Annexes to COM(2010)633 - Progress report on the development of the second generation schengen information system (sis ii)

Please note

This page contains a limited version of this dossier in the EU Monitor.

dossier COM(2010)633 - Progress report on the development of the second generation schengen information system (sis ii).
document COM(2010)633 EN
date November  5, 2010
agreement time of three minutes. Out of the 26 844 897 queries sent during the 72 hour load test 26 834 528 (99.96%) were answered by the central system within the service level agreement time of one second (the majority of the remaining queries were answered in less than three seconds). All messages (C.U.D. and queries) received were correctly acknowledged by the central system. Over the test period the central system demonstrated that it handled an average of 100 standard queries per second and 3.3 C.U.D. transactions per second. The Commission noted throughout the first milestone period that the overall atmosphere of cooperation with Member States' experts in the framework of the GPMB during the milestone test was very fruitful.

In addition to the declaration of the successful outcome of the first milestone test, the Commission provided further input for Council deliberations by adopting, on 12 April 2010, a report on the financial and contractual aspects of developing the second generation Schengen Information System (SIS II) [1].

Accordingly, the JHA Council on 23 April 2010 decided that the development of SIS II will continue on the basis of the current SIS II project and invited the Commission to present a comprehensive global schedule for the entry into operation of SIS II to the Council at its meeting on 3-4 June 2010. This will have to be confirmed as a binding global schedule preferably by the end of July 2010 and at the latest at the Council meeting on 7-8 October 2010.

The Commission presented to the JHA Council on 3-4 June 2010 a high-level schedule for the entry into operation of SIS II which is due to be confirmed in the October JHA Council. This schedule sets a target date of the first quarter of 2013 for entry into operations.

The European Parliament was also regularly and transparently informed on the progress towards and results of the first milestone test.

2.3. Preparations for an alternative technical solution

In order to prepare the ground for a possible switch to an alternative technical scenario for implementing the SIS II functionalities, should one of the milestones be judged to have failed, bilateral discussions took place between the Commission and France with a view to a possible delegation agreement for implementing the alternative option for developing SIS II (SIS 1+RE).

The June 2009 and November 2009 Council Conclusions set out that in the event that the milestone tests demonstrate non-compliance with requirements, the Council would have two months to decide on the basis of a comprehensive financial and contractual information whether to invite the Commission to stop the current SIS II project and continue with the SIS II development on the basis of an alternative technical solution.

The French administration highlighted that the contract negotiated for the replacement of obsolete components of the current SIS 1+ (and optionally extendable for SIS 1+RE) could not be used beyond September 2010. Hence, if not activated as a result of the first milestone test, no contingency plan would be available to back the second milestone test. This point was recorded in the JHA Council Conclusions of April 2010.

A key element of any delegation to France concerned the adoption of the legislative proposals to amend the migration instruments providing the required legal flexibility for SIS II development by means of an alternative technical scenario. This was achieved on 3 June 2010 with the adoption of two Council Regulations, which entered into force on 25 June 2010 [2]. On this basis, there is ongoing will and commitment, from the Commission and France, to identify the necessary contractual arrangements to ensure a contingency scenario for the second milestone test.

2.4. Preparations for entry into operation

The refinement of requirements exercise focussed on fixing the requirements to avoid a background to the project of constantly evolving needs.

The key issue is system capacity. The original specifications anticipated the management of 15 million records, increasing over time to 22 million. Due to expansion in the number of Member States using the SIS and intensive use of the system by the competent authorities at national level, by January 2010 the existing system contained over 31 million alerts. The participants in a series of workshops agreed that the estimated size of SIS II at go-live is likely to be 52 million alerts. Accordingly, it was agreed that the system capacity at go-live should be 70 million alerts and that SIS II should be tested to a capacity of 100 million alerts, without the need for technical change.

The implications of this significant deviation from the original specifications were discussed regarding acceptable, business-oriented levels of performance in relation to queries in the system and transactions which involve creating, updating or deleting alerts. Additionally, the ability of the central SIS II to handle this greater throughput was investigated and proposals made.

Further discussions covered the priorities of end users upon switchover from the central unit to the back-up central unit should there be a major problem at the principal location housing the central SIS II. Again, the participants identified solutions set out in service level agreements.

As a result of the intensive work on requirements, on 26 May the SISVIS Committee was in a position to consider the updated system requirements and the outline of the global schedule for SIS II. The new proposed date of entry into operation of SIS II is the first quarter of 2013.

The Commission informed the Council of the new schedule at the JHA Council on 3-4 June 2010. The global schedule formed a basis for the insertion of a new expiry date (31 March 2013) to the proposal for amending the legal instruments governing transfer from SIS 1 + to SIS II (“the migration instruments”). With respect to the budgetary estimate, the Commission declared at the Council that its intention was to maintain the cost within the budgetary envelope for SIS II approved for the current financial perspectives (2007-2013).

The Commission shall achieve the remaining and final contractual coverage necessary to achieve entry into operation of the system.

It is important to note this process of refining the requirements did not modify the core obligations stemming directly from the SIS II legal instruments.

2.5. Preparations for migration

The Council Regulation [3] and Council Decision [4] governing migration from SIS 1+ to SIS II (the migration instruments) lay down the tasks and responsibilities of the Commission and the Member States for preparing this migration, including further development and testing of SIS II. As these legal instruments contained an expiry date of 30 June 2010, the Commission tabled proposals to amend them, chiefly with a view to extending the deadline for transferring data from SIS 1+ to SIS II. The outcome was the adoption, on 3 June 2010, of Council Regulation 541/2010 [5] amending Regulation (EC) no 1104/2008 on migration from the Schengen Information System (SIS 1+) to the second generation Schengen Information System (SIS II) and Council Regulation (EU) 542/2010 [6] amending Decision 2008/839/JHA on the same subject.

Together, these Regulations, in line with the JHA Council Conclusions of 4-5 June 2009:

· Give formal status to the GPMB;

· Provide legal flexibility for an alternative technical scenario;

· Set out that the migration instruments "shall expire on a date to be fixed by the Council…and in any case no later than on 31 March 2013 or on 31 December 2013 in case of a switchover to an alternative technical scenario…"

2.6. SIS II network

The SIS II project includes the provision of a wide area communications network, meeting the requirements of availability, security, geographical coverage and level of service, to enable the national and central systems to communicate.

In late May, the Commission took a decision to temporarily suspend the back-up local national interfaces. These back-up sites are optional. Given the new draft project schedule, a financial saving could thus be made on network costs. Member States were informed about this step. The sites will be re-activated at a later stage, prior to go-live.

During the period covered by this report the connections to the SIS II s-TESTA network were successfully established for Bulgaria on time and within budget.

2.7. Operational management

During the transitional phase between the entry into operations of SIS II and the setting up of the agency for long-term operational management of large-scale IT systems in the area of justice, freedom and security (including SIS II), the Commission will be responsible for operational management of SIS II.

Preparations for a two year extension to the contract with the French authorities for infrastructure and offices are in their final stages [7]. In the framework of the service contract on recruitment and training, the French authorities have recruited staff to operate the systems developed by the Commission. One major priority is to complete negotiations with France on the contractual framework covering operational tasks during the transitional phase. A further priority is to seek agreement with France on delegation arrangements for continuing development on the basis of the SIS 1+RE solution, should this solution be required.

The original proposals for a legislative package for establishing an IT agency [8] were replaced in March 2010 by a revised proposal [9] for a Regulation, taking account of changes introduced by the Lisbon Treaty. Negotiations on these proposals are ongoing in the preparatory bodies of the Council and in the European Parliament, with a view to their adoption by the end of 2010.

2.8. Security and data protection

Following points raised by some Member States, the Commission carried out a study on the question of access to unencrypted data, which can only take place within the secure environment of the network operating centre in Bratislava. Several scenarios were outlined on which Member States were consulted. The options included a second layer of encryption but also a set of additional organisational measures. There was no broad consensus within the Member States on the most suitable scenario. It was observed that the implementation of a second layer of encryption would be both costly and time consuming. Additionally it would be necessary to consider the possible impact on network stability and performance.

The Commission organised two visits for Member States' experts to the network operating centre. The experts commented favourably on the internal organisation and security in the centre and made some recommendations. The Commission will carefully follow the implementation of those recommendations and arrange further consultation, if required.

On 4 May 2010 the Commission adopted the SIS II Security Plan which will cover the security of SIS II during the transitional period, until the IT agency is established [10].

3. Management

3.1. Financial implications

By the end of the reporting period the total budgetary commitments made by the Commission on the SIS II project, since 2002, amounted to € 93.987.003. The corresponding contracts include feasibility studies, the development of the central SIS II itself, support and quality assurance, the SIS II network, preparation for operational management in Strasbourg, security, biometrics preparations and communication.

Of this amount, € 55.574.168 had actually been paid between 2002 and the end of June 2010. The main expenditure items were development (€ 26.500.816), the network (€ 16.012.711) and support and quality assurance (€ 7.192.480).

As agreement has been reached on Member States' final operational requirements for the system, the Commission is commencing negotiations with its main development contractor with a view to obtaining precise figures on costing for additional work required to complete the project and to achieving respective contractual coverage. This will enable a detailed budget covering the period until the entry into operations of the system to be presented to the JHA Council by October 2010 at the latest.

Budget execution |

| From 2002 to June 2010 | From January to June 2010 |

| Commitments | Payments | Commitments | Payments |

Development | 43.175.733 | 26.500.816 | 0 | 2.240.213 |

Support & quality assurance | 9.399.894 | 7.192.480 | 722.836 | 900.547 |

Network | 32.375.954 | 16.012.711 | 5.421.281 | 1.413.447 |

Operational management preparation | 6.124.038 | 4.528.421 | 40.425 | 709.493 |

Security | 869.275 | 217.712 | 0 | 73.803 |

Studies / Consultancy | 940.481 | 921.611 | 20.650 | 26.516 |

Information Campaign | 33.373 | 33.373 | 0 | 0 |

Experts Mission Expenses | 1.053.380 | 152.171 | 77.930 | 39.640 |

Others | 14.874 | 14.874 | 0 | 0 |

TOTAL: | 93.987.003 | 55.574.168 | 6.283.122 | 5.403.657 |

During the period covered by the present report penalties of € 390.000, imposed on the main development contractor for failure to accomplish the SIS II Operational System Tests in December 2008, have been offset against payments for other deliverables.

3.2. Project management

3.2.1. Global Programme Management Board (GPMB)

The partnership embodied in the GPMB has been one of the key features of this period. The status of the GPMB has now been formalised with the adoption on 3 June 2010 of the two Council Regulations on migration from the Schengen Information System (SIS 1+) to the second generation Schengen Information System (SIS II), which entered into force on 25 June 2010.

The informal formation of the GPMB met 21 times during the period covered by this report.

3.2.2. SISVIS Committee (SIS II)

The Commission is assisted in the development of SIS II by the SISVIS Committee. There were five meetings of the SISVIS Committee on SIS II matters in the period January – June 2010.

In addition to regular SISVIS Committee meetings, working groups of the Committee and workshops, involving Member States' experts, are organised to discuss detailed technical issues. These meetings generally focus on issues arising from specific project deliverables:

· The "Test Advisory Group" (TAG), provides the SISVIS Committee with an opinion on issues related to the organisation, implementation and interpretation of tests. This group held seven meetings in this reporting period;

· The "Change Management Board" (CMB), provides advice on classification, qualification and the potential impact of correction of reported issues. This working group, which also reports to the SISVIS Committee, met six times during the reporting period;

· Two SIS II Migration Workshops were held during this period, to advise the SISVIS Committee and pursue activities on this critical topic.

3.2.3. National planning and coordination

A working group composed of the Member States' and users' national project managers (NPM) is organised within the framework of the SISVIS Committee. The purpose of these NPM meetings is to deal with detailed planning issues, risks and activities both at the central and national project levels. During this reporting period four NPM meetings have taken place.

3.2.4. Council

The Commission takes part in the meetings of the preparatory bodies of the Council responsible for the Schengen Information System and each Council of Ministers session where SIS II is included on the agenda. On these occasions, the Commission presented oral reports on the state of play of the SIS II project, the associated risks and the envisaged next steps.

3.2.5. European Parliament

The European Parliament followed developments closely throughout this period. It is also likely that the announcements by the Committee on Budgets "to hold funds allocated to the migration to the SIS II in reserve pending successful testing and a comprehensive audit" will be followed up during the 2011 budget procedure.

The Commission continued to keep the European Parliament informed on the state of play on SIS II: bilateral meetings with MEPs regularly took place, a letter was sent by Commissioner Malmström to the Chairman of the LIBE Committee of the European Parliament (and to rapporteurs) following each JHA Council in the first semester of 2010. Presentations on the state of play of SIS II have been made in the LIBE Committee, notably on 10 May.

Finally, the Commission responded to two Parliamentary questions relating to SIS II.

4. Priorities for the next reporting period

· Finalisation of negotiations with the main development contractor with a view to ensuring contractual coverage for the refined requirements;

· Preparation of a comprehensive global schedule and a detailed budget for the completion of the project (taking account of the above-mentioned contractual negotiations) by the October JHA Council at the latest;

· Implementation of the final requirements for entry into operation agreed by the Member States;

· Development of the test campaign for the refined requirements;

· Preparations for entry into operation;

· Continuation of work to prepare for operational management, including follow-up of negotiations on the IT agency package and internal preparations for the establishment of this agency.

5. Conclusions

During this reporting period there were a number of key points which moved the project in a positive direction. It was mainly the successful outcome to the first milestone test which allowed progress to be made in a number of fields, not least the confirmation, in the JHA Council on 23 April that the development of SIS II will continue on the basis of the current SIS II project. This was supported on 3 June by the adoption of the two Regulations amending the deadline for entry into operation. In addition, some long-standing issues such as the security of data passing through the network operations centre were moved forward. The visit to this centre succeeded in demonstrating to Member States' experts the extensive risk mitigation measures in place.

Furthermore, the Council invited the Commission, together with the Member States, to swiftly finalise the system requirements for the entry into operation of SIS II. This reporting period saw intensive, fruitful cooperation, within a constructive atmosphere, where experts from the Commission and Member States refined the requirements for the entry into operation. Much of the detailed discussion for this exercise took place in the Global Programme Management Board which was formalised within the above-mentioned Regulations.

The updating of the requirements is intended to make progress towards the entry into operation of SIS II, including the integration of the second milestone test into the set of tests defined to streamline the development of the SIS II project.

The JHA Council also requested a new global schedule and detailed budget estimate. At the June Council, the Commission pointed out that detailed negotiations with the main contractor would be pursued throughout the summer in order to seek to incorporate the refined requirements into the project contract. The outcome of this process can be expected for the JHA Council meeting in October 2010.


Annex I

SISVIS Committee (SIS II) and Working Group Meetings

a) Meetings held during the reporting period

JANUARY 2010 |

14 | Change Management Board |

5, 14, 21, 28 | SIS II Global Programme Management Board |

7, 14, 21 | Test Advisory Group |

FEBRUARY 2010 |

2, 11, 23, 26 | SIS II Global Programme Management Board |

24 | 'National Project Managers' Meeting |

25 | Change Management Board |

24 | SISVIS Committee (SIS II technical) |

20 | SISVIS Committee (SIRENE) |

4, 25 | Test Advisory Group |

MARCH 2010 |

3, 10, 23, 25 | SIS II Global Programme Management Board |

24 | 'National Project Managers' Meeting |

24 | SISVIS Committee (SIS II technical) |

4, 11 | Test Advisory Group |

APRIL 2010 |

6, 21 | SIS II Global Programme Management Board |

14 | SISVIS Committee (SIS II technical) |

28 | Change Management Board |

MAY 2010 |

12, 18, 25 | SIS II Global Programme Management Board |

26 | SISVIS Committee (SIS II technical) |

26 | 'National Project Managers' Meeting |

25/25 | Migration Workshop / Change Management Board |

JUNE 2010 |

2, 9, 15, 23 | SIS II Global Programme Management Board |

26 | Change Management Board / Migration Workshop |

b) Meetings scheduled during the forthcoming reporting period

JULY 2010 |

6, 14, 28 | SIS II Global Programme Management Board |

15 | Change Management Board |

15 | 'National Project Managers' Meeting |

15 | SISVIS Committee (SIS II technical) |

1,8, 15, 22, 29 | Test Advisory Group |

AUGUST 2010 |

4, 11, 18, 25 | SIS II Global Programme Management Board |

05, 12, 19, 26 | Test Advisory Group |

SEPTEMBER 2010 |

1, 8, 15, 22, 29 | SIS II Global Programme Management Board |

22 | SISVIS Committee (SIS II technical) |

22 | 'National Project Managers' Meeting |

23 | Change Management Board |

2, 9, 16, 23, 30 | Test Advisory Group |

OCTOBER 2010 |

21 | Change Management Board |

20 | 'National Project Managers' Meeting |

20 | SISVIS Committee (SIS II technical) |

27 | SIS VIS Committee (SIRENE) |

7, 14, 21, 28 | Test Advisory Group |

6, 13, 20, 27 | SIS II Global Programme Management Board |

NOVEMBER 2010 |

3, 10, 17, 24 | SIS II Global Programme Management Board |

18 | 'National Project Managers' Meeting |

18 | SISVIS Committee (SIS II technical) |

17 | Change Management Board / Migration Workshop |

4, 11, 18, 25 | Test Advisory Group |

DECEMBER 2010 |

1,8, 15, 22 | SIS II Global Programme Management Board |

16 | 'National Project Managers' Meeting |

16 | SISVIS Committee (SIS II technical) |

14 | Migration Workshop / Change Management Board |

2, 9, 16 | Test Advisory Group |

[1] Commission Staff Working Document - Report on the financial and contractual aspects of developing the second generation Schengen Information System (SIS II), Brussels SEC (2010) 436

[2] Council Regulation (EU) 541/2010 amending Regulation (EC) no 1104/2008 on migration from the Schengen Information System (SIS 1+) to the second generation Schengen Information System (SIS II) and Council Regulation (EU) 542/2010 amending Decision 2008/839/JHA on the same subject.

[3] Council Regulation (EC) No 1104/2008 of 24 October 2008 on migration from the Schengen Information System (SIS 1+) to the second generation Schengen Information System (SIS II), OJ L 299, 8.11.2008, p. 1.

[4] Council Decision 2008/839/JHA of 24 October 2008 on migration from the Schengen Information System (SIS 1+) to the second generation Schengen Information System (SIS II), OJ L 299, 8.11.2008, p. 43.

[5] OJ L 155/19 of 22.6.2010

[6] OJ L 155/23 of 22.6.2010

[7] The central SIS II and VIS systems are physically located in Strasbourg with a back-up site close to Salzburg in Austria. In accordance with the SIS II legal instruments, prior to this reporting period, the Commission had already concluded service contracts on infrastructure, recruitment and training, with a view to delegating operational management tasks to the French authorities.

[8] Adopted by the Commission on 24 June 2009

[9] Proposal for a Regulation of the European Parliament and of the Council (COM/2010/93 Final of 19.3.2010.

[10] Commission Decision of 4 May 2010 on the Security Plan for Central SIS II and the Communication Infrastructure (2010/261/EU)

--------------------------------------------------