Regulatory Impact on 5G Security and Privacy 417
In that assessment, Options 1 and 3 are not considered viable for reaching the
policy objectives, and are therefore not recommended. The reasons not to recommend are that their effectiveness would depend on whether the voluntary approach
would actually deliver a minimum level of NIS and, regarding Option 3, it would
depend on the good will of the Member States to set up capabilities and co‐operate
cross border.
Option 2 is the preferred one, given that under this Option the protection of EU
consumers, business and Governments against NIS incidents, threats and risks would
improve considerably. The analysis supports the Impact Assessment of the NIS
Directive: Government regulation that would best promote the targets for Security
and Privacy.
The technology (Clouds, NFV and SDN) implications on Security and Privacy regulations can be summarized as (in a random order):
● New technologies will allow new types of market structures with new types of players in the telecommunications value chain. Different players have different views,
practices and objectives for securing Security and Privacy. The responsibilities and
accountabilities for securing end‐to‐end Security and Privacy, and the ownership
rights over the data, have to be clearly and firmly defined across country borders;
● Due to the de‐centralized architecture of the Clouds‐based implementations, the
protection mechanisms are likely to be inconsistent. Regulators have to push for the
consistent systems with respect to Security and Privacy;
● Due to the de‐centralized nature of architecture (Clouds, Virtualization) the user
related data may be located where‐ever. In this new, more complicated environment,
the governments have to also enforce the rule for “right to be forgotten”;
● A loss of governance may lead to a Service Provider lock‐in (one kind of loss of
Security). Regulators need to take action to foster interoperability and data
portability;
● Balancing of interests in protecting Security and Privacy, on the one hand, and fostering EU‐wide (and global) services, on the other hand, shall be agreed at least at the EU
level. However, different levels of Privacy may be difficult to regulate;
● The new Security and Privacy issues in the context of new technologies are more of a
global nature than ever before, and EU‐wide (global) approaches are needed in
Regulation. EU‐wide standards and practices are also needed. This is also important
for enabling new entries to the market. The location of legal disputes has to be clear
and agreed.
References
1 Security in Telecommunications and Information Technology (2003) ITU‐T. Available
at: http://www.itu.int/itudoc/itu‐t/85097.pdf
2 ITU‐T Recommendation X.805 (2003) Security architecture for systems providing end‐to‐
end communications. Available at: http://www.itu.int/rec/T‐REC‐X.805‐200310‐I/en
3 Telecoms Council, Brussels (2009) 31 March 2009. Available at: http://europa.eu/rapid/
pressReleasesAction.do?reference = MEMO/09/139&format = HTML&aged = 0&language =
EN&guiLanguage = en/
In that assessment, Options 1 and 3 are not considered viable for reaching the
policy objectives, and are therefore not recommended. The reasons not to recommend are that their effectiveness would depend on whether the voluntary approach
would actually deliver a minimum level of NIS and, regarding Option 3, it would
depend on the good will of the Member States to set up capabilities and co‐operate
cross border.
Option 2 is the preferred one, given that under this Option the protection of EU
consumers, business and Governments against NIS incidents, threats and risks would
improve considerably. The analysis supports the Impact Assessment of the NIS
Directive: Government regulation that would best promote the targets for Security
and Privacy.
The technology (Clouds, NFV and SDN) implications on Security and Privacy regulations can be summarized as (in a random order):
● New technologies will allow new types of market structures with new types of players in the telecommunications value chain. Different players have different views,
practices and objectives for securing Security and Privacy. The responsibilities and
accountabilities for securing end‐to‐end Security and Privacy, and the ownership
rights over the data, have to be clearly and firmly defined across country borders;
● Due to the de‐centralized architecture of the Clouds‐based implementations, the
protection mechanisms are likely to be inconsistent. Regulators have to push for the
consistent systems with respect to Security and Privacy;
● Due to the de‐centralized nature of architecture (Clouds, Virtualization) the user
related data may be located where‐ever. In this new, more complicated environment,
the governments have to also enforce the rule for “right to be forgotten”;
● A loss of governance may lead to a Service Provider lock‐in (one kind of loss of
Security). Regulators need to take action to foster interoperability and data
portability;
● Balancing of interests in protecting Security and Privacy, on the one hand, and fostering EU‐wide (and global) services, on the other hand, shall be agreed at least at the EU
level. However, different levels of Privacy may be difficult to regulate;
● The new Security and Privacy issues in the context of new technologies are more of a
global nature than ever before, and EU‐wide (global) approaches are needed in
Regulation. EU‐wide standards and practices are also needed. This is also important
for enabling new entries to the market. The location of legal disputes has to be clear
and agreed.
References
1 Security in Telecommunications and Information Technology (2003) ITU‐T. Available
at: http://www.itu.int/itudoc/itu‐t/85097.pdf
2 ITU‐T Recommendation X.805 (2003) Security architecture for systems providing end‐to‐
end communications. Available at: http://www.itu.int/rec/T‐REC‐X.805‐200310‐I/en
3 Telecoms Council, Brussels (2009) 31 March 2009. Available at: http://europa.eu/rapid/
pressReleasesAction.do?reference = MEMO/09/139&format = HTML&aged = 0&language =
EN&guiLanguage = en/