other issue that I'm thinking about is the vulnerability of European seaports to Chinese cyberattacks. I think China's state cyberattack capability is very substantial, which China would not normally use, but which China could use in extreme situations. And the extreme situation that I'm thinking about, I think the main scenario here would be a military conflict between the United States and China, where I think we can see what is happening at the moment in the Middle East, where it would be very difficult for EU member states and for the European Union as a whole to remain outside of that conflict.
And assuming that Europe would be drawn into such a conflict, it would be on the U. S. Side. And therefore, Europe would constitute a potential target on the Chinese side. And there, I think China's very strong cyber capabilities and the potential of the European maritime infrastructure as a target should be taken into account.
Maybe not primarily for the Chinese, not as a motive, not so much to cause damage to Europe, but primarily to coerce Europe. So China could use that vulnerability to try to coerce Europeans' position in such a conflict. It's an extreme scenario, but there, I think it's very difficult for us in Europe to really deal with the possibility. And then the second one, the other one I think is also quite fundamental and very difficult for Europe to deal with, is United States coercion. So where the US would coerce, would try to force European countries to restructure their relationship with China in regards to European seaports.
So you could think of not allowing Chinese users to use ports, not allowing Chinese technology or equipment, or not allowing Chinese investments in European ports. So this is also a potential scenario. We don't know if this would happen. But look at the news over the past few days with regard to Chinese involvement in a potential seaport in Brazil, where the United States representative has said that we don't like that. Look at what is happening with Panama at the moment, where Panama has tried to get rid of Chinese involvement in Panamanian ports, container terminals, which turns out to be very difficult for Panama to get out of that situation, or also look at signals that were given by The U.
S. Ambassador in Athens about the Chinese involvement in Piraeus. And I think given the very important strategic relationship between Greece and the United States, where Greece depends very much on the U. S. To manage the difficult relationship it has with Turkey, I think such remarks by a U.
S. Ambassador should not be taken lightly by such a country. So very quickly to go to the end. What is being done? I don't want to say too much about this.
I think the people here are very much aware that there is a European port strategy, which I think is a very important step, and also other elements that are being undertaken by the European Commission and increasingly also by member states, and also the update of the foreign direct investment screening strategy or framework that Europe has. I think important steps are FDI screening is improving. It's getting more refined. It's not there. There's also still work to be done, but important steps have been taken and are not being taken.
I think preparedness on the European side is increasingly better. Also, what I saw in the port strategy, the element that European member states should be ready in emergency situations to take control of their maritime assets. And also, of course, the coordination, that there's more and more coordination among the member states, between the member states, and also with the commission. Finally, is there anything left to be done? Like I said, a lot of the steps that are being taken are in the right direction, and I think need to be continued.
But taking a step back and looking also at the bigger picture, I think it's also the instruments also need perhaps more clearly to try to calibrate the find a balance between where we try to minimize the risks that come from Chinese involvement and where we, in Europe, try to use the Chinese involvement that there is to our benefit as much as possible because China also brings benefits. China's involvement in European seaports can bring benefits. I'm not saying that it is an essential thing that Europe definitely needs. But I think we could European ports generally also do without Chinese investment, maybe. I don't think they could do without Chinese users, necessarily.
It's because I think trade with China is an important part of the for many of the ports. And Chinese technology is a very difficult issue. It's very difficult to, in some areas, do without Chinese technology, and it's getting more difficult to do so as China improves its technological capabilities. The final thing, my final word is, I would argue very strongly for looking at these vulnerabilities in a balanced way, so also look at where do we need China, where can we use China to our own benefit, and how do we position this in a broader framework that takes into account not only our bilateral relationship and not only our firm ability, so not only look at the defensive side, but also look at what does this mean for our broader geopolitical positioning with, and especially with regard to, The United States.
Speaker 1
Thank you very much, mister Vanderpittend, for your intervention. Now I open the floor for colleagues to ask questions, and we will start with EPP, Davos Chlonsky. You have the floor.
Dariusz Joński
Thank you, chair. First of all, I would like to thank you for organizing this very important hearing. Thank you for your presentation. Thank you for your information. As we know, we discussed today the sovereignty of the new EU's transport infrastructure.
And as we know, this topic is very important because international tensions are rising, because war is happening near our eastern border, because hybrid threats are increasing, and all this affects the security and resilience of the EU. So I have one short question. I speak as a representative of Poland. Our country plays a key role in the logistic of the EU's eastern flank. And what concrete tools will the EU use, both, I mean, both regulatory and financial, to strengthen the transport infrastructure of member states and especially for countries with strategic geopolitical importance?
Will there be a special support to modernize and protect infrastructure and include cybersecurity? You talk about it, but it's very important in my region and eastern flank of EU. So I would like to ask about these tools, EU tools. Yeah. Thank you.
Speaker 9
Chair, dear colleagues, to your panelists, I think we have to take back control of our sovereignty in terms of critical infrastructure when it comes to transport. And I think that this hearing serves to convince us of this. Last November, the Oslo transport authorities dismantled one of its buses, and they found Chinese chips that had been built into these buses. And every day, our ships in the Baltic Sea, our airplanes, our rail systems are being targeted by cyberattacks. And the Port of Antwerp and Rotterdam are strategic hubs, which are controlled by Chinese companies.
Speaker 10
This was said earlier. We have given the digital tools for our infrastructure to foreign powers, who are often hostile. We cannot turn a blind eye, because we are in a very difficult conflict. War is on our doorstep, and we have to take back control of our sovereignty. This is why I have been fighting for months in order to ensure that we filter foreign influence on our infrastructure.
And at the moment, the text does not go far enough. We have to ensure that our infrastructure is made in Europe. And this has to be the case for sovereignty, but also for our security. And our infrastructure cannot be controlled by other states outside the EU, and we have to ensure that our networks are controlled at home. Because if we don't have the right infrastructure, we depend on foreign industries.
Speaker 12
So my question here is straightforward. We have to stop being naive when it comes to the European sovereignty of our transport networks. And I'd like to be more specific. Can we continue to consider Chinese investments without controlling our strategic infrastructure? Secondly, can we continue to delegate the production of strategic equipment?
Speaker 10
I'm thinking of rail equipment, for instance. I know that we have a digital representative in the German rail network system. When it comes to software chips, can we delegate this to hostile third countries? I know that the implementation of the ERTMS in Austria has been given to a Chinese operator. And so we depend on an economic and a security standpoint on foreign powers.
Speaker 9
And so we have to protect ourselves and ensure that we remain European. Thank you very much for your attention.
Speaker 1
Thank you a lot, Mr. Calphon, for your question. For the moment, I do not see any other colleagues. Ah, Willemine Conning.
Speaker 11
Yes. Thank you. Thank you for the interesting presentations. And my question is to what extent can countries like China use their position in ports as a geopolitical leverage tool?
Speaker 1
So there are obviously more questions. Isabel Le Kallenek, you have the floor.
Isabelle Le Callennec
Thank you very much, Mr. Chair. And thank you to all our panelists for these presentations. They are concerning. And what you've said about China, well, you've confirmed our fears, really. The European Commission recently announced a strategy when it comes to ports.
And the third axis of the strategy, in the third part, the commission identified cyber risks. So it's not enough to identify these risks. We have to act. And I'd like to bounce back to what you presented. In the slides, we saw cyber Europe aviation, rail, but I did not see anything about the maritime aspect.
And I think that we should be working on the maritime front as well, because Europe has finally realized that this is a very strategic area when it comes to transport and mobility. Thank you very much.
Speaker 15
Thank you very much, especially for your input. And when I was listening to you, I was thinking about the port strategy and why it's so important also as the Trane Committee to work on this, and I think this will be one of the next points in the next months. But, I want to ask my question in German.
Speaker 16
Now we have, seen on the slide, there's different national regulations in the area of transport. And so from your perspective, do you think it's clear who is responsible for what in all of these different regulations, and any confusion that might lead to? And then we talked about air transport and possible cyberattacks. So how can we better react to those types of incidents and ensure that the personnel is properly prepared for that? Now I'm perhaps one of the younger people in the room, and I have a real, just issue in terms of volume, in terms of understanding.
Speaker 1
Well, I'm.
Glad that my colleague said that and not me. So it's a bit reassuring that some of the younger colleagues are having problems hearing as well. So perhaps acoustically, it isn't optimal.
The answers, and we start with mister Le Passage for five minutes, please, to answer the questions.
Speaker 3
Right. I'm not so sure that I can answer all questions within 5 minutes, but I try to do my best. I've a number of issues, I think, that the honorable members have raised now were also tackled by my co panelists in terms of looking specifically, you know, why the Chinese linked threat actors act the way they act, what is their potential reason for prepositioning themselves in our networks, etcetera, and what could be the risks. So I'm not going to repeat these. I just want to highlight, in terms of measures, I think it's quite important.
There were a number of questions of what kind of measures can we actually take at the European level now, and what kind of measures are more strategic. I think there is a very good division of labor, which I think we should keep in mind that when it comes to fighting or pushing back specific incidents, that's a national prerogative. So we have capable national cybersecurity agencies who deal with these kind of issues on the spot. They know best what kind of help their critical entities need, and they don't need European busybodies coming into their field and telling them what to do. They already know it.
And I respect this division of labour. I think it is important that we keep that in mind. At the European level, we can deal with systemic risks, systemic threats, which are common to all, and no national authority can deal with alone. What are these systemic threats or systemic risks? One of them is, of course, stemming from the technology dependency.
Where are these technology dependencies? What can we do at the European level? There, I think it's very important that Europe fully utilizes the framework that has already been set up. So under the NIS two directive, the member states, with the commission and with the support of ENISA, can run union-wide risk assessments on specific sectors to understand better. Every single sector uses technologies which are non-European.
Does it matter? That's the first question. Sometimes it does matter, and sometimes it doesn't. So we need to understand where it does matter and what are then the measures which Europe needs to take. And the measures can be, from the point of view of ensuring sufficient control and mitigating measures up until when we say in these ultra critical areas, we cannot allow non European technologies.
That helps because then it's up to the member states to implement these measures gradually. Everything when it comes to technology replacement is costly. Everything when it comes to technology replacement is also taking time. So we also need to keep that in mind that these measures are probably not quick. There are no quick fixes there.
And mostly when we deal with issues in cybersecurity, there are legacy issues. So we have built up technologies over time. And these technologies, which are legacy technologies, they are now getting older, crappier, etcetera, and we can't control them. We don't know anymore. The people who knew these technologies are also retiring.
That's one of the We have a skills gap in Europe to fill in this place as well. So these kinds of systemic issues are best dealt with at the European level. And that's why I think also the way of understanding technological vulnerabilities, these are internal market problems. Understanding the technological dependencies, these are internal market problems. Understanding also where we need to upgrade our own capacities in order to put European technologies in place is something that we can do, and we should do.
In this context, I just want to highlight as well the very important work that I think there was a question from the honorable member regarding what are you doing for ports and what are you doing for maritime. Aren't you neglecting this? We're definitely not neglecting this. I just, this morning, had a meeting with Digimove, the director responsible for maritime, to see what specific steps Canonis offer in terms of supporting the better cybersecurity maturity of the maritime sector and ports in particular, in the context of the port strategy. So I'm happy to follow-up on this and present also to the Trend Committee a very specific road map that we are, together with DG Move, developing to see what can we do, where we need further help and also in terms of resources in order to be of best assistance to the maritime sector.
Maritime sector is very critical, but it doesn't have the maturity to actually deal with this criticality that it underlines. So I do share your concern, and I would be happy to work further with you on see how Innosat can help.
Speaker 1
Thank you very much, Mr. Le Passat. And now, Mr. Vander Putten for five minutes.
Speaker 6
I think the concerns about vulnerability are there, and it would be great if it would be possible to solve this by just disconnecting us from China. So if we would no longer trade with China, if Europe would no longer use Chinese products, Chinese technology, and if also there would be no more Chinese investments in Europe, that would mean that all the vulnerabilities that result from Chinese involvement and from dependencies on China would be gone. But unfortunately, I don't think this is at all possible. This has something to do with the fact that China is the largest manufacturer of goods, the role of China in the world economy, the innovative power of China. So a lot of modern technology comes from China, also technology that is required for things such as the energy transition.
But moreover, there's also a geopolitical side to it, I think, which is that Europe cannot isolate itself from the world in general. And in particular, Europe can also not isolate itself from the main powers in this world. So if you think about United States and China and Russia, the reality is at the moment that Europe has very limited relations with Russia because of very understandable reasons, and that Europe is very dependent for its security on the United States. So this then leads to the question, how should we deal as Europe with China in general? I don't think we can ignore China in such a context.
I think to avoid becoming too dependent on The United States, you need to have a counterbalance partnership, which can only be China. It cannot be Russia. So in general, we need China geopolitically and economically. So then the question, what would be China's leverage geopolitically by using its influence, the influence that it has built up in European seaports? There's always a tension between, on the one hand, what is it that China could do in the maximum that hurts European interests?
And what is it that China will actually do? Of course, the second one, we don't know. We only know the first one, or we can try to know the first one. So of course, as Europe, we try to limit our vulnerabilities as much as possible, but it remains relevant and important to keep asking the question, what is it that China wants from us? Why would China, if it has leverage, when would it use it?
How would it use this leverage? What would be its aims? And when it comes to blocking critical transport infrastructure in Europe, it's very unlikely that China would ever do this unless it's a very extreme situation, a very extreme scenario, as I mentioned before, with the U. S.-China conflict. So yes, China can use such a leverage.
We have to take it into account. We have to be prepared. We have to do everything we can to not let that happen. But the likelihood of that happening is very small. That's also something that should not be forgotten.
Speaker 1
Thank you very much, Mr. Vander Putten, for your answers. And, before we now jump to our second panel, I have a simple question to Mr. Lepassard. There was one very impressive chart on the threats to aviation. There was 58%. And on rail, it's just 2%.
Speaker 3
The amount of incidents does not represent the maturity of the sector. So aviation is the most targeted, but it's also the most capable of dealing with incidents. And also the amount of incident, it depends very much on what you're looking at. Do you look at only the significant incidents, or do you look only at impactful incidents, or do you look at everything? So it very much depends on your data center as well.
I just want to say that the amount of incidents targeting a sector does not immediately mean that the sector is vulnerable. It means that the threat actors are interested in this sector, either because there is money to be made out of it. So the threat actors who are monetarily incentivized or there is a strategic interest for a threat actor to position themselves there. So I just want to clarify, and thanks very much for this good question.
Speaker 2
Yes. Thank you very much for that good answer. And now we jump to our second panel. We start with Mr. Command for fifteen minutes.
Mr. Colmand, you have the floor.
Speaker 21
Thank you very much. Just a brief introduction for ACI Europe for those who don't know us. So ACI Europe is the industry association representing airports in Europe. So we present airports from Iceland to Kyrgyzstan, around 600 airports represent around 90% of the traffic. Next slide, please.
Speaker 18
So one very important thing to mention when it comes to airports and that we talk about resilience is to avoid seeing an airport as one company. An airport is an ecosystem. An airport needs hundreds of stakeholders to operate. Of course, you need airlines, but think about the ground handlers, the ones that are putting the bags in the aircraft. You need a lot of involvement of the authorities, border, customs, police, sometimes military, are involved at the airports.
Speaker 20
You have air navigation service providers that provide safe traffic for the aircraft. You have cargo operators around the airport, and it goes on and on and on. Even the parking provider at the airport is a key asset of the airport. That's the entry door to the airport. So when we talk about resilience in the context of an airport, we have to see this as an ecosystem.
Speaker 19
Next slide, please. With regard to the airport expertise in Europe, that's something I would like to stress as well. Mr. Lepassar mentioned the maturity of the air transport sector when it comes to cyber, but we have not to be shy here. European airports operators are leaders in the global market.
Speaker 18
So companies that are managing airports in Europe expand their footprint way beyond the European borders. We can mention investment from VINCI Airports that you can find in South America, in Japan. And there as well, the list is very long of the airports that outside of AU are managed by European companies. And, really, this is a sector where all standards, all quality of service, reunite way beyond the border. Next slide.
On this, I think it's really important to mention. When it comes to airport ownership, I will paint a very different picture than the one that was shared with regard to ports. Airports, while at the same time the structure may vary a lot from one airport operator to another, are usually very closely linked to public authorities. Depending on where you are, it will vary, but it's absolutely not uncommon that a local city or a region invest heavily in an airport and because consider that it's an important link for the local community. So it's a strong link between the public sector and the airports in the airport industry.
It goes up to having a full country, directly linked to national authorities. Think about the network of airports in Finland or in Spain where it's the public authorities owning the entire airport network in the country. So I would say that compared to the discussion we had with the first panel, we are facing a very different market when it comes to the airport. Next slide. So it's also important here to define what we are talking about when we talk about resilience.
I will, of course, cover in my next slide all that comes first to mind, the cyber risk, the physical security risk, but also an economic question that you could ask here about resilience. So that's the beauty of the European Union. Airport services have been progressively liberalized. And, of course, it brings a lot of benefits, for the passenger ultimately. But when you liberalize a sector, there is also some consequence by doing that can arise that are impacting resilience.
For example, if there is a strong competition on the price, the buffers that exist to manage a crisis might not be as available as you would be in a system that would have been taking this into account. So what I'm trying to say here is that if the intention is to review the way critical infrastructure or critical sector or transport critical infrastructure are managed from a regulation perspective, it is important to look at how liberalization of a sector can have an impact on operational resilience. So that's an element that is sometimes forgotten. Next slide, please. So sometimes it's also good to congratulate ourselves.
And if there is something we can congratulate about when we are in the European Union, that's what has been achieved with aviation security. We have one, if not the most advanced system in place when it comes to security outcomes. It is a strong system. It's a system that is highly regarded outside of Europe and is a system that delivers massive benefits to the industry on top of delivering massive security effectiveness. Give you one example of this.
Airport in Europe are designed in a specific way that you're not going to find outside of Europe. Why? Because passengers that are taking off of a member state, that are going to transfer at another airport located in a different member state don't need to be rescreened. So you don't have to go through security again. This is massive gains in terms of how you can connect people in Europe.
This is massive gain on how you operate the airport. And in this is something that influenced the design of the airport itself. You will land on the gate, walk a few 100 meters, and connect to the next gate. But outside of Europe, you will have to channel to a long corridor, get screened through to go through security again, and then walk again a long distance to get back to maybe sometime the same gates where you just landed. So there, honestly, congratulations to the European Commission, the AU member states, and the aviation industry that have been working for 20 years together to achieve that.
Next slide. But not everything is perfect, of course. I think this is given. There is an evolving threat landscape. And, some of the comments that have been made during the first panel are very true when it comes to the airport industry, sabotage of critical infrastructure, disruption.
And disruption, it could be done to organizing protests around an airport to limit the ability for the traveling public to access the airport. And of course, there are well known events of airspace disruption due to drones or due to balloon that are being sent from another country. So all of this is creating a new type of threats that airports are facing. Are there ways to tackle these threats? Yes, of course.
Are airports doing something about it? Yes. Of course. Depending on their exposure to the threat, they will adapt their technology that they have at the airport or in collaboration with the authority that will decide what needs to be done at the airport level. But there is one thing that never changes.
Resources are not infinite. You cannot do everything. It's all about risk management. It's all about putting your resource on the elements that really matter. And this is something that is important for the future of aviation security regulation, this time.
It's not to miss the threat that are in front of us by continuing to do what we have done very well so far, but not acknowledging that there is now a new part of the threat that requires dedicated resource to be allocate to. So in a short, if you've got 100 to spend at an airport today, you're putting, you were in the past putting this 100 on aviation security because there was a requirement to do so. But now you might need to put Haiti on aviation security and 20 on to tackle this new threat, and the regulation must account for that. Next slide. So security and technology because to deliver, on this new threat, you need technology.
To deliver on the old threat, you need technology as well. And this is something that was mentioned by Eneesa earlier. There has been a study linked to the performance and the exposure to the cyber threat of screening equipment that was framed as a port screening equipment, but that's the same equipment that you may have at airports. So it's important to think about what can be done to better support Europe when it comes to security technology. So there as well, maybe something that doesn't work very well.
There is very limited support to research and development when it comes to security technology. So let's see, when I say very low, it's probably zero. There is also not a lot of support when it comes to the testing of this equipment. These equipments are very complex technologies, and they are there to tackle very complex threat. So it's absolutely normal that states, the commission wants to have this technology tested under the most secure way, but it is something that is very complex to do.
Some member states have already been developing capabilities in this. There has been a lot of collaboration and alignment between the states that have developed such capacities, but there's very little involvement from the European institution in supporting this testing capacity. And they are clearly there is something that can be done to support the industry. Next slide. What are we talking about when it comes to sovereignty on the security equipment?
So I've just went to publicly available information. That's a database that is run by the European Commission and looks at the most advanced piece of hardware that you will find, to deliver security outcome at airports. So the CT technology, the security also known as body scanners and all baggage system that are automatically detecting explosive in whole baggage. Well, this table provides a clear answer. We have capabilities inside the European Union, but we are heavily reliant on capabilities that are developed outside of the European Union.
Some are located in the United Kingdom. Some are located in the United States. Some are located in China. And there is even equipment that is being developed in The Republic Of Korea, but it's not marketed directly, but it's available. Next slide.
The other dimension that I wanted to touch upon is, of course, resilience in the cybersecurity context. There as well, there are the things that are good. And honestly, as an industry association, we are supportive of the Cybersecurity Act 2.0 that's currently being discussed. There is a lot of good elements in this. But as Mr.
La Passard mentioned earlier, clearly, and we need to be serious when we say that we need to avoid duplicative requirements, that we need to streamline obligation, choice needs to be done. You cannot do everything. Sometimes trying to achieve a 100 will lead to achieve zero, and it's much better to be able to achieve 80. And tough. If someone is not having as much power as they could have by doing a 100, that's probably time to ask the right question and pick a piece of regulation that makes a difference rather than trying to achieve everything.
And on this, back to things that are working very well, I must really highlight the collaboration that we have seen not only between the member states and the Commission, but also the collaboration that we have as an industry with our European partners. And, for example, the increasing collaboration that we have with ANESA to learn from the other and also from an airport perspective, supports resilience in other sectors. Next slide, please. So I'm trying to recap what I've been saying here. Strengthening resilience when it comes to airports, don't think only about the airports operator.
Think about an ecosystem and a wide range of actors that need to be involved in this resilience improvement. Please, support the industry by being directly involved in the development and testing of aviation security technologies. I'm sure that we can do much better than what we're doing today. And finally, security policies must tackle the threat. There is a tendency sometimes to try to reach perfection in compliance.
Perfection in compliance is not perfection against a threat. And regulation when it tackling security issue should be looking at the outcome and should agree on an outcome collectively that can be achieved by the industry in an operationally feasible manner. That's back to my comments on money, on finance, on resources. Regulation should take a really close look at what can be done with the resource that airports have. Thank you.
Speaker 1
Thank you very much for your intervention, Mr. Coleman. And as we expect from the aviation industry, it was on time. 15 minutes. Perfect. So now we go to Deutsche Bahn, Mr. Steinbach.
Speaker 22
Last not least, you have the floor for 15 minutes. There was no one laughing in the room. Okay?
Speaker 23
Thank you very much. Dear mister chair, honorable members of parliament, Antran, for the possibility to address a couple of questions and ideas. I think the sequence of presentations was wisely chosen because first, we came from the general threats down to maybe going nearer to the subject, and now we will end with the view of a humble infrastructure manager and the decisions which need to be made. And I think that's maybe quite good to see how these views might differ. If we look at InfraGo, InfraGo is an infrastructure manager of railway with about 40,000 kilometers of tracks.
We have 3 and a half thousand interlockings, more than 100,000 line sight signals, 27,000 bridges. I could go on maybe for nearly 15 minutes without stopping. So, what I want to say with that is we have a very big amount of assets and they are distributed over our total country, and this is the same for every other infrastructure manager no matter in which country he is. It might be a bit bigger, a bit smaller, but it's in general the same. Apart from being CTO, I'm also responsible for the task of digitalization of the infrastructure.
And actually, this task is going into a very important phase for us because we are changing from maybe more specific made systems like specialized interlockings and also communication systems to more general systems, especially in the communication sector. These are then in the future systems which are IP based and also with FMCS on the level of 5G. So state of the art technology, which is more in the direction of common off the shelf products and not specialized products, which are only made for the industry of railway. These changes are will be taking. We heard that those changes take a long time in the industry of the railway sector, the next about 5 to 15 years. And especially when we look at the communications infrastructure and the introduction of FRMCS, we are talking about nearly 2-digit billion euro project for Deutsche Bahn.
And for this network expansion we are doing, it is for us of utmost importance to clarify before we are in distribution of the network if there will be, so to speak, if there will be suppliers of countries of concern or maybe high-risk suppliers which will be excluded from the market. Those thoughts are important to us because if we look today at this field, we see the situation of our European procurement law. And usually, if we look at European procurement law, we would look at the technical aspects. These companies we are talking about, we heard early on, are usually the companies which have the most advanced technologies. If I look into it, a company which would definitely fulfill the criteria, I think, for everyone in this room of being maybe a high-risk company or a company out of a country of concern.
If I look at their technology, it's more functions, less energy consumption, more reliability, better service. And if I look at the commercial aspect of it, a price they would always win. So if we use laws and regulations, national and European, we will always award them. That's definite. Not saying good or bad, but first, this is the framework we're in.
And we as infrastructure managers really need fast the way forward for these questions because it's not hard to do one or the other thing, but it's hard to do it when we are in rollout and when we have spent a lot of money and when we are maybe also already in our whole operation system reliable, relying on the structure we made, the architecture we made, and we followed. Then if we think of that there could be some, we will call it political guidance in this situation, then obviously this would have to at least, as I said already, address the aspect of procurement laws. It would also have to look at the national regulations. We have in our national regulations to keep to efficiency and cost effectiveness, which is, I think, nearly for every infrastructure manager in Europe the same, which is also good because we're talking about national funding and money of the taxpayers. And, also, we have to keep in mind that solutions could be taken, but these could also have a high impact on costs.
I will come to that later. But usually, these costs also lead to higher track access costs, which lead to jeopardizing the wishes of growth in the sector, which is always also a big impact, and especially when we are talking about investments which are so extremely high. So quick questions which are occurring to us are: will tender accord according to European procurement law stay the same, or are exemptions planned? If there is no exemption planned, will that give us security on our investment, or will they come later and then we will have big problems with investments? I think that's nearly the most important question.
And if exemptions are planned, I think then we have to be aware of that. We will surely be talking about them in law cases. There has to be a good and strong will to protect them. Apart from that, we would have to ask or answer the question if the EU was planning to implement a communication sector which is able to develop, produce and operate those products themselves and totally independent. And they are not leaving out of sight that I think it has been said earlier on all telecommunication products we purchase today, no matter from which company and from which country, always use at least chipsets out of countries which would be of concern.
So in summary, and I think there have been a lot of questions raised, but I don't want to leave you with all those questions. In summary, the good news is that there is nearly no possibility to do something bad. The only one would be to not take action. So if decisions are made and if actions are taken, it is nearly no matter which, it will get better. So pass a bit of pressure.
I think if I can put in a bit of personal view into this subject, we actually faced three options, maybe for this special case. I'm not saying that it will fit for every case because we have heard quite different cases, but for FRMCS and the communication transformation over the next 15 years, which will be a multibillion change in Europe in total and is already a multibillion change only in Germany. There is actually three ways forward. Immediate exclusion of high risk suppliers out of countries which are at stake would be one. Intermediate, maybe ten to fifteen years exclusion of high-risk suppliers from countries of concern would be a second or no exclusion.
So, quite obviously, this would be the trees. And these three have very certain advantages and disadvantages which come with them. Obviously, maybe some of you just heard what I was saying before, but I will go through them for you in every part of them, and then it makes it easier to sum up maybe how I come to a conclusion. The first, so the immediate exclusion I think is not feasible because alone from the technology where we are and where we would need to be, we are too far away from it. And that's a situation which is maybe not the nicest situation to be in, but it's the reality we live in.
Also, it would be extremely cost intensive because the big suppliers, which also regulate the market through what they contribute to the market. As I explained in the beginning, technical and also commercial would fall away, which would immediately bring a cost increase in every product we could buy. And last but not least, it is a solution, and that's not to be undervalued, which has a high clarity. So not everything is bad, but it's a problematic solution. The intermediate term exclusion of high risk suppliers out of the company or out of countries of concern is a more feasible way of handling it.
But if you take into account that in the next 10 to 15 years, the rollout of FMCS will be over, and we would then start regulation. Then in the next ten to 15 years, it would take until those products out of our field. So the turnaround takes a long time, and then we would be 30 years on. I think the threats might be different then. So and also, not saying it the cost would go up just a bit later.
But if you ask me, this solution also is a problematic solution because why if we can work with it for 10 to 15 years, why can't we go on? And that brings me to the last solution, which is not to exclude any of the suppliers. For me, it's a realistic conclusion and also complies with the zero-trust approach. If there are questions on the zero trust approach, I will be happy to answer them later on and also the zero trust architecture. Especially with the question which companies or which countries we don't trust, the question is, will they stay the same?
And this approach will be, apart from it, always resilient against this question because we would see that many systems are changing, and many countries are changing their views. So this is one of the things this approach can handle. It is cost efficient, obviously, but it is a bit harder in the regulatory guidelines we need, and also more complex, but it is, if you ask me, the most technically robust solution to the question. So I would like to close with that, and I'm excited for any questions you have. Thank you.
Speaker 1
Thank you very much, Mr. Streinebach. Excellent, and even faster than the airport industry. So before the timing, that was even better.
On time.
Speaker 1
It's a good standard to be two minutes early. Now we come to questions from the colleagues. So there were questions from my colleagues for the moment. Johan Danielson from S and D.
Johan Danielsson
Thank you. Thank you to both of you, about all four of you. Firstly, perhaps on aviation. I think it's a valid point you made, also in the beginning, about resilience is also an economic issue. And perhaps on some of the liberalization, you don't even see benefits as a customer.
Yes. That you have competing companies carrying your bags doesn't really help either. So I think there is a balance to be found. But my question is more concerning this. As you say, aviation and aviation security is an ecosystem.
It's everybody who is involved. And also to connect to the discussion about foreign ownership, we know that the European Commission is planning it later this year. Well, it's been later this year for 6 years, so who knows? But to revise their service regulation. And one of the issues that the commission are continuing to investigate in consultation after consultation is to get rid of the European ownership requirement.
So from your perspective in the concept of the whole ecosystem, that we would lose control over European control of a part of the ecosystem, would that be a potential security risk? I would also then perhaps go to Deutsche Bahn. It's impressive to be depressingly optimistic in a sense. To say, we are in deep trouble, but whatever we do can make it better. One thing that I encountered in the procurement of this big infrastructure projects, that if the infrastructure manager, at least in my country that is a little bit smaller than yours, if we pure core two big segments of the investments that we need to do, then for sure we will have no Swedish companies.
We might not even be able to get European companies. But if we procure, if we divide the investment into smaller projects, it's also then perhaps easier for national or European companies to take part and win the procurement. Then, of course, there are disadvantages with this as well. But it would be interesting to hear if you have some experience perspectives from Germany on this. Thank you.
Speaker 1
Thank you very much. So for the moment, I deem I do not see any more questions. So I will put me on the list. Mr. Colmand, you pointed very well to the ecosystem and to the whole aviation sector and to even including the parking and the ground handling and everything.
Of course, we know that there are revisions ongoing, the fit for purpose test from the commission on ground handling. If there were a vision, of course, resilience is a key question and security as well. There are new threats arising, like you pointed to balloons, to drones. My question would be, is it a unique approach there? Are we fit for purpose, or do we have, in a way, a whole bunch of competencies and, in a way, different approaches, which, in a way, lead to not the best performance of efficiency to attack the threat.
For example, we have ANESA. We have agencies. We have EASA. EASA is dealing with safety. Is your take that, for example, EASA should work more on the security issues on fighting against drones.
Should that be something where EASA could work on as well? Tomorrow, I will go to EASA in Cologne, and we will talk about the civil use of drones in agriculture, which is very peaceful. But at least the drones who come to airports, they have nothing to do with the use of agriculture. I don't know if so you get the point. That would be the question.
And to mister Steinbach, what I did not really understand because on the exclusion of the high risk suppliers, for example, chips you mentioned, your option was, the third one, not to exclude any of those. So the general principle here is to derisk because it has been pointed out in earlier interventions. So risk with China, if we have seen in escalation with US or with Taiwan, it's a very cautious approach not to be too dependent on China, for example. We try to derisk, to have our own production, for example for chips. It's difficult to the chips act to implement because even if you give public money, it's not always successful like in Saxon and Halten in my country in Germany, which was not successful.
Speaker 2
The plan was good. The implementation was bad. But the principle of derisking is something we work on. So this is why I do not understand that the last option is your preferred one. So I would love to hear your answer on that.
Speaker 1
Thank you very much. And we start now. We do not start. Now we have Vivian Costanzo.
I'm sorry, Jens.
Speaker 1
No. You're not sorry. You make me happy, because now we have another question, and you have the floor.
Thank you.
Speaker 16
Well, it's known that in the Deutsche Bank digital infrastructure there are parts from Huawei, and you have probably expected that question. And given today's political context, are there any plans to replace or exchange those critical parts? And then, as a follow-on question, what about the sustainability in the future of our rail infrastructure? Of course, we've got this huge railway. We've got it across Europe as well.
Speaker 27
And how critically important do you think those are? Perhaps you could give us some practical information.
Speaker 1
Thank you very much. Thank you very much.
Before Mister Nebach answers that question, we will give the floor to Mister Colmott first. He's got 4 minutes to answer. Now you have the floor, Mr. Colmott first.
Speaker 18
Thank you very much. So quickly on liberalization, what I meant was like there are benefits, but we need a balance, resilience. So our suggestion here would be simply to evaluate the impact of the market infrastructure on resilience, not more than this. When it comes to ownership and regulating ownership, I think I painted a picture where actually there is no problem currently. When we're looking at this from a server NPS perspective, I'm a simple man.
I like simple things. So my recommendation here would be don't try to fix something that is not broken. By recognizing that airports are business on their own right, provide connectivity to local, city or regions, this is what will keep the public sector, the local, the sector that knows the best about the benefit of the airport involved at the airport. So, actually, the success of what we have today is the best protection if we're looking at it from a sovereignty perspective. About the question related to drones and the fitness of what we have as regulation.
September, October, I was not a single day without, you know, a report regarding drones. Look at the news over the last 2 months. There will be not a lot of reports on drones. What we're facing here is extremely flexible and adaptive threats. They're looking at our weak points.
And if there is something where we're really bad at is to address flexible threat because we are always aiming for perfection. Countless, endless discussion to reach perfection in front of a very flexible enemy, in front of a very flexible threat, we should prioritize a solution, not the solution. That would be my point for any of the threats that I've listed or that will come and that we are unaware of. So really there, I'm glad and we have worked a lot with EASA because the drone threat, by the way, is not new. We have been facing drone incidents since Christmas 2019, with Languedot Gatwick being closed almost for 48 hours.
We have worked a lot with EASA. We're promoting the drone incident manual that was produced by EASA. We continue to do so. But let's not overfocus on elements that are going to change every day.
Speaker 1
Thank you very much, Mr. Comment. And finally, Mr. Steinberg for 4 minutes.
Speaker 23
Yes. Thank you very much for that question. I'm going to answer this in German because it's easier for me to do so. And I'd like to start with your question, and then we can come to the others. So my statement saying that we shouldn't exclude any of the manufacturers wasn't to minimize the risks.
No, it's not about money that you can save because you're spending such and such money. No, that's not what it's about. It's about having an approach from an engineering perspective where you have zero trust, and that's an approach where you look at the architecture of the system, and you follow that. And in that approach, you don't need to exclude anyone because you would just assume that anybody could actually corrupt your system. So this means then that you would have a system.
We talked about FRMCS. It's got several levels. There are different risks that might happen as to how it could be corrupted. And then you look at those different levels, and you find technical solutions for the different risks. So you'd have the IP network, you'd have two of them from two different manufacturers.
So if one wasn't working for whatever reason and didn't, you didn't necessarily have to be an attack, then you can address that problem. So for each level, you have risks, and then you have your defense system, you have your central system, and then you know how to deal with it. So you would basically start with a starting point saying that there's basically nobody you could trust, and then you need to look at the list to see if that is a stable list or not, or does it constantly change. And then if you apply that approach, I take one example here, the Suez Canal. We had the situation.
You just mentioned the company. So that company was one of those companies that was able to tell us when that Suez Canal crisis, when we were looking for supplies, that they wouldn't have any problem. They've got their own production, and so on. Now if I know, then I am slightly dependent on that, then in a zero trust, I'd need to say I need to have some redundancy as well. But then I'm not going to be robust against various different situations that could happen.
It's not always an attack because you've got chaos when you're hit by something that you hadn't expected. So from an engineering perspective, you need to think about this as the approach that's the best one to take, because you need to be prepared beforehand. You need to think about what could happen in your system if one bit were missing. COVID, for example, that's another good example. And it's maybe not got anything to do with an attack, but you had that approach, and it meant that you were looking at responding to more than one threat or risk.
And if you really want to look at this, then it wouldn't necessarily mean that you just have to say you're going to exclude one particular manufacturer. Now maybe there's going to be one part of the system where you wouldn't use them, but it would be clearly linked to one of the potential risks. And that's something that I said as well. It's more difficult in regulation, yes, I admit that, but you're going to want to have long-term stability. That's the best option.
Then the big tenders, that was another question. And here, I have to say that as an infrastructure manager, we even have smaller tenders and so on. They're not that attractive to SMEs. They always go to the big companies. And for us, when we're talking about the different technologies that we're going to use, we're usually using the European manufacturers, and that was just one of the examples that you mentioned.
And then you also asked if we were planning to replace a particular manufacturer in our system. No. We don't have any plans to do that because it's due to the measures that we have already taken that we're going to assume that on that point, there's not going to be, how do I put it, there's not going to be any major risk here that then we wouldn't be able to address it. And at the same time, we're going to have this new system, FRMCS, and so on. So that means it's not necessarily going to be possible to make an exchange at this point, but we don't have any specific plans.
That's what I would say. Then there was a question. I was asked to assess the current risks, and I'd have to say yes. I do think there are some threats that need to be taken seriously, not necessarily due to the situation that we just discussed. No.
But due to the fact that we have an asset-heavy system, we've got a lot of distributed assets, and many of those are assets that have been developed over decades and even a century. And they developed in a situation that was quite different. And if you're going to try to manage them now and make sure that they all catch up with the current standards, well, I mean, you've got 3,500 things in Germany that you might need to replace. So, of course, that's going to be quite difficult. But this is when you're talking about this threat landscape, then you do need to think about what the tensions are.
Speaker 1
And I'd like to thank all of the panelists for their very valuable contributions to this item. So that concludes item 12. And I will just suspend the meeting for two minutes, because we are going to have the next item chaired by Johan Danielson. He will come and sit here. So we'll swap the speakers for the panel and also the chair.
Johan Danielsson
Thank you. Let's start. As my colleague said, this is strange, but I'm replacing the share for this last point on the agenda. So let's start. It's the presentation of the ECA special report, EU Transport Infrastructure, Further Delays and Some Cost Increases, But a Reinforced Governance Framework is in place for the future.
I would also like to draw your attention to the fact that this report is an update of the ECA special report on the same subject published in 2020. The report highlights the progress made and the reasons for the cost increase of the Trans European Transport Network, a flagship transport infrastructure project. The report also provides for further recommendations on how to move forward. I'm happy to welcome Ms. Turtlebaum, the Member of the European Court of Auditors, to the TRAN Committee.
She will present the report and then participate in a debate where we will have a possibility for questions and answers with the member. So firstly, thank you for being here, Mr. Ottebohm. And you now have the floor for 10 minutes.
Speaker 31
Thank you very much, Mr. Chair, and dear members of the European Parliament. First of all, thanks for inviting me and for giving me the opportunity to present our special report, update of the special report on the EU transport infrastructure. As you well know, transport infrastructure is the backbone of Europe's economy and mobility: roads and railways, inland waterways, ports, airports. They keep our union moving.
Speaker 30
They connect people, enable businesses, and support trade. Moreover, they bind our single market together. And to close the gap in the transport network, mega projects are key. They remove bottlenecks, bridge borders, and make cross-border mobility possible. But they are also extremely complex, technically demanding, financially intense, and highly dependent on cooperation between many actors.
In 2020, we published a special report where we warned that the EU's ambition to complete the core of its transport network by 2030 was at serious risk. We had reported on the fact that national priorities and procedures differed widely, that the commission had only limited tools to enforce agreed commitments, that planning quality required improvement, and that the commission's oversight remained distant. Since then, Europe has been hit with many new challenges. The pandemic and Russia's war of aggression against Ukraine have placed even more pressure on these projects due to disruptions, higher energy and materials cost, and new defense and security considerations. And at the same time, an evolving regulatory framework and, for some mega projects, new technical challenges have contributed to make delivery an ever more complex task.
Speaker 32
Now the landscape has, in short, changed. We therefore decided to produce, it's the first time that we do it as a court of auditors, a focused report to update key data and observations from our 2020 special report. We also analyzed, oh, yeah. I'm a bit too fast. Okay.
Speaker 30
Excuse me. We also analyzed how the 2024 revision of the Tenti regulation could potentially improve issues identified in our previous reports. We also examined the level of implementation of all the recommendations we have included there. Now here on the slide, on the next slide, you can see the eight mega projects on which we focused in our 2020 report and also on this update. They include four railway projects, the Rail Baltica, the Basque, the Lyon Turin Rail Link and the Brenner Base Tunnel, two multimodal projects, the Fermat Belt fixed link and the E59, one inland waterway, the Canal Sena Nord, Europe, and one motorway, the A1 in Romania.
The main conclusion of our update is that while there have been improvements in the governance framework, the underlying structural problems remain, and in some cases have grown. I'm now going to give you the three main messages of our report. First, there were significant further cost increases for the two TFIs. Compared to our 2020 findings, the total estimated costs for the eight projects have increased by 24% in real terms, so netting out the effect of inflation in just six years. This means the combined budget for the ATFIs is now almost double their earliest estimates.
This is mainly the result of cost increases in two mega projects, the Rail Baltica and the Lyon-Turin Rail Link. Rail Baltica cost has more than doubled since 2020, with the total estimated cost now for the first phase only of 24,000,000,000, while for the Lyon to Rand project, costs have increased by 23% since our last report. The other projects show more moderate changes, and a few even have lower revised estimates once inflation is considered, but these do not outweigh the major increases. Second, the 2030 deadline to complete the new TnT core network will not be met. In 2020, we reported an average delay of 11 years for the eight mega projects we examined.
Now, for most of them, the situation has worsened. For the five projects for which we had full data, the overall delay we now report is 17 years on average compared to the original plans. And this still can worsen as the projects are ongoing. For example, after the publication of this report, it was reported that the Fairmount Belt project may be delayed until 2031. That's two years later than the official estimate we based our report on.
Now let me quote some examples. The Lyon Turin rail link is now projected to be opened in 2033, a delay of three more years compared to when we last audited, and eighteen years later than planned. The Brenner Base tunnel now aims for 2032. This is a four-year additional delay compared to the situation in our 2020 audit, and the 16-year delay compared to original plans. And for the RealBaltica, which was once expected to be completed by 2030, the situation is even more uncertain.
Now 2030 is the envisaged day to complete only the first phase, and there is no timeline for the full project. Now when we look at the likelihood of one of the mega projects we looked at together with its connecting infrastructure being fully in service by 2030, the situation has clearly deteriorated compared to our previous special report. We have reported only one case, the A1 Motorway in Romania, which moves from not having a deadline for completion in 2020, to now being scheduled for 2029. In all other cases, the situation has worsened compared to our previous audit. Now the implication is clear.
Europe's core network will not be completed on time. As we have seen with overly ambitious goals in other policy areas, the gap between planning and delivery continues to widen. Now my third and last point is that the governance framework has improved, but the new provisions are mostly relevant for projects still in the planning phase. In 2024, the TNT regulation, the main legal act providing objectives and provisions for the member states to complete the network, was significantly revised and now it mandates a stronger corridor framework, which brings together infrastructure and operational considerations, a stronger broader commission implementing acts now covering entire corridors, greater powers for European coordinators, and a requirement for member states to align national transport plans with EU priorities. Moreover, the 2021 directive on streamlining also introduced new measures to facilitate permitting on key sections of the EU core network, including cross-border ones.
These are, in theory, real improvements. However, their effectiveness will depend on how actively they are used and how fully member states comply. For example, in 2020, we highlighted that the commission had limited legal tools to react to delays and that it did not make use of the ones available. The commission could, in fact, launch a procedure to ask member states the reasons behind significant delays and then start a consultation with a view to resolving them. However, even though many delays exist, as we have highlighted, the provision has only been used once since 2020, and that was for another mega-project in France, not in our sample.
Moreover, most of these tools apply mainly to new projects in the planning phase, not to those already under construction. In other words, the toolbox has improved, but the projects we examined are already too advanced for these tools to reverse the trends. To sum up, our report shows that despite a reinforced governance framework for the future, Europe's transport mega projects are still affected by delays and cost increases. These issues weaken not just planning schedules, but the credibility of the EU's ability to deliver. Moreover, if these killings are not completed on time, Europe's mobility, economy, and cohesion will all suffer.
And in a world marked by geopolitical tensions and growing competition, Europe must ensure that its transport backbone is reliable, modern, and resilient. So thank you very much for your attention, and I'm looking forward to your questions.
Johan Danielsson
Thank you very much for the presentation. We now move to the first round of questions. Representatives from political groups, for the EPP, mister Borje Meslaras, you have the floor for three minutes according to my thanks.
Borja Giménez Larraz
Thank you very much to the court of auditors. I think this confirms that we have a serious problem when it comes to implementing the European transport network. We see we have the basic network, the extended network, the comprehensive network, but all of this is systematically ignored when it comes to the timeline. So let me just say one thing specifically in 2020. The court of auditors published a special report where it talked about delays, increasing costs, lack of coordination between member states, lack of oversight by the commission.
I'm not sure much of this has changed, and it doesn't seem that there is a solution. The commission doesn't seem to have the right tools to monitor this situation, which is quite concerning. Now there's eight projects that were analyzed, so we're talking about 17-80 years when we look at the timelines that have been overshot, which I think really should give us food for thought. Then we look at the cross-border projects, and that's where most of these delays seem to accumulate. And the commission really needs to look at what can be done to deal with these issues.
And then finally, I wanted to look at key infrastructure for Spain. There's 20 years of delay in the project in the Basque area. So this is one of the worst figures we have. So it's not just an issue of technical problems, but there just isn't any sound political management here. Now I know that you've analyzed this project in detail, so I would like to know what you think is behind these delays in the Basque area, these extra costs.
Speaker 34
So what would the court say? Is there a lack of transparency? Is it simply not realistic in terms of the time frames? Thank you.
Johan Danielsson
Thank you very much. Also, to the speakers, if you could speak a little bit slower, it says on my screen, it's easier to interpret. So the next speaker for the S and D group is Ms. Maria Serrano. The floor is yours.
Three minutes.
Thank.
Rosa Serrano Sierra
Thank you very much. This was a very interesting presentation. I'd like to ask three questions. First of all, why were factors that have an impact on projects, such as inflation, taken into account? Because inflation has changed costs now in 2026, and this is different from the prices when the projects were designed, especially in relation to 2013 documents.
The new regulation, the 2024 regulation, new requirements have been taken into account, such as more regulation, more security, and use of network. These questions imply a raise in costs vis-à-vis the initial costs. Therefore, I'd like to know whether this increase in cost has been taken into account in terms of the requirements of the current regulation. And I would also like to talk about the Basque way. In the 2020 report, the ECA distinguished the Spanish side, which was respecting deadlines, and the French side where there were delays, estimated at 2,037.
The current report does not distinguish between the two countries. In Spain, the project is in its final phase, and it will be completed before 2030. But on the French side, we are still waiting for the report. But some reports are already stating that there will be delays until 2042. That's why I have a very concrete question.
Speaker 37
Have you taken this situation into account, and have you taken into account the delays in this new report? Thank you very much.
Johan Danielsson
Thank you very much. I don't see anyone from the Patriots, so then it would be ECR, Mr. Sile.
Speaker 38
Yes. Thank you. Thank you, chair. Well, thank you for your presentation. We on this major projects, so how you described, did you evaluate it also, why they became so much expensive?
So it's not only the classical inflation. So let's be honest. So the composition of the projects like RealBoltica is different because of the military mobility needs and additional parts. So it's, but if the court of auditors also present it like a just inflation, it creates political problems in those countries involved in the creation of this project. That's why I would appreciate if you will explain how deeply you dig it into why the projects became so expensive and why they are so much delayed.
Speaker 39
And, also, because it's a cross-border project, well, how it looks like, did you analyze delays in particular member states involved in the development of the project, which could delay all the final stage 2030 to fulfill core network projects? So again, coming back to the example of RedBoltica, there are totally different developments of the project in Estonia and in Latvia. So did you go there? And since last, what is your suggestion in the situation? I remember in a presentation of report 2020, your colleagues that time in a press conference in my country in Latvia, he said perhaps it should be reduced speed of Rail Baltic train to 130 or something, which, of course, create of course, it will be less expensive, but then we also have to speak it's partly related with my first question about axis of the military needs.
How much pressure is on one railway axle or rail rolling stock? It is 22.5 tons or something less, like 16 for passengers. So it's well, all those things and what is your suggestion as a what to do with this situation with delays and also with a possible other financial resources used by member states involved in a particular of those major projects. So thank you very much.
Johan Danielsson
Thank you very much. I don't see anyone here from Renu. The Greens, the left, ESN. So I will open the floor for questions. If any other member has questions to put.
If not, I would introduce some questions myself. Firstly, perhaps because you mentioned briefly that some of the problems are also with the implementation of the TNT network is national priorities that are not then in line with the European priorities of the TNT networks. And have you then also, we will let the commission in, but when we now will use the ZEF money more to finance the cross border links, how do we then ensure that the national priorities help us with the whole network? And then as I understood, one suggestion made by the ECA in the previous report, and as I've been informed, not considered to be implemented by today, is about a better holistic analysis by the commission before deciding to provide co-funding for mega project. And perhaps a few questions to you and the commission on this point.
If this is not yet done, how would this recommendation distinguish itself from the current practices? What would this recommendation entail to spot unexpected delays, and so on? Because normally, they are unexpected. So what would this recommendation entail? And from your perspective, is the current revision of the ZF an opportunity to deal with this issue?
If so, how from your perspective? Thank you. With that said, I will first leave the floor to the European Commission, and then you will have the opportunity to answer the question as well. But first, Mr. Philippe Catherine, of the transport and investment unit at GGMU.
The floor is yours.
Speaker 40
Thank you very much, chair, and thanks to the ECA for the presentation of this updated report. We consider that despite unprecedented external challenges, including the COVID-19 pandemic and the Russian war of aggression against Ukraine, we are still on track to achieve many of the endeavors that we have set ourselves. And, again, let me underline that these are really external challenges which have a direct impact on our projects. The Russian war of aggression had an impact on Rail Baltica, not to name one, because all the steel was purchased in Ukraine, and also workers were suddenly not available anymore because they were drawn into the army, etcetera. So the direct impacts on our projects, which partly explains the increased costs and increased delays that were noted.
But if I can underline the main takeaway on our side on this is, and the figures of the court showed this, the majority of the projects are with stable or even decreased costs. And I think this is testimony to the good project management that we have in the majority of the projects. The other ones, we would certainly encourage to assess individually for the reasons that have led to cost increases, and to assess them one by one. We have taken concrete action to follow-up the 2020 report, and many of the measures that are now in place were already presented, notably the TNT regulation of 24 or the streamlining directive of 2021. Of course, this impacts rather the new projects that are coming in than the existing projects that have to be delivered.
Speaker 41
Let me also react on one wording used here, the overly ambitious deadline of 2030. I think our assessment would be different. The 2030 deadline, which was introduced to develop the Tenti core network, has been very conducive to mobilize actors across borders and to make project happen. It hasn't worked in all cases, and we know the famous French case for the Spanish connections for sure. But in many others, it has helped.
The other reasons why most of these projects are still alive and delivering is that we were able to support them with the Connecting Your Facility, a program specifically designed to support cross-border projects because they are not prioritized at national level, and hence, they need support from the European Union to deliver. And without that support, for sure, these projects would be stopped. And I think here we also agree fully with the Court of Auditors in the overall assessment of the importance of these missing links between the national networks as the backbone for our economy. So we are really hopeful that also for the next MFF we will have a strong CEF to make these projects happen, because this incentive is the strongest instrument we have. Thank you.
Johan Danielsson
Thank you very much. Now I will give the floor to Miss Tottenbaum to answer the questions from the members.
Speaker 30
Thank you very much. And I will start with the first question concerning the cross border and also the twenty year delays in the Basque region, like as you have said. Well, actually, if you ask the reasons behind, we always see some reasons coming back. That is, first of all, a weak cost-benefit analysis. That is the stakeholders' involvement that is quite weak.
We wrote on that also a review where we compared the big projects in Europe with, for example, how they deal with it in Canada, in the US, and also in Switzerland. And there we see, for example, in Switzerland, saw that once they make an agreement with the stakeholders, they make more time for it. But once they have an agreement, they go faster. So that stakeholder involvement, the weak cost-benefit analysis, and then also the changes in the scope. Of course, we work with the projects as they are introduced at a level and approved at the level of the European Commission.
Of course, if later on that is the case, for example, in the Real Baltica, one of the remarks in the Real Baltica is that there is a change of the scope. But, of course, we work with the data as they are existing, and we compare with the projects as they have been introduced. Also in box one, you can see and that's also an answer to you on the Real Baltica because in Box one, we explain really quite extensive what are the problems in the Real Baltica. And there, it was, for example, the lack of maturity, the changes in the project scope, and the design. And important to notice is that there is also a joint report of the three Baltic national audit institutions.
He also made a report on the Real Baltica. And this report no longer than one month ago, I presented also to the National Parliament, in addition to what the three supreme audit institutions also said. But the three remarks of three supreme audit institutions are actually in line with our remarks and with our findings that we do have. But you see also on the real Baltica, there are problems where there is the promoter highlighted risk that the new estimate might still not be fully accurate as there were mature design studies for only one third. So, of course, if you measure a cost and not a delay, but a period of building it, but you only have mature studies for one third of the project, then, of course, you might miss the target in the delays, and you might also have a lot of cost overruns.
On your three questions, first of all, well, why inflation? We ruled out inflation. As we write in our paragraph three, I think, of our report where we highlight also what you highlighted in your question is the fact that since 2020, there is the COVID nineteen. There is the Russia's war of aggression against Ukraine, and the eight TFIs faced the same challenges as well as needing to adapt to the evolving regulatory framework that you also highlighted in your second questions, but they were also subject to unexpected technical challenges such as geological constraints in excavation of tunnels, which contributed to additional costs and delay. But in our cost estimate, we ruled out inflation, which is quite logical because that was actually very unexpected.
When you ask in your second question about the new governance framework will increase the cost, that was not included in this report because the new governance framework will only be applicable for new projects. And these are actually already ongoing projects. That's the reason why we did not introduce it. On, it's true in our report, we only looked at the Spanish side of the Basque, but we are very well aware of the challenges also at the French side. And as someone else highlighted on the cross border, as you also highlighted on the cross border aspect, of course, it doesn't make any sense to do something well at one side of a border and not do it well at the other side of the border.
That actually goes without saying. On your question about the real Baltica, I think I already answered that question. And then your question on the new TNT regulation, actually, and what should be done better. I think the new 10 t regulation gives quite already an answer to some challenges that there are in the sense, it brings more, it puts more the member states together for the planning, which I think is a good thing. The also more including the access lines because, again, it doesn't have any sense to build the tunnel and not having the access lines in the planning itself.
On the new stuff, we don't have an opinion. We haven't produced an opinion, so I cannot answer that question because we don't have a report of it. But in summary, the new TNT regulation, as the commission has designed it, will be an improvement. But of course, for ongoing projects, it will not be applicable for the ongoing projects, but only for the new projects that are there.
Johan Danielsson
Thank you very much. Thank you for the insights to the report, but also clear answers and explanations to members' questions. Me, we, the Transport Committee, are really looking forward to continue the cooperation that we have with European Court of Governors and see you back in this committee again. So thank you very much for being here today. The members, this leaves us to the end of our meeting.
So I would only have to inform you to note that the next meeting will take place on April 8, and the meeting that was first originally scheduled for April 9 will not take place. So with this said, many thanks to all the participants, interpreters, ushers, technicians, and try to have a nice evening. Thank you.
Ask anything about this video — I analyse its transcript to answer.