COUNCIL DECISION (CFSP) 2021/698

of 30 April 2021

on the security of systems and services deployed, operated and used under the Union Space Programme which may affect the security of the Union, and repealing Decision 2014/496/CFSP

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on European Union, and in particular Article 28 thereof,

Having regard to the proposal from the High Representative of the Union for Foreign Affairs and Security Policy,

Whereas

(1) In view, in particular, of its strategic dimension, regional and global coverage and multiple usage, the European Global Navigation Satellite System (GNSS) constitutes sensitive infrastructure the deployment and usage of which are susceptible to affect the security of the Union and its Member States.

(2) Where the international situation requires operational action by the Union and where the operation of the GNSS could affect the security of the Union or its Member States, or in the event of a threat to the operation of the GNSS, the Council should decide on the necessary measures to be taken.

(3) For this reason, the Council adopted Decision 2014/496/CFSP (1).

(4) Regulation (EU) 2021/696 of the European Parliament and of the Council (2) establishes the Union Space Programme (the ‘Programme’) and the European Union Agency for the Space Programme (the ‘Agency’). Article 3 thereof provides that the Programme consists of five components: a global navigation satellite system (Galileo); a regional satellite navigation system (EGNOS); an Earth observation system (Copernicus); a space surveillance and tracking system complemented by observational parameters related to space weather and near-Earth objects (‘space situational awareness’); and a satellite communications service (GOVSATCOM).

(5) Space technology, data and services have become indispensable to the daily lives of Europeans and play an essential role in preserving many strategic interests of the Union and its Member States. In addition, space-related systems and services themselves are potential targets for security threats.

(6) A range of potential threats to the security and the essential interests of the Union and of its Member States could arise from the deployment, operation and use of each of the components of the Programme. It is therefore appropriate to extend the scope of Decision 2014/496/CFSP to the systems and services set up under those components that have been determined as security-sensitive by the security configuration of the committee established under Article 107(1)(e) of Regulation (EU) 2021/696 and taking into account the differences between the components of the Programme, in particular as regards Member States’ authority and control over sensors, systems or other capacities relevant to the Programme.

(7) Lessons have been drawn from the experience acquired in implementing Decision 2014/496/CFSP in recent years. The operational procedure foreseen in Decision 2014/496/CFSP should therefore be adapted accordingly.

(8) Information and expertise concerning whether an event related to a space-related system or service constitutes a threat to the Union, to the Member States or to the space-related systems and services should be provided to the Council and to the High Representative of the Union for Foreign Affairs and Security Policy (the ‘High Representative’) by the Agency or by the relevant structure designated, where appropriate, to monitor the security of a system set up, or a service provided, under a component of the Programme pursuant to Article 34(4) of Regulation (EU) 2021/696 (‘appointed security monitoring structure’), or by Member States or by the European Commission. In addition, third States may also provide such information.

(9) The respective roles of the Council, the High Representative, the Agency, any appointed security monitoring structure and the Member States should be clarified within the chain of operational responsibilities to be set up in order to react to a threat to the Union, to the Member States or to any of the systems and services set up under the Programme.

(10) Article 28 of Regulation (EU) 2021/696 establishes that the Commission has overall responsibility for the implementation of the Programme, including in the field of security. This Decision should define the responsibilities of the Council and of the High Representative to avert threats arising from the deployment, operation and use of space-related systems and services, or in the event of a threat to those systems or services.

(11) In this regard, the basic references to threats are contained in the System-specific Security Requirement Statements which contain the main generic threats to be addressed by each component of the Programme, and the respective System Security Plans which include the security risk registers set up in the security accreditation processes for each component. Those basic references will serve as references to identify the threats specifically to be dealt with by this Decision and to complete the operational procedures for the implementation of this Decision.

(12) In urgent cases, decisions may have to be taken within a few hours of receipt of information concerning a threat. If the circumstances do not allow for the Council to take a decision in order to avert a threat or to mitigate serious harm to the essential interests of the Union or of one or more of its Member States, or in the event of a threat to the space-related systems or services, the High Representative should be empowered to issue the necessary provisional instructions. In such circumstances, the Council should be informed immediately and review the provisional instructions as soon as possible.

(13) In accordance with Article 34(5)(b) of Regulation (EU) 2021/696, the Agency, within its area of responsibility, should ensure the operation of the Galileo Security Monitoring Centre (GSMC) in accordance with the requirements referred to in paragraph 2 of that Article and the instructions developed under the scope of this Decision. In accordance with Article 79(1)(j) of Regulation (EU) 2021/696, the Agency’s Executive Director should ensure that the Agency, as the operator of the GSMC, is able to respond to instructions provided under this Decision.

(14) The relevant appointed security monitoring structures should operate in accordance with the security requirements referred to in the first subparagraph of Article 34(2) of Regulation (EU) 2021/696 and with the instructions developed under this Decision.

(15) In addition, Decision No 1104/2011/EU of the European Parliament and of the Council (3) lays down the rules under which the Member States, the Council, the Commission, the European External Action Service, Union agencies, third States and international organisations may access the public regulated service provided by the global navigation satellite system established under the Galileo programme. In particular, Article 6 of Decision No 1104/2011/EU states that the GSMC provides the operational interface between the competent public regulated service authorities, the Council and the High Representative and the control centres,

HAS ADOPTED THIS DECISION:

Article 1

1.   This Decision sets out the responsibilities to be exercised by the Council and the High Representative:

(a) to avert a threat to the security of the Union or of one or more of its Member States or to mitigate serious harm to the essential interests of the Union or of one or more of its Member States arising from the deployment, operation or use of the systems set up and services provided under the components of the Union Space Programme (the ‘Programme’); or

(b) in the event of a threat to the operation of any of those systems or the provision of those services.

2.   In the implementation of this Decision, due account shall be given to the differences between the components of the Programme, in particular as regards Member States’ authority and control over sensors, systems or other capacities relevant to the Programme.

Article 2

1.   In the event of such a threat, the Member States, the Commission, the European Union Agency for the Space Programme (the ‘Agency’) or any security monitoring structure appointed in accordance with Article 34(4) of Regulation (EU) 2021/696 (‘appointed security monitoring structure’), as appropriate, shall immediately inform the High Representative of all the elements at their disposal which they consider relevant.

2.   The High Representative shall immediately inform the Council of the threat and of its potential impact on the security of the Union or of one or more of its Member States and on the operation of the systems or the provision of the services concerned.

Article 3

1.   The Council, acting unanimously upon a proposal from the High Representative, shall decide on the necessary instructions to the Agency or to any appointed security monitoring structure, as appropriate.

2.   The Agency or the relevant appointed security monitoring structure and the Commission shall provide advice to the High Representative on the likely wider impact on the systems set up and services provided under the components of the Programme of any instructions which the High Representative intends to propose to the Council pursuant to paragraph 1.

3.   The proposal from the High Representative referred to in paragraph 1 shall include an impact assessment of the proposed instructions.

4.   The Political and Security Committee (PSC) shall provide an opinion to the Council on any instructions proposed, as appropriate.

Article 4

1.   If the urgency of the situation requires immediate action to be taken before the Council has taken a decision under Article 3(1), the High Representative is authorised to issue the necessary provisional instructions to the Agency or to the relevant appointed security monitoring structure. The High Representative may direct the Secretary-General of the European External Action Service to issue such instructions to the Agency or to the relevant appointed security monitoring structure on the High Representative’s behalf.

2.   The High Representative shall immediately inform the Council and the Commission of any instructions issued pursuant to paragraph 1.

3.   The Council shall confirm, modify or revoke the provisional instructions of the High Representative as soon as possible.

4.   The High Representative shall keep those provisional instructions under constant review, amend them as appropriate or revoke them if immediate action is no longer required. In any event, the provisional instructions shall expire four weeks after being issued, or upon a decision by the Council pursuant to paragraph 3.

Article 5

1.   Within a year after the security configuration of the committee established under Article 107(1)(e) of Regulation (EU) 2021/696 has determined, on the basis of the risk and threat analysis performed by the Commission pursuant to Article 34(2) of Regulation (EU) 2021/696, under the procedure referred to in Article 107(3) thereof, whether a system set up or a service provided, or both, under a particular component of the Programme is security-sensitive, the High Representative shall prepare, and submit for approval to the PSC, the necessary operational procedures for the practical implementation of the provisions set out in this Decision as regards the system or service concerned, or both. For that purpose, the High Representative shall be supported by experts from Member States, the Commission, the Agency and the relevant appointed security monitoring structure, as appropriate.

2.   The operational procedures referred to in paragraph 1 may include predefined instructions to be implemented by the Agency or any relevant appointed security monitoring structure, as appropriate.

3.   The operational procedures shall be reviewed by the High Representative at least every two years, in particular as a result of a lessons-learned review process following a yearly exercise on the implementation of this Decision, or at the request of a Member State, and shall be submitted to the PSC for approval.

4.   The High Representative shall inform the PSC at least once a year on the ongoing activities carried out for the practical implementation of this Decision.

Article 6

1.   In accordance with international agreements concluded by the Union or by the Union and its Member States, including those granting access to the public regulated service pursuant to Article 3(5) of Decision No 1104/2011/EU, the High Representative shall have the authority to conclude administrative arrangements with third States concerning cooperation for the purpose of implementing this Decision. Such arrangements shall be subject to approval by the Council acting unanimously.

2.   If such arrangements require access to Union classified information, the release or exchange of classified information shall be approved in accordance with the applicable security rules.

Article 7

The Council shall review and, as necessary, amend the rules and procedures set out in this Decision no later than three years from the date of its entry into force, or at the request of a Member State.

Article 8

The Member States shall take the necessary measures to ensure the implementation of this Decision in their respective area of responsibility, in accordance with, inter alia, Article 34(6)(a) of Regulation (EU) 2021/696. For that purpose, the Member States shall designate one or more points of contact to assist in the operational management of a threat. Those points of contact may be natural or legal persons.

Article 9

Decision 2014/496/CFSP is hereby repealed.

The operational procedures developed under Decision 2014/496/CFSP as regards the Galileo system shall remain applicable until they are updated under this Decision.

Article 10

This Decision shall enter into force on the date of its publication in the

Official Journal of the European Union

.

It shall apply from 1 January 2021.

Done at Brussels, 30 April 2021.

For the Council

The President

A. P. ZACARIAS

(1)  Council Decision 2014/496/CFSP of 22 July 2014 on aspects of the deployment, operation and use of the European Global Navigation Satellite System affecting the security of the European Union and repealing Joint Action 2004/552/CFSP (

OJ L 219, 25.7.2014, p. 53

).

(2)  Regulation (EU) 2021/696 of the European Parliament and of the Council of 28 April 2021 establishing the Union Space Programme and the European Union Agency for the Space Programme and repealing Regulations (EU) No 912/2010, (EU) No 1285/2013 and (EU) No 377/2014 and Decision No 541/2014/EU (see page 69 of this Official Journal).

(3)  Decision No 1104/2011/EU of the European Parliament and of the Council of 25 October 2011 on the rules for access to the public regulated service provided by the global navigation satellite system established under the Galileo programme (

OJ L 287, 4.11.2011, p. 1

).