In the field of communications security, several actions were undertaken during 2010, as outlined below.
Technical advice with respect to E112
ICP-ANACOM held a meeting on locating calls originating on mobile networks, taking place in the 112.pt Centro Operacional Sul (South Operations Centre) with the presence of the operators involved. In addition to the onsite observation, a way was put forward to improve this feature in the light of obtained experience.
A such the requests for assistance submitted to ICP-ANACOM were satisfied and work was begun with operators and entities responsible for emergency services to bring about ongoing improvements to location accuracy and reliability with respect to mobile calls to the 112 European single emergency number, taking into account the regulatory change in line with the new regulatory package.
Sub-registry
In 2010, the necessary actions were developed with the Autoridade Nacional de Segurança (National Security Authority) to provide ICP-ANACOM's sub-registry with an electronic information security system, the exchange of classified material between Agência Nacional de Distribuição (National Distribution Agency) and the sub-registry by electronic means, allowing a streamlining of the process. This is due to implemented shortly.
In parallel, a process was undertaken to accredit the employees of ICP-ANACOM involved, who attended the Curso Geral de Segurança de Matérias Classificadas (General Course on Security of Classified Matters) at the Gabinete Nacional de Segurança (National Security Office).
Communications security exercise
On 4 November 2010, ICP-ANACOM participated in the first pan-European exercise, "Cyber Europe 2010", included in the European Action Plan for communications security (Commission Communication to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions on the protection of critical infrastructure information - "Protecting Europe from large scale cyber-attacks and disruptions: enhancing preparedness, security and resilience", COM (2009) 149 final of 30 March 2009).
This exercise saw participation by 30 European countries (22 participating actively in the exercise and 8 as observers) and was organized by seven Member States of the Union with the joint support of the European Network and Information Security Agency (ENISA) and the EU Joint Research Centre; it involved about 70 public agencies.
Portuguese participation in the planning exercise was led by ICP-ANACOM, which also provided national representation in the European central cell. Nationally, ICP-ANACOM established and coordinated the national cell, with participation during the exercise involving Fundação para a Computação Científica Nacional (Foundation for National Scientific Computing). Meanwhile, at a national level, the following participated as observers: Gabinete Nacional de Segurança (National Security Office), CEGER - Centro de Gestão da Rede Informática do Governo (Government Information Network Management Centre), Serviço de Informações da República Portuguesa (Information Service of the Portuguese Republic), Sistema de Segurança Interna (Internal Security System), Conselho Nacional de Planeamento Civil de Emergência (National Council for Civil Emergency Planning) and Autoridade Nacional de Protecção Civil (National Authority for Civil Protection), which also took part in the preparation and concluding works of the exercise.
In their provisional findings, the participants of the EU Member States considered that the "cyber-stress test" was useful for the public authorities involved and there was interest in pursuing this type of exercise, focusing in future years on: the creation of a pan-European contingency plan to respond to cyber incidents and other large-scale events; wider participation of the private sector; and the exchange of lessons learned with other national or international exercises.
Applicational system for notification of failures
During 2010 an analysis was made of the legal framework that will govern this initiative; it was concluded that it was fitting to wait for the publication of changes to the regulatory framework, entering into force in May 2011.
