52011DC0391

TABLE OF CONTENTS

1. Introduction 2

2. Project Status 2

2.1. Overview of progress during the period under review 2

2.2. Contractual framework for finalising the project 3

2.3. Preparations for an alternative technical solution 4

2.4. Preparations for migration 5

2.5. SIS II network 6

2.6. Operational management 6

2.7. Security 6

3. Management 7

3.1. Financial implications 7

3.2. Project management 8

3.2.1. Global Programme Management Board (GPMB) 8

3.2.2. SISVIS Committee (SIS II) 9

3.2.3. National planning and coordination 9

3.2.4. Council 9

3.2.5. European Parliament 10

4. Priorities for the next reporting period 10

5. Conclusions 11

1. INTRODUCTION

This progress report describes the work carried out in the second semester of 2010, concerning the development of the second generation Schengen Information System (SIS II) and preparations for migration from SIS 1+ to SIS II. It is presented to the Council and the European Parliament in accordance with Article 18 of Council Regulation (EC) No 1104/2008 and of Council Decision 2008/839/JHA on migration from the Schengen Information System (SIS 1+) to the SIS II.

2. Project Status

2.1. Overview of progress during the period under review

The JHA Council of 3-4 June 2010 set the scene for the significant progress achieved in the SIS II project during the second semester of 2010. During this period, the Commission's and Member States' experts worked intensively to finalise the refined requirements for the system and to draw up the outline of a realistic draft schedule. Valuable workshops and meetings, gathering together all stakeholders' experts, took place to highlight the areas in which the requirements of SIS II had to evolve in line with end-users' needs, taking into account the need to safeguard investments in SIS II made at national level. Several elements of this evolution were significant, not least the need to provide a system about five times the size of the system originally envisaged (from 15-22 million alerts in the initial contract to 70-100 million alerts now required) and yet which still delivers operationally-oriented performance.

Following a thorough assessment conducted by all stakeholders' experts, a broad consensus was reached both on the revised system requirements and future test approach, and on the outline of the global schedule. On this basis, SIS II is expected to become operational during the first quarter of 2013.

Once the requirements for the system had been stabilised, the Commission undertook negotiations with its main development contractor to achieve the required contractual coverage, with a view to closing the gap between the description of deliverables in the original contract and those made necessary by the migration legal instruments of 2008[1] and the evolution of end-users' needs. Complex negotiations took place from August to mid-September in order to clarify the exact content of the services to be delivered and achieve a financially sound offer from the contractor. Ultimately the negotiations proved successful. The corresponding budget for completing the project remains fully in line with the budgetary envelope for SIS II approved for the period 2007-2013.

Although the final specifications for the system have been jointly designed and agreed with Member States' experts in such a way as to preserve previous investments, national systems nevertheless also require some upgrade, notably to meet the significantly updated capacity of the system. Seeking to accommodate any extended SIS II-related resource implications for Member States, the Commission endeavoured to be fully flexible in adapting the national annual programmes of the European External Borders' Fund (EBF). SIS II is indeed one of the strategic priorities for the EBF, allowing Member States to benefit from EU co-financing of up to 75%.

In this context, on 7-8 October 2010, the JHA Council reaffirmed that the entry into operation of SIS II remained an absolute priority, requiring a joint effort and the close cooperation of the Member States and the Commission. Further, the Council took note of the global schedule and budget for the entry into operation of SIS II, as confirmed by the Commission in a report[2] submitted to the meeting, and called upon all the stakeholders to do their utmost to ensure that the project was fully implemented within the time schedule and financial plan. The Council also welcomed the possibility, offered by the Commission, to make the EBF available to the Member States to support the completion of the national elements of the system and recalled that the contingency plan based on the further development of C.SIS 1+ needed to be retained until the tests defined in the second milestone were successfully completed.

Following a period of almost two years of technical difficulties, the Conclusions adopted at the JHA Council of 7-8 October 2010 provided a clear, realistic and widely-shared roadmap for the SIS II project's finalisation. The Commission highlighted that it was time to give experts the serenity they needed to allow complete concentration on the technical objectives ahead of them and completion of the project.

2.2. Contractual framework for finalising the project

On 15 September 2010, the Commission and the main development contractor reached agreement on the contractual framework for finalising the project. The main features of this agreement are the following:

- Technical requirements

The Commission and the contractor agreed on all definitive requirements for the SIS II system to go live, in full compliance with the consensus reached with Member States' experts. One of the chief upgraded features of the system concerns its capacity, which is about five times bigger than originally envisaged (from 15-22 million alerts in the initial contract to 70-100 million alerts now required). The high performance requirements of the system have been maintained, so as to meet all the operational needs of its future end-users.

It is important to note that the core obligations stemming from the SIS II legal instruments remained unaffected by the revised requirements.

- Schedule

The global schedule, announced to the June 2010 Council, was confirmed and became an integral part of the contract. The further development and extensive testing of SIS II will be carried out over a period of 30 months. The system will thus be ready for entry into operation during the first quarter of 2013. The short term focus, which will last until the second quarter of 2011, will be the adaptation of both the central and national systems to the updated requirements. To that purpose, a new Interface Control document (ICD), which is the basic technical reference document for the development of the central and national components of the SIS II, was issued in October and the hardware upgrade was delivered to the main and back-up sites at the end of the year. The subsequent phase will be devoted to testing activities to ascertain the proper functioning of SIS II as a whole. This will take approximately one year and will culminate in the second milestone test in 2012. The final phases of the project will consist of the 'comprehensive test' (a test campaign provided for in the SIS II legal instruments) and the actual data migration. The entry into operation of the system is to take place during the first quarter of 2013.

- Budget

The budget of the negotiated procedure for completing the development and testing of SIS II was set at € 34.95 million.

More specifically, out of the € 34.95 million, € 22.02 million was allocated to development (including testing and migration) and € 12.93 to hardware upgrades (justified by the system's increased capacity and the need for additional testing environments that allow development and testing tasks to be carried out in parallel).

Development costs are in line with the budget estimated in the Commission comparative report of June 2009 (€ 21.74 million, without hardware upgrade).

Global costs will be kept within the budgetary envelope agreed for SIS II until 2013.

- Contractual Conditions and Guarantees

In the course of these negotiations, the Commission ensured that none of the contractual conditions and safeguards of the original contract were lowered, in particular those concerning the provisions on penalties.

The Commission also secured the inclusion of a "resolution" clause in the contract, as specified in the June 2009 Council Conclusions. This clause is similar to the one put in place should failure have occurred at the first milestone test, but now relates to the performance of the second milestone test. It will allow the Commission to decide on the immediate termination of the contract, should the second milestone test be considered to have failed.

The Commission also ensured a "best customer clause" for hardware acquisition.

2.3. Preparations for an alternative technical solution

On 7-8 October 2010, the JHA Council recalled that the contingency plan based on the further development of C.SIS 1+ needed to be retained until the tests defined in the second milestone were successfully completed. To that end, the Council called upon the Commission to take the necessary steps to ensure, in cooperation with France, the availability of such a contingency plan until that time.

In order to prepare the ground for a possible switch to an alternative technical scenario for implementing the SIS II functionalities, should a milestone be judged to have failed, bilateral discussions have taken place between the Commission and France, since 2009, on a possible delegation agreement for implementing the alternative option for developing SIS II on the basis of an enhanced SIS 1+ technical solution (SIS 1+RE).

A delegation agreement would allow the Commission to implement the EU budget by delegation of tasks, related to SIS II development, to France. The draft of this delegation agreement has already been finalised and could be re-used for any viable alternative technical solution which France might put forward.

As regards the legal relations between France and its contractor for SIS 1+RE, France informed the Commission that, due to French public procurement law, the contractual basis for SIS 1+RE would lapse if not triggered by September 2010. This indeed occurred. In the light of the commitment of France to provide a technical contingency solution until after the second milestone (as described in the Council Conclusions on SIS II of 23 April 2010), the Commission will continue to work in close cooperation with the French authorities to enable that this solution can be implemented, by means of a renewed call for tender by the French authorities, should this be required.

As regards legislative action, all necessary steps are already in place to ensure that an alternative technical scenario can be implemented, should it be necessary. The Commission proposal for amendments to the SIS II migration instruments resulted in adoption by the Council in June 2010 of a provision, whereby, " the development of SIS II may be achieved by implementing an alternative technical scenario characterised by its own technical specifications "[3].

2.4. Preparations for migration

In order to successfully perform the migration from SIS 1+ to SIS II an interim migration architecture will be put in place. This will include a converter designed to convert data in two directions between the current C.SIS and central SIS II and keep both systems synchronised for the period of time required for Member States to move from one system to the other.

The key elements of the work, at this stage, are:

- The converter itself, to be developed by the contractor.

- The related documentation, such as the technical specifications of the converter.

- Converter test documentation.

- Data cleansing activities at Member State level in order to ensure that existing SIS 1+ alerts, to be moved to SIS II, are as close to SIS II data requirements as possible.

Due to the period of technical and political discussion over the SIS II project, which lasted from the failure of the operational system tests in December 2008 until the successful first milestone test in March 2010, migration activities were placed, to a certain degree, on hold. With the clarity gained during the second half of 2010 these activities regained their position of importance. All the previous work on migration has been reviewed to align it with the refined requirements.

Development of the converter has continued, in the light of the requirements. The updated converter will be needed towards the end of the second quarter 2011 for testing in conjunction with the existing SIS 1+.

In order to assist the Member States in identifying the amount of work they face in data cleansing, C.SIS regularly provides to the relevant Council working party a document describing the detailed evolution of the SIS database according to data mapping and cleansing activities.

2.5. SIS II network

The SIS II project includes the provision of a wide area communications network, meeting the requirements of availability, security, geographical coverage and level of service, to enable the national and central systems to communicate.

During the period covered by this report, the connection to the SIS II s-TESTA network was successfully established for Romania, on time and within budget, bringing to 31 the number of Member States connected (plus Europol and Eurojust)

2.6. Operational management

In accordance with the political mandate that the Council and the European Parliament gave to the Commission in the form of joint statements when adopting the SIS II and VIS legal instruments, the Commission adopted, in June 2009, legislative proposals for setting up an Agency for the operational management of large-scale IT systems in the area of freedom, security and justice. Following the entry into force of the Lisbon treaty it became necessary to present a single amended proposal which was adopted by the Commission in March 2010. The core mission of the proposed Agency would be to carry out the tasks related to the operational management of SIS II (once brought into operation), VIS and EURODAC. In future the Agency could also be entrusted with other large-scale IT systems.

Work on this legislative proposal is well advanced and it is anticipated that adoption of the regulation can take place in the course of 2011.

2.7. Security

Following points raised by some Member States regarding compliance with Commission Decisions 2007/171/EC, 2007/170/EC and 2008/602/EC[4], the Commission carried out a technical study on the question of access to unencrypted data within the secure environment of the network operating centre.

The study described several potential scenarios and the opinions of Member States' experts were sought. Options included a second layer of encryption but also a set of additional organisational procedures to prevent or limit access to unencrypted data. In terms of implementation, the potential solution will have to ensure minimal impact on certain key criteria, such as the performance and response time of the system, implementation costs at central and national level and impact on the schedule. Implementation of potential solutions was addressed with Member States in a workshop organised by the Commission in early 2011.

3. MANAGEMENT

3.1. Financial implications

By the end of the reporting period the total budgetary commitments made by the Commission on the SIS II project, since 2002, amounted to € 133.170.429. The corresponding contracts include feasibility studies, the development of the central SIS II itself, support and quality assurance, the SIS II network, preparation for operational management in Strasbourg, security, biometrics preparations, communication and experts' mission expenses.

Of this amount, € 68.152.710 had actually been paid between 2002 and the end of December 2010. The main expenditure items were development (€ 33.435.295), the network (€ 20.371.388) and support and quality assurance (€ 8.124.387).

Budget execution |

From 2002 to December 2010 | From July to December 2010 |

Commitments | Payments | Commitments | Payments |

Development | 80.377.456 | 33.435.295 | 37.201.723 | 6.934.479 |

Support & quality assurance | 9.882.074 | 8.124.387 | 482.180 | 931.907 |

Network | 32.375.954 | 20.371.388 | 0 | 4.358.677 |

Operational management preparation | 7.468.215 | 4.837.950 | 1.344.177 | 309.529 |

Security | 874.715 | 217.712 | 5.440 | 0 |

Studies / Consultancy | 940.481 | 921.611 | 0 | 0 |

Information Campaign | 33.373 | 33.373 | 0 | 0 |

Experts Mission Expenses | 1.203.286 | 196.121 | 149.906 | 43.950 |

Others | 14.874 | 14.874 | 0 | 0 |

TOTAL: | 133.170.429 | 68.152.710 | 39.183.426 | 12.578.542 |

During this period, Member States expressed a growing concern over the need for additional national funding for SIS II. In order to address this issue, the Commission commenced assessment of the possibilities to provide further support towards the costs of completing the national system developments within the existing budget allocations. This was carried out in close cooperation with the national Responsible Authority under the European External Borders Fund (EBF) in the Member States and the SIS II national project managers. Discussions on this matter took place within the framework of the SOLID Committee at its meeting on 20 October. Each Member State was subsequently invited to identify their respective national needs and report them to the SOLID Committee by the end of November 2010. An analysis of this data was then carried out in order to ascertain whether existing funding is sufficient or whether complementary resources may be required.

3.2. Project management

3.2.1. Global Programme Management Board (GPMB)

In the Council Conclusions on SIS II of 26-27 February 2009 and 4-5 June 2009, an informal body consisting of experts from the Member States, designated as the Global Programme Management Board, was established to enhance cooperation and to provide direct Member States' support to the central SIS II project. The positive result of the work of this group and the necessity to further enhance cooperation and transparency for the project justified the formal integration of the group into the SIS II management structure, without prejudice to the responsibilities of the Commission and the Member States.

The amended migration legal instruments, adopted on 3 June 2010[5], formalised the GPMB as an advisory body for assistance to the central SIS II project to facilitate consistency between central and national SIS II projects. The Board has neither decision-making power nor any mandate to represent the Commission or Member States.

The legal instruments set out that a number of experts would be designated by the Member States acting within the Council. The nominations were agreed on 23 September 2010. The Commission carried out a parallel process to nominate its own experts. This allowed the next meeting, on 30 September 2010 to take place within the new formal framework. The established practice of alternating the chairperson role between the Presidency and the Commission continued.

The GPMB reached an agreement on the draft Terms of Reference in November 2010, to be put forward to the SISVIS Committee in 2011.

The GPMB met sixteen times during the period covered by this report.

3.2.2. SISVIS Committee (SIS II)

The Commission is assisted in the development of SIS II by the SISVIS Committee. There were three meetings of the SISVIS Committee on SIS II technical matters in the period July – December 2010.

In addition to regular SISVIS Committee meetings, working groups of the Committee and workshops, involving Member States' experts, are organised to discuss detailed technical issues. These meetings generally focus on issues arising from specific project deliverables:

- The "Test Advisory Group" (TAG), provides the SISVIS Committee with an opinion on issues related to the organisation, implementation and interpretation of tests. This group held two meetings in this reporting period.

- The "Change Management Board" (CMB), provides advice on classification, qualification and the potential impact of correction of reported issues. This working group, which also reports to the SISVIS Committee, met once during the reporting period.

- One SIS II Migration Workshop was held during this period, to advise the SISVIS Committee and pursue activities on this critical topic.

3.2.3. National planning and coordination

A working group composed of the Member States' and users' national project managers (NPM) is organised to advise the Commission services. The purpose of the NPM meetings is to deal with detailed planning issues, risks and activities both at the central and national project levels. During this reporting period three NPM meetings took place.

3.2.4. Council

As expressed in Council Conclusions and in line with the wishes of all parties in the project to maintain complete transparency, the Commission keeps the Council and the European Parliament informed, regularly, on the implementation of the global schedule for SIS II and expenditure on the central project.

The Commission takes part in the meetings of the preparatory bodies of the Council responsible for the Schengen Information System and of each Council of Ministers session where SIS II is included on the agenda. The Commission has presented reports on the state of play of the SIS II project and the envisaged next steps.

In addition to the usual oral updates, during this period the Commission circulated its Commission Staff Working Document, "Report on the global schedule and budget for the entry into operation of the second generation Schengen Information System (SIS II)" , prior to the JHA Council of 7-8 October.

The Commission circulates a weekly flash report, summarising technical developments, to colleagues engaged in the project at national level.

3.2.5. European Parliament

The Commission continued to keep the European Parliament closely informed on the state of play on SIS II on the basis of correct, verifiable and up-to-date facts and data.

The announcements by the Committee on Budgets, " to hold funds allocated to the migration to the SIS II in reserve pending successful testing and a comprehensive audit ", were followed up during the 2011 budget procedure. On 15 December, the European Parliament put the appropriations for SIS II in the reserve for the 2011 budget.

The Parliament set out the conditions for lifting the reserve[6]:

1. The presentation by the Commission of a " concrete and realistic schedule " for the further development of the SIS II, as well as an overview of the budgetary implications.

2. Full access to the service contract signed between the Commission and the service provider for the development of the SIS II system to both the Parliament and the Council.

In order to satisfy the first condition described above, the Commission provided, in November, a detailed overview of progress to members of relevant Parliamentary Committees in the context of a "technical briefing". Extensive budgetary information, covering both past and future budgetary commitments and payments, was circulated by the Commission. Furthermore, the Commission expressed its readiness to share the requested contractual information in a confidential environment (to protect the contractor's legitimate business interests). This meeting also offered the opportunity for discussing practical ways of handling the budgetary issue, ensuring that the Parliament could demonstrate its role of control and overview without impeding progress on the project and the processing of invoices.

Further meetings with MEPs regularly took place, a letter was sent by Commissioner Malmström to the Chairman of the LIBE Committee of the European Parliament (and to rapporteurs) on the main outcomes of the October JHA Council. The report on the schedule and budgetary plan was forwarded to the chairs of both LIBE and BUDG committees, and presentations on the state of play of SIS II have been made in the LIBE Committee.

Finally, the Commission responded to ten Parliamentary questions relating to SIS II.

4. PRIORITIES FOR THE NEXT REPORTING PERIOD

The initial focus, which will last until the second quarter of 2011, will be the upgrading of both the central and national systems to comply with the updated requirements.

The subsequent phase will be devoted to testing activities to ascertain the proper functioning of the SIS II as a whole. This will take approximately one year and will culminate in the second milestone test in the first quarter of 2012.

The final phases of the project will consist of the 'comprehensive test' (a test campaign set out in the SIS II legal instruments) and the actual data migration. The entry into operation of the system is to take place during the first quarter of 2013.

5. CONCLUSIONS

THANKS TO THE JOINT EFFORTS OF ALL STAKEHOLDERS, THE SIGNIFICANT TECHNICAL AND POLITICAL UNCERTAINTIES over the future of the SIS II project that characterised the beginning of 2010 have progressively been addressed in the course of the year. This intensive work culminated with the successful outcome of the first milestone test, the consensual definition of final requirements for the system to go live and the conclusion of the corresponding contractual framework. These positive developments all contributed to bringing the SIS II project back on track with a clear and shared vision on the remaining phases of the project, as well as a realistic schedule and an adequate budgetary plan to complete the work outstanding. Closing a parenthesis of almost two years of difficulties, this new momentum provides a framework within which all stakeholders will need to make the necessary efforts to ensure the finalisation of the SIS II project.

Annex I

SISVIS Committee (SIS II) and Working Group Meetings

Meetings held during the reporting period

JULY 2010 |

6, 14, 27 | SIS II Global Programme Management Board |

13 | Change Management Board |

15 | 'National Project Managers' Meeting |

15 | SISVIS Committee (SIS II technical) |

AUGUST 2010 |

11, 25 | SIS II Global Programme Management Board |

SEPTEMBER 2010 |

8, 16, 30 | SIS II Global Programme Management Board |

22 | SISVIS Committee (SIS II technical) |

22 | 'National Project Managers' Meeting |

OCTOBER 2010 |

20 | SISVIS Committee (SIS II technical) |

27 | SIS VIS Committee (SIRENE) |

20, 27 | SIS II Global Programme Management Board |

NOVEMBER 2010 |

10, 16, 24 | SIS II Global Programme Management Board |

DECEMBER 2010 |

2 | Migration Workshop |

2, 8, 15 | SIS II Global Programme Management Board |

16 | 'National Project Managers' Meeting |

7, 14 | Test Advisory Group |

SISVIS Committee (SIS II) and Working Group Meetings

b) Meetings provisionally scheduled during the forthcoming reporting period

JANUARY 2011 |

11-12 | Test Workshop |

12, 19, 25 | SIS II Global Programme Management Board |

26 | SISVIS Committee (SIS II technical) |

26 | 'National Project Managers' Meeting |

FEBRUARY 2011 |

2, 9, 16, 22 | SIS II Global Programme Management Board |

23 | SISVIS Committee (SIS II technical) |

23 | 'National Project Managers' Meeting |

MARCH 2011 |

2, 9, 16, 22, 30 | SIS II Global Programme Management Board |

23 | SISVIS Committee (SIS II technical) |

23 | 'National Project Managers' Meeting |

APRIL 2011 |

6, 13, 20, 26 | SIS II Global Programme Management Board |

27 | SISVIS Committee (SIS II technical) |

27 | 'National Project Managers' Meeting |

MAY 2011 |

4, 11, 18, 24 | SIS II Global Programme Management Board |

25 | SISVIS Committee (SIS II technical) |

25 | 'National Project Managers' Meeting |

JUNE 2011 |

1, 8, 15, 28 | SIS II Global Programme Management Board |

29 | SISVIS Committee (SIS II technical) |

29 | 'National Project Managers' Meeting |

[1] Regulation (EC) No 1104/2008, as amended by Regulation (EU) No 541/2010, and Council Decision 2008/839/JHA as amended by Regulation (EU) No 542/2010

[2] Commission Staff Working Document, "Report on the global schedule and budget for the entry into operation of the second generation Schengen Information System (SIS II)" : document SEC (2010) 1138 final Brussels 21.09.2010

[3] Common Article 1(3) of Regulation (EC) No 1104/2008, as amended by Regulation (EU) No 541/2010, and of Council Decision 2008/839/JHA as amended by Regulation (EU) No 542/2010

[4] 2007/171/EC: Commission Decision of 16 March 2007 laying down the network requirements for the Schengen Information System II (3rd pillar); 2007/170/EC: Commission Decision of 16 March 2007 laying down the network requirements for the Schengen Information System II (1st pillar) (notified under document number C(2007) 845); 2008/602/EC: Commission Decision of 17 June 2008 laying down the physical architecture and requirements of the national interfaces and of the communication infrastructure between the central VIS and the national interfaces for the development phase (notified under document number C(2008) 2693).

[5] Regulation (EU) No 541/2010 and Regulation (EU) No 542/2010

[6] Two thirds of appropriations for both commitments and payments have been released in January 2011.