Regulation of critical infrastructure (CI) is in vogue; and accordingly every government presently develops legal governance regimes. In this paper, I try to analyse some of the present efforts to identify and govern CI. I argue that while the legal definitions introduced contribute little to the actual identification of critical infrastructure, they alter the responsibility and modus operandi of the identification. Political discretion is re-organized into administrative decisions. By relying on similar observations from risk sociology, I set out to criticize the present implementation for masking the hard political choices inherent in the work with CI, and thereby creating a dysfunctional governance regime for the protection of CI.

Critical infrastructure (CI) sees to assets that are essential for the functioning of a society and economy, as they provide public services, enhance quality of life, sustain private profits and spur economic growth. Assets of CI differ considerably, ranging from hardware such as cables and wires, through to networks for the generation and supply of energy sources. Critical infrastructures encompass many sectors of the economy, such as banking and finance, transport and distribution, energy, utilities, health, food supply and communications, aswell as key government services.

This article addresses conceptional components of national strategies on critical infrastructure protection (CIP). In particular, it focuses on the Swiss CIP programme and its strategic components. As in other countries, Switzerland divides its national infrastructure into critical sectors, but rather distinctively it subdivides them into critical subsectors and even lists specific critical infrastructure objects in a classified inventory. The article stresses the importance of a pragmatic public private partnership in further strengthening the CI's resiliency, but also argues for a more explicit legal foundation to provide some clearer guidelines in this evolving field of collaboration.

The process risk allocation is essential for effective PPP contracts, depending on the scope of defined tasks and responsibilities between the parties in their quest to deliver public services. However, risk in critical infrastructure is sui generis risk which could not be treated contractually and transferred by the public sector to the private sector or retained by the party to an arrangement which is suited best to borne such risks.

Risk in critical infrastructure, being either internal or external, is endemic to the relevant services andwhen critical infrastructure is delivered by public-private partnerships or owned by private actors, the treatment of such risk merits a third-party approach. Such third-party could be an industry in itself, such as insurance, re-insurance or hedge fund insurance bond finance, or a sector / industry approach which related to the owners/operators of the relevant infrastructure, by means of collective apportioning and mitigation of risks associated with the failure of providing services fromsuch infrastructure. The most innovative way of treating risk of critical infrastructure remains in the discretion of EU Member States, in the form of integrating costs related to risk assessment and security measurers to protect critical infrastructure into tariff arrangements of relevant services. In such manner, the enduser / consumer of services ensures and collectively insures their delivery against any type of risk which is not quantified and determined as part of corporate arrangements between the state and the private sector provider of services.

This article focuses on the information requirements of public and private stakeholders engaged in critical infrastructure protection (CIP).With its emphasis on information management rather than information sharing, the article builds on existing research suggesting that the notion of information sharing inadvertently renders cooperation more difficult as it evokes impressions of information “dominance” rather than joint information ownership. The article proposes a joint public-private information management agenda based on core issues providing actionable information to tackle immediate threats and crosscutting issues looking at the long-term issues that are relevant to understand the overall context in which critical infrastructure development occurs.

Most European countries’ constitutional obligations guarantee and protect public security and fundamental rights. One aspect and often a prerequisite for the protection of public security and individual rights is the protection of critical infrastructure (CIP). CIP is of great importance in Switzerland, which is inevitable in an economically and technologically sophisticated and densely populated country.

Private liability can potentially play a crucial role in protecting critical infrastructure. Traditional liability rules will especially play their deterrent and therefore preventive effect in the case of so-called man-made “technological” disasters. By using a strict liability role and by providing solvency guarantees potential tort-feasors can be provided with incentives to take optimal preventivemeasures.However, the case of nuclear accidents, addressed inmore detail, makes clear that in practice those efficient liability rules that would be needed to generate this preventive effect are often not implemented at the legislative level. The legislator rather imposes financial limits on liability and provides for public funding, thus effectively granting a subsidy to operators. Those type of inefficient rules laid down in international conventions are obviously often the result of interest group politics.

As far as natural disasters are concerned liability rules can play less of a role given the fact that those are considered an “act of God”. One could then only consider public authority liability.However, this is not often accepted in practice and there may also be theoretical reasons to be careful with the imposition of public authority liability. Public authorities are multitask agents which need a substantial amount of discretion. That explains that many legal systems award (partial) immunity from liability to public authorities. This leads generally to the conclusion that although liability rules can play a role in the protection of critical infrastructure those rules may have important limits as well. As a result the primary instrument to protect critical infrastructure will in practice often be safety regulation rather than liability rules.

Critical Infrastructure (CI) provision is characterized by privatization of CI providers, transnational risks and a changing role of the state. We describe two paradigmatic systems of state liability with a view to CI liability, namely Germany as a fault system and Switzerland as a strict liability system. Both are unsatisfactory and not well adapted to the modern realities and exigencies of allocation of risks and liability in CI and show flaws from a functional, incentive-based perspective. Therefore, we make suggestions how those systems may be ameliorated, suggesting organizational, design and supervisory liability reforms.

This article is a critical reflection on the manifoldness of the notion of “partnership” in Critical Infrastructure Protection. It is argued that the partnership arrangement can be a promising political approach to CIP if the details of public-private cooperation – that is: the participants, the duration, the responsibilities and duties, as well as possible financial compensation – are formalized. Illusionary ideas of a “partner-like” relationship between the public and the private, such as those laid down in the German “National Strategy for Critical Infrastructure Protection”, are, however, doomed to fail. State authorities have to actively offer binding regulatory arrangements to private CI firms in order to establish which companies genuinely agree to cooperate – and which do not. Due to the state's constitutional obligation to guarantee national security and protect the life and health of its citizens, introducing legal requirements is the only possible reaction to a company's refusal to cooperate. In order to avoid overly intrusive market intervention, the state's offer to private firms or their industry associations to conclude binding regulatory contracts on CIP matters may serve as a promising compromise between a laissez-faire approach and regulation.

With respect to critical information and communication technologies (ICT), nations most often declare their national critical infrastructure to include telecommunication services and in some cases critical services offered by key Internet Service Providers (ISP). This paper debates whether nations, their policy-makers, legislation and regulation largely overlook and fail to properly govern the full set of ICT elements and services critical to the functioning of their nation. The related societal and economical risk, however, needs to be closely mitigated, managed and governed. Legal and regulatory obligations to increase the ICT resilience may sometimes encourage this process.

The risks of technological accidents in the energy sector and their potentially disastrous effects have been analyzed over the past decades, and are nowadays generally recognized to constitute a key factor in an encompassing assessment of energy security. In contrast, the issue of intentional attacks on energy infrastructures has received increased attentionmore recently, particularly due to growing dependence of energy imports fromand transit routes through regions considered less reliable and politically stable. Both types of risks, however, illuminate different vulnerabilities. Therefore, the focus of the present analysis was on these two risk categories: accidents and intentional attacks in the energy sector. Risk assessment resultswere based on quantitative data from the databases ENSAD (Energy-related Severe Accident Database) and EIAD (Energy Infrastructure Attack Database). Evaluations examined similarities and differences between technological accidents and intentional attacks in terms of frequencies and consequences, considering time-series trends and regional patterns. A key difference is that accidents are typically rare and independent events, whereas intentional attacks are often multiple events and concentrated both in time and space, resulting in distinct hotspots. Concerning consequences, the severity distribution for accidents generally stretches over a broad range, with low-probability high-consequence events being an important factor of both energy chain performance and as a measure of risk aversion. On the other hand, these types of consequences are usually less important for intentional attacks because targeted energy infrastructures are often of “linear” nature (e.g. pipelines and transmission lines) that are difficult to protect and usually lead through remote areas with low population density. However, when frequently attacked substantial business and supply disruptions can occur. In summary, the joint analysis of accidents and intentional attacks provides a comprehensive and complementary approach on two types of risks that have rather different properties, but are essential in an energy security perspective.

This report addresses the legal concept of “self-evident” and “flagrantly misleading” advertising established in Article 7(1)(c) of Regulation (EU) No 1169/2011 of the European Parliament and of the Council of 25 October 2011 on the provision of food information to consumers (hereinafter, the Food Information Regulation, FIR). Since 13 December 2014 (since the specific origin of vegetable oils must be declared), “palm oil-free” claims on, e.g., a product containing sunflower oil or any other vegetable oil (and mandatorily indicating it in the list of ingredients) are arguably obvious, unnecessary and irrelevant (and in legal terms “selfevident” and “flagrantlymisleading”). Compared to similar foods that possess the same characteristics, but do not claim to be “palm oil-free”, these products are in no way “special”.

The report aims to illustrate how weakening of the statehood is reflected in the way EU and its member-states manage obesity epidemics. Private interests and behavioural turn in policy mechanisms call for more state involvement and rigorous democratic deliberation not only of nudges coming from the state, but those coming from the industry as well. The potential of nudging does not lie in the behavioural interventions it is capable of producing, but rather in the discourse it kick-started, as behavioural law and economics are paving their way into policy-making.

Case C-404/13, The Queen, on the application of Client Earth v Secretary of State for the Environment, Food and Rural Affairs EU:C:2014:2382, OJ C – 26 of 26.1.2015, p. 6.

When a Member State finds that the limit values cannot be respected before the deadline fixed by the Air Quality Directive and wishes to postpone that deadline for a maximum of five years, that Member State is required to make an application for the postponement of the deadline by drawing up an air quality plan demonstrating how those limits will be met before the new deadline (official headnote).

Judgment of the Court (Fourth Chamber) of 5 March 2015 In Joined Cases C-503/13 and C-504/13, preliminary ruling in the proceedings Boston ScientificMedizintechnik GmbH v AOK Sachsen-Anhalt — Die Gesundheitskasse (C-503/13), Betriebskrankenkasse RWE (C-504/13)

On 5 March 2015, the European Court of Justice issued a preliminary ruling on two issues arising under the EU Product Liability Directive, which imposes objective, no-fault or strict liability, but not absolute liability, for defective products. Despite the wide range of issues arising under this directive, the Court has had only a few occasions to construe its ambiguous terms. This case, however, provided an opportunity to the Court to settle key issues relating to the defect test and the scope of damages compensable under the directive. As in other civil law cases, the question arises whether the Court's light treatment will provide a sound basis for the further development of product liability in Europe. The Court did not answer the questions posed by the referring court, but in some respects went beyond these questions and in other respects avoided the difficult issues raised thereby. As discussed in this note, the Court paints with a broad brush, and the test set forth in its judgment to determine whether a product is defective, may itself be defective.

Case C-658/11, European Parliament v Council of the European Union [2014] (not yet reported)

CFSP acts can be challenged before the Courtwhen the arguments relate to procedural points outside of the CFSP articles in Title V TEU. The Court can annul Council CFSP acts when the proper notification procedures to the Parliament stemming from Article 218 TFEU have not been followed. The effects of CFSP acts can remain in place, even after the Court annuls them, until such a time when the act has been replaced.