Critical infrastructure protection

Some state policies in Ukraine were not reformed for thirty years and thus are in dire need of fundamental changes. The success of new policies largely depends on the quality of legislation. Today we will consider in detail a draft bill addressing the fundamental issue of critical infrastructure protection.

Critical infrastructure protection

Draft bill #5219 of March 9, 2021

Status: second reading.

Who is affected: Ukrainian citizens, big business, the Cabinet, the National Bank of Ukraine, independent regulatory bodies, the Security Service of Ukraine.

Background: in the process of privatization, many infrastructure objects vital for millions of Ukrainians and important to the economy became privately owned. Some of the owners use these objects to put pressure on the authorities and society by sabotaging the work of these objects. The problem appeared because no one tried to balance the private interest of big business and public interest during the privatization.

The Constitution provisions that such a balance should be achieved: “property entails responsibility and shall not be used to the detriment of the person and society.” The owner of the property seeks profit while the interest of the society is for the owner to pay taxes and properly use the property. The bill on critical infrastructure should help to maintain the balance of these interests.

Summary of the draft bill:

– Defines the state policy on critical infrastructure protection. That includes:

• prevention of unauthorized access and interference with the work of critical infrastructure
• prevention of critical infrastructure failures, preparation of projections to prevent such failures
• establishment of a national system of critical infrastructure protection.

– Defines four levels of critical infrastructure protection management:

• state level managed by the Cabinet, the national regulatory body on critical infrastructure, the National Bank, and other independent regulators
• regional and sectoral levels managed by central and local executive bodies
• local level managed by local executive bodies and local governments
• objects’ level managed by the owners or users of critical infrastructure.

– The Cabinet and the National Bank of Ukraine will recognize objects of critical infrastructure according to the following criteria:

• the object is essential for national interests
• there are particular threats to the object
• there will be severe consequences for the population, the economy, or social sphere if the object is destroyed or damaged
• damage mitigation will take significant time if the object is destroyed or damaged
• the object is vitally important for the economy.

– Essential spheres and services important for critical infrastructure:

• electricity, heat, and water supply, sewerage
• food supply
• healthcare, chemical industry, pharmaceutics, vaccine production, and biological laboratories
• electronic communications, informational and financial services
• transportation
• governing, administrative services, defense, law enforcement, judiciary, and civil defense
• space and research.

– Creates the National Commission on Critical Infrastructure Protection that is supposed to develop and implement the state policy on critical infrastructure protection.

– Grants the investigative authority to all units of the Security Service of Ukraine, the SSU counterintelligence gets the power to protect critical infrastructure.

What is wrong:

– The approach proposed by the bill is too narrow: it treats the issue of critical infrastructure protection as the physical safety of the infrastructure and its defense in case of a military threat. The bill does not introduce a mechanism to prevent the abuse of critical infrastructure objects by their owners. According to the Constitution, though, the whole purpose of the bill should be to protect critical property in private hands. For example, electricity networks and gas pipelines.

– The bill includes the issue of the proper functioning of governmental bodies as a part of critical infrastructure protection. For example, the work of law enforcement and the judiciary. Although it is important for government bodies to work properly, this has nothing to do with critical infrastructure protection. The safety of government bodies is a separate issue that should not be regulated by this bill.

– Food security also should not be covered by the bill:

• first, Ukraine is one of the biggest exporters of basic food products, e.g. grain, poultry, and sunflower oil
• second, there is no monopoly in the agrarian sector at the moment neither with respect to land ownership or food processing industry, so there is no danger to food security from producers acting in bad faith
• third, the food security of the state is ensured by stockpiling a reserve to be used in case of bad crop, natural or technological disaster. Therefore, it is unjustified to introduce additional regulations on the matter.

– The bill extends the regulation of critical infrastructure to “informational services,” the term is defined in the Law on Information. It means the work of media that inform the population. If media are regulated by the provisions on critical infrastructure, there is a risk of censorship. It is unjustified to introduce such regulations since the state can inform its citizens via the public broadcaster without interfering with the work of private media.

– Pharmaceutics covers both the production and circulation of drugs, in particular, the work of pharmacy chains. It should not be regulated as a part of critical infrastructure since there is a large number of agents on the pharmaceutical market and the market itself is under the control of the state regulators. Even if several large pharmacy chains are closed, that will not present any danger to society or the economy since other players on the market will promptly take their place.

– Now, the issue of space has little bearing on the life and health of the Ukrainian population, the economy, and industry. Thus, it should not be considered a part of critical infrastructure. Moreover, there are already regulations on the issue of space so it should not be addressed by the bill in question.

– Research activities are not a part of critical infrastructure. Critical infrastructure includes industrial enterprises like power plants, refining and chemical companies, and objects like railway junctions, harbors, dams, gas pipelines. The issue of intellectual property protection should be addressed separately.

– The creation of the National Commission on Critical Infrastructure Protection proposed by the bill is unconstitutional. The exclusive right to create such central government bodies belongs to the Cabinet, not the Parliament. Also, it is unjustified to create a separate independent regulatory body that will address the issues of critical infrastructure protection: each sphere of critical infrastructure protection is already covered by a designated body that develops and implements state policies on the issue. For example, the Ministry of Energy and the National Commission for State Regulation of Energy and Public Utilities are responsible for the energy sector, heat and water supply, the National Bank and the Ministry of Finance are responsible for the finance sector. Thus, the creation of a new government body will only create an overlap of responsibilities.

– An independent regulatory body cannot be granted the authority to define a state policy on any issue since this is an exclusive right of the ministries.

– It is unjustified to grant investigative powers to all SSU units. Analytical and utility units of the SSU are unable to and should not conduct investigations.

– The bill does not restrict the authority of the SSU to interfere with the economy: the SSU will not deal exclusively with critical infrastructure but will be able to pressure any business it wants.

The bill lacks clear procedures for monitoring the state of critical infrastructure objects, procedures of regulating their workings by government bodies. Also, there is no conclusive list of reasons when the state can interfere with the work of private enterprises or government bodies responsible for managing critical infrastructure objects. The bill does not define sanctions. Without these regulations, government bodies will be unable to take effective measures against business entities that threaten or abuse critical infrastructure. On the other hand, the absence of clearly defined regulations can be exploited by some government bodies to interfere with the work of businesses.

Conclusion: the bill should be rejected by the Parliament or vetoed by the President. Its basic concept is flawed, many of its provisions are empty declarations, and its terminology is incongruous with other laws.