1 European Security Standardisation in relation to ABC Paolo Salieri DG Enterprise and Industry FRONTEX 8 th2nd Global Conference and Exhibition on Future.

1

European Security

Standardisationin relation to ABC

Paolo SalieriDG Enterprise and Industry

FRONTEX 8th2nd Global Conference and Exhibition on Future Developments of

Automated Border Control 10-11 October 2013

Communication on the Security Industrial Policy – COM(2012)417

Action Plan for an innovative and competitive Security Industry

Objectives:

• Overcoming the fragmentation of the EU security market

• Reducing the gap from research to market

• Better integration of the societal dimension

2

A role for technical standardisation in security

To increase the harmonisation in the European security market and reduce fragmentation by the creation of a set of comprehensive European standards.  To enhance secure interoperable communications and data management between the various security control centres, operators, public authorities and first responders.  To develop common technical specifications concerning interoperability, quality (privacy by design) or safety levels, including test methods and certification requirements.  To provide interoperability and comparability of different solutions, which in turn facilitate competition and innovation.  To develop methods for security vulnerability assessment by security system operators.  To allow companies the opportunity to develop tailor-made and cost beneficial security measures in agreement with the EU security strategy.

3

The Action Plan (excerpt)

• ESOs to establish standardisation roadmaps in the areas of CBRNE, border security, crisis management/civil protection

• EC to propose legislation on EU-wide harmonised certification systems for airport screening equipment

and alarm systems

• EC to issue standardisation mandates to ESOs for 'hybrid standards' (applicable to civil security & defence, e.g. on Software Defined Radio - SDR)

4

Action on Standardization

Mandate M/487 (COM(2012)417) was performed to analyse the existing security standardization landscape, select priorities and develop standardization roadmaps for three selected sectors to support the EU industrial policy on security.

- Chemical, Biological, Radiological, Nuclear and Explosives (CBRNE);

- Border Security – automated border control systems (ABC), as well as biometric identifiers;-WHY: Instrument for a (not just industrial) security policy (SMART BORDER package) aimed also at facilitating travel thus boosting economy-Industry is competitive-Market potential exist but with risk of fragmentation

- Crisis Management/Civil Protection –communication interoperability and interoperability of command and control, including organizational interoperability, as well as mass notification of the population. 5

Programming Mandate M/487

6

Programming Mandate M/487, coordinated by CEN/TC 391

- M/487 coordination group (Chair Mr. Joost Cornet)

- JWG M/487, secretariat NEN

- CEN Programme Manager

- M/487 project experts (border sec.: Mr. Chris Hurrey)

Balanced participation of stakeholders in this process, coming from security industry (including SME’s), research institutes, end users, consultants, standard experts and local, national and international authorities.

Issues to be tackled in ABC

Automated Border Control (ABC) is likely to become a permanent feature at many passport controls in Europe and worldwide by the end of this decade. However:

•Need to shape the view on what is meant by "ABC" in the context of standardisation – the gate, a system, an operational concept ...?

•Standardisation vs. harmonisation / exchange of best practices / guidelines (and who is doing what)

•Where are the gaps in the standardisation landscape? A lot is on-going on ABC and biometrics at ISO, and on document readers at ICAO

7

Aspirations in the context of European automated border control (ABC)

Commonality of technical standards for the components so that operators know exactly what they are purchasing and how it will perform; Commonality of the ‘look and feel’ of ABC systems so that passengers intuitively know how to use different systems; Commonality of standards for the operators’ interface so that border agency staff are protected from stress and physical strain.

8

Why standards are not yet fully established within the ABC area (in Europe)

Customers are not aware of them and therefore do not insert them into system requirements, or mandate them in procurement requirements;  Suppliers and integrators do not yet see advantage in formally complying with standards because customers do not ask for them;  Some standards and recommended practices are not yet out of drafting phase;  Some excellent and relevant ABC guidance (e.g. those developed by Frontex) does not have ‘standard’ status, and these guidelines require additional resources to transfer into international standards;  When quoted in specifications or procurements, the requirement to adhere to a particular standard is stated in general terms without an indication of which parts are relevant; The absence of biometric standards profiles relevant to ABC systems.

• 

9

Likely advantages of common standards for ABC

They provide a common reference point for discussions between parties about safety, performance and quality;  The need for extensive evaluation is reduced as conformance with documented specification can be assured;  ABC systems in the same geo-political area are more likely to be common, compatible and interoperable;  Certification and quality control can be formalised to ensure continuing performance; Requirements gathering and procurement should be quicker and cheaper and products can be more ‘off the shelf’ than at present; The insistence compliance to standards by procuring authorities leads to a rise in quality of systems and their delivery and use.

10

A number of ‘components’ make up a working ABC system, most of which can be subject to standards

PassengersSupervising border agency staffOperational and fallback proceduresEligibility rulesUser familiarisationTravel documents and tokensTravel document data capture devicesBiometric capture devicesBiometric matching techniquesBarrier mechanisms and sensorsSystem logicData interfacesBusiness case, societal issues and system design methodology

11

Missing standards, Gaps found

Standards and recommended practices for passenger and operator health and safety in automated border control systems.Data protection and privacy.Passenger education and familiarisation.Performance testing of ABC – standard methods of timing transactions, assessing biometric decision thresholdsEffective certification of ABC systems. Performance of individual gates as a result of environmental aspects (ambient light, temperature, humidity etc.).Standards for performance to be checked and systems certified as compliant. Accessibility for less-abled passengers.Anti-evasion, anti-spoofing and security sensors.A standard set of specifications to allow certification of ABC systems (and of all security elements integrated into an e-gate).Standards and recommended practices for border guard monitoring of ABC systems.Common functionality for ABC – data exploitation, watch-lists etc., document examinationStandards or recommended practices for business cases, project management methodology for ABC systems to enable faster, less risky procurement and implementation.Security of ABC systems against hacking, infiltration and corrupt practices Travel document issue procedures and standards, registered traveller enrolment.12

Outcome of M/487

EC to draft in 2014 Standardisation Mandates to EOS (if / where appropriate) after consultation with stakeholders (DG HOME, FRONTEX, CEN/TC 224 and /TC 391..)

• Assessment of the feasibility of proposals in the context of policy setting (smart borders regulation)

• Indication of short-, mid- and long-term standardisation needs/opportunities

• Assessment of expected impact of proposed actions (EU-added value, competitiveness of EU security industry, improved cross-border collaboration, …)

Which standards? European Standards, Workshop Agreements (CWA), Technical Specifications (CEN /TS) ?

13

14

Contact

Paolo SalieriDG Enterprise and IndustryPolicy and Research in SecurityPhone +32 2 29 62951Email: [email protected]

Website:http://ec.europa.eu/enterprise/policies/security/index_en.htm