52008DC0714

EN

Brussels, 10.11.2008

COM(2008)714 final

REPORT FROM THE COMMISSION TO THE COUNCIL AND THE EUROPEAN PARLIAMENT

ON THE DEVELOPMENT OF THE VISA INFORMATION SYSTEM (VIS) IN 2007

(submitted in response to the obligation under Article 6 of the Council Decision No. 2004/512/EC of 8 June 2004)

REPORT FROM THE COMMISSION TO THE COUNCIL AND THE EUROPEAN PARLIAMENT

ON THE DEVELOPMENT OF THE VISA INFORMATION SYSTEM (VIS) IN 2007

(submitted in response to the obligation under Article 6 of the Council Decision No. 2004/512/EC of 8 June 2004)

Report from the Commission to the Council and the European Parliament on the development of the Visa Information System (VIS)

Progress Report January – December 2007

(COM (2008) …)

TABLE OF CONTENTS

1. Introduction (...)3

2. Project status (...)3

2.1. Progress during the period under review (...)3

2.1.1. Legal framework for the VIS (...)3

2.1.2. Rescheduling the VIS (...)4

2.1.3. Development of Central System (...)4

2.1.4. Development of the Biometric Matching System (...)5

2.1.5. Site Preparations (...)5

2.1.6. Network (...)5

2.1.7. National Planning and coordination (...)6

2.1.8. Roll-out to Consular posts (...)6

2.2. Commission project management (...)6

2.2.1. Planning and budget (...)6

2.2.2. Risk management (...)7

2.2.3. Communication (...)7

2.2.4. Project management board (PMB) (...)8

2.3. SIS II Committee meetings (...)8

3. Conclusions and Perspectives (...)8

1. Introduction

This is a report on the work carried out by the Commission in 2007 (January – December 2007) on the development of the Visa Information System (VIS). It is the fourth progress report [1] presented by the Commission to the Council and the European Parliament in accordance with Article 6 of Council Decision No. 2004/512/EC of 8 June 2004 establishing the Visa Information System (VIS) [2]. This decision provides that the Commission, assisted by the SIS II Committee [3], is responsible for developing the VIS, whereas the national systems shall be adapted and/or developed by the Member States.

2. Project status

2.1. Progress during the period under review

The VIS Project is divided into three phases. Phase 1 (Detailed Design) has delivered all the documents necessary to fully describe the VIS from a technical perspective. The system will be developed and deployed during phase 2 (Development, Testing and Deployment). Finally, during phase 3 (Migration and Integration), Member States will connect their national systems to the VIS central database. Phase 1 of the project was closed during the previous reporting period and phase 2 is in progress. The Main Development Contractor has completed an analysis of the additional system development work needed to make the VIS fully compatible with the proposed legal framework agreed in June 2007 and to prepare the interfacing with the biometric component, the Biometric Matching System (BMS).

2.1.1. Legal framework for the VIS

In June 2007, political agreement was achieved between the European Parliament and the Council on the "VIS legislative package", consisting of the Regulation concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas [4] (VIS Regulation) and a third pillar Council Decision [5]. The EP plenary voted on 7 June 2007. The Council endorsed the amendments made by the EP in the JHA Council meeting on 12 June 2007. The regulation and decision constitute a single legislative package. The VIS Regulation defines the purpose and functionalities of the VIS and the responsibilities for this system. It also establishes conditions and procedures for the exchange of data between Member States on applications for short-stay visas and on the decisions taken in relation thereto. The data to be processed in the VIS shall include alphanumeric data, photographs and fingerprints of the visa applicant, in order to ensure reliable verification and identification.

The VIS Decision concerns access for consultation of the Visa Information System (VIS) by designated authorities of Member States and by Europol for the purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences.

The break-through achieved by the political agreement on the legal framework for the VIS provided the clarity needed to allow re-scheduling to go ahead (see 2.1.2 below).

2.1.2. Rescheduling the VIS

The original VIS schedule indicated that the VIS would go live in March 2007, but with only 6 Member States, each connecting to at least one consulate, without biometrics. This was based on the assumption that the legal framework for the VIS would be adopted in the summer of 2006.

A technical rescheduling was prepared in September 2006 when it became clear that the go-live strategy had changed to a gradual regional approach, starting in Northern Africa and including biometrics. This was based on the assumption that the legal framework would be adopted in January 2007.

Despite the legal uncertainty at that time, Commission services decided to continue development of the VIS on the basis of the current legal proposals and activities were scheduled until the end of 2007, but not beyond, given that development activities are largely dependent on requirements set out in the legal basis, on which no agreement had been reached at the time.

Given that system development in Member States was stalled by the same problem, preparation for a revised schedule took place in close cooperation with experts from the Member States, with a view to ensuring that it was realistic. Workshops regarding the adoption of the legal basis were held with Member States in February and March 2007 to discuss different scenarios and outstanding technical issues. The revised schedule was finally presented in September 2007, following discussions by the VIS National Project Managers in June and July 2007 (by which time political agreement had been reached on the legal framework) and support by the SIS II Committee.

According to this revised schedule, taking into account all requirements of the legal basis, the Central VIS is due to be ready for operations by the end of May 2009. Key intermediate milestones include availability of the complete Detailed Technical Specifications by September 2008, readiness of network connections in OST (Operational System Tests) Member States by late September 2008 and starting of tests involving the Member States in late November 2008 for completion by May 2009.

2.1.3. Development of the Central System

The target was to have the central system developed and tested by the end of 2006. This was not possible due to the fact that political agreement had not yet been reached at that time on the VIS Regulation, which inter alia defines the purpose, the functionalities and responsibilities for the VIS. At the start of 2007, there was no clear indication of the likely timing for adoption. Pending the political agreement on the VIS Regulation, reached subsequently, in June 2007, the Commission services decided to pursue a pro-active approach, continuing development of the VIS on the basis of the current proposal.

A number of key deliverables defining the system to be developed were provided to the Member States in 2007 [6]. Revised versions of the specifications (Interface Control Document Version 1.62 and Detailed Technical Specification Version 1.2 delivered in October and November 2007 respectively) take account of the agreement on the legal proposals and the requirements for interfacing with the Biometric Matching System.

2.1.4. Development of the Biometric Matching System

The original VIS development schedule specified that the inclusion of the biometric components of the system (the Biometric Matching System - BMS) would only take place after the implementation of the alphanumeric part of the system. However, on 24 February 2005, the JHA Council requested that the VIS become operational with biometric functionalities from the onset.

The Main Development Contractor has completed an analysis of the system development work needed to make the VIS fully compatible with the legal framework and to prepare its interfacing with the BMS. This resulted in the delivery of the final Detailed Functional Specifications by the end of 2007. The contract for BMS development had to be suspended until adequate progress had been made with VIS development. Biometric updates will have to be included in the next Interface Control Document for VIS (version 1.7). Meanwhile, Member States have received software kits for the quality check and a presentation of the BMS demonstrator giving details of the biometric workflow at Consular and border posts.

Preparations for subsequent testing (including tools) are in progress. There will be various phases of tests both at central level and in collaboration with the MS.

2.1.5. Site Preparations

The works for upgrading the electrical power supply for the Central VIS at the Strasbourg site (supported via a grant from the Commission to the French authorities) were completed on 16 August 2007. The VIS hardware for the Central Unit in Strasbourg was delivered on 3-4 September 2007 and installation was completed without the application itself by the end of October 2007.

Hardware for the Central VIS back-up site in St. Johann im Pongau, Austria was delivered at the beginning of October 2007 and the installation was completed, without the application itself, by mid-November 2007.

After the completion of a study on power distribution for BMS and following a number of intensive workshops between the local contractor and the European Commission, agreement was reached on the power distribution for the BMS and how to install the system on both sites.

2.1.6. Network

The scope of the VIS project includes the provision of a wide area communications network between the National Interface in each Member State and the Central VIS to allow the national and central systems to communicate. This network satisfies requirements for availability, security, geographical coverage and service level. The contract for the s-TESTA network was awarded in 2006 to a consortium comprising OBS (Orange Business Services) and HP (Hewlett-Packard).

The network was initially due to be installed in two waves: firstly, in the Member States participating in the Operational System Tests, i.e. Germany, Estonia, Finland, Italy, Sweden, Slovenia, Norway and Portugal and, secondly, in Member States participating in the Provisional System Acceptance tests (tests on the central system in conjunction with a significant number of national systems).

At the end of 2007, after agreement of the revised global schedule for VIS, the Commission services revised the scheduling of network delivery. The network contractor agreed to install the network for all Member States by 30 June 2008.

The adoption of a Commission decision laying down the architecture and requirements of the National Interfaces and of the communication infrastructure between the Central VIS and the National Interfaces is scheduled for 2008.

2.1.7. National Planning and coordination

The state of progress varies between the Member States, due to different circumstances at national level. During 2007 good overall progress was made with the national projects. Very positive results were noted in the countries due to participate in the Operational System Tests (at the end of 2007, seven of the eight Member States concerned reported that they could meet all target dates).

Each month a Working Group meeting for the Member States’ National Project Managers (NPM) is organised by the Commission services in the framework of the SIS II Committee, in order to discuss planning issues, risks and activities at central and national project levels. The monthly reporting by Member States for these meetings has enhanced the quality, consistency and usefulness of the information available on their national projects. In September 2007, after approval of the revised schedule for VIS, the Commission services adapted the key milestones in the monthly reporting form and re-launched the reporting exercise. The majority of Member States are now reporting via this new system. Meanwhile, the Commission services have also received information on progress at national level in countries that will fully apply the Schengen acquis at a later stage [7].

2.1.8. Roll-out to Consular posts

According to Article 48(1) of the draft VIS Regulation, biometric data should be collected from the start of operation of the VIS. In continuing preparation for this roll-out, a second pilot project for the capture, storage and verification of biometric data from visa applicants (BIODEV II), led by the French and Belgian administration, but incorporating several other Member States, continued in 2007. Both BIODEV and BIODEV II intend to demonstrate how to facilitate the implementation of the VIS at Member States’ consulates and border crossings through the establishment of common enrolment facilities or other consular cooperation initiatives. The findings of BIODEV were released to Member States at the end of the current reporting period and additional findings of BIODEV II are due to be presented in 2008.

2.2. Commission project management

2.2.1. Planning and budget

Commitment appropriations in the 2007 general budget amounted to € 32 million. The main components of expenditure during 2007 were site preparation, the network, preparation of biometrics (additional features), security audit, external assistance for project management, audit and evaluation, running costs for the development phase, studies and changes to the VIS (due to developments with the legal texts). 73.35% of the total VIS appropriations had been committed and 69.30% of payment appropriations had been paid by the end of the reporting period. The delay in agreement on the legal framework triggered a delay with certain commitments. These developments also subsequently impacted on the implementation of certain payment appropriations in 2007. Commitment appropriations of € 20 million have been secured for the next reporting period.

Commitment and Payment appropriations 2007

Available commitment appropriations | Consumed | Total % | Available payment appropriations | Consumed* | Total % |

€27,258,110.14 | €19,994,843.72 | 73.35 % | 20,023,656.59 | 13,875,607.13 | 69.30 % |

2.2.2. Risk management

In accordance with best practice, the project risks are identified, assessed and monitored on an ongoing basis within three risk logs. The main development contractor assesses risks for activities within the scope of its contract (development of the central system, provision of support and training). The Member States monitor risks relating to their national projects. The Commission services also assess the global project risks, comprising, for example, the tasks of the main development contractor, the national projects, procurement of network services, preparation of the operational sites and adoption of the legal instruments. The Commission discusses risks with the Member States on a regular basis during the national project meetings and the Project Management Boards with the past, current and future presidencies of the Council (see 2.2.4).

The Project Support Office (PSO), led by the Customer Assistance contractor, was set up at the end of 2006 under the supervision of the Commission to assist the VIS project team with following up risks, actions and coordination of communication between various stakeholders. The PSO began operations in 2007.

During the reporting period, the overall risk level fell significantly, due to the agreement on stable legal proposals and the rescheduling. The main current risks concern the duration of system development, the availability of the network, the testing activities, the availability of resources, the remaining legislative work and the security documentation. The most significant risk at the moment concerns the timely completion of the system development. One key risk concerns the possibility that the network provider may not install the central network interface as planned. In the area of testing, there is a risk that insufficient Member States will be ready on time for certain tests on the central system to be carried out with their involvement (OST & PSAT). There is also a risk that approval of the document describing the Test Design will take longer than foreseen. There are significant risks concerning availability of adequate financial and human resources (for various reasons including a potential SIS II delay, preventing transfer of staff from SIS II to the VIS project, difficulty to find specialised staff in case of staff turnover and potential inability of the main development contractor to finalize development within the agreed time frame. Further delays concerning the formal adoption of the VIS Regulation will pose a serious risk in the Comitology work to be completed before the entry into operation. In addition, a late adoption of the amended Common Consular Instructions (CCI) and the amended Schengen Borders Code may pose a risk on the finalisation of the system development. In the area of security, there is a risk that the final versions of certain documents (other than the security target) may not be available in time. Action plans are in place to address all key risks.

2.2.3. Communication

The Commission services report regularly on the status of the VIS central project to the Member States in SIS II Committee meetings and VIS Working Group meetings. Furthermore, as mentioned above, Member States provide monthly updates on progress with their national projects.

Finally, the good practice of bilateral meetings between National Project Managers and the Commission's technical VIS team continued in 2007, allowing Member States to discuss in further detail progress with their specific national project and with the central project and other issues of particular concern to them.

During the reporting period, there were eleven one-day combined National Project Manager and Working Group meetings and two one-day National Project Managers' meetings.

2.2.4. Project management board (PMB)

The VIS Project Management Board was established in 2004. Since 2005 it includes representatives from the countries holding the current Council Presidency, all preceding presidencies since its establishment and the two forthcoming presidencies, in order to ensure continuity of Member States' involvement in the project. During the reporting period, this board met eight times to discuss project management issues with project stakeholders, the main development contractor and the quality assurance contractor.

2.3. SIS II Committee meetings

There were eleven meetings of the SIS II Committee during the period under report, during which progress with the development of the VIS project was discussed.

In addition to regular SIS II Committee meetings, VIS working groups composed of Member States’ experts are organised by Commission services to discuss detailed technical issues. These meetings generally focused on issues of concern to the Member States and issues arising from specific project deliverables. The Commission, the Member States and the main development contractor gave presentations on the issues of concern to Member States. Workshop sessions were also organised, in order to have closer contact with and greater input from the Member States. In addition, informal meetings with National Project Managers were organised, in order to discuss the new schedule of the VIS project.

3. Conclusions and Perspectives

2007 was characterised by the political agreement on the legal framework which allowed the rescheduling of the project and clarification of the development work needed for incorporation of the BMS into the VIS. The political agreement on the legal framework in mid-2007 enabled good progress to be made with development, building on the pro-active work carried out in the first half of the year on the basis of the previous versions of the legal proposals. At the end of the reporting period, the project remained fully on track with the revised schedule finalized in September 2007. With regard to financial matters, certain commitments were suspended in the first half of the year, pending the political agreement on the legal framework in June 2007. From that time onwards, efforts were made to move ahead as efficiently and effectively as possible with financial implementation. This resulted in positive year end figures for both commitments and payments. Communication with Member States remained excellent and relationships were strengthened within the working group meetings.

[1] For the third report, see the Commission staff working paper of 13 June 2007 on the development of the Visa Information System (VIS), SEC (2007) 833.

[2] OJ L 213 of 15.6.2004, p. 5.

[3] The comitology framework for both the SIS II and VIS projects in the development phase, set up by virtue of Article 5 (1) of Regulation No 2424/2001 (OJ L 328, 13.12.2001, p. 4).

[4] PE-CONS 3630/1/07 REV1.

[5] Council document 13607/07.

[6] In particular, three versions of the Interface Control Document (ICD) and the related CD simulators, four versions of the Detailed Technical Specifications (DTS), final Detailed Functional Specifications and a Draft Acceptance Plan (version 1.30).

[7] Cyprus, Bulgaria, Romania and Switzerland

--------------------------------------------------