52009DC0555

[pic] | COMMISSION OF THE EUROPEAN COMMUNITIES |

Brussels, 22.10.2009

COM(2009) 555 final

REPORT FROM THE COMMISSION TO THE COUNCIL AND THE EUROPEAN PARLIAMENT

ON THE DEVELOPMENT OF THE SECOND GENERATION SCHENGEN INFORMATION SYSTEM (SIS II)

Progress Report

January 2009 - June 2009

TABLE OF CONTENTS

1. Introduction 2

2. Project status 2

2.1. Progress during the period under review 2

2.1.1. Overview 4

2.1.2. Preparations for migration 2

2.1.2.1. Migration legal instruments 2

2.1.2.2. Converter specification 2

2.1.3. SIS II network 2

2.1.4. SIS II security health check 2

2.1.5. Testing central SIS II 6

2.1.5.1. Repair of bugs and subsequent testing 6

2.1.5.2. The analysis and repair period 6

2.1.6. Architecture review .…………………………….........................................................7

2.1.7. Operational management 8

3. Management 2

3.1. Financial implications 2

3.2. Project management 9

3.2.1. Global Programme Management Board……………………………………………...9

3.2.2. SISVIS Committee (SIS II) ...…………………………………………………….….9

3.2.3. National planning and coordination 10

3.2.4. Council 10

4. Priorities for the next reporting period 10

4.1. Global programme management approach 2

4.2. Testing 11

4.2.1. First milestone…………………….…………………………………………..……..11

4.2.2. Towards a global testing approach 11

4.2.3. Global test preparations (GT)…… 11

4.3. Migration development 11

4.4. Security and data protection 11

5. Conclusions 11

1. INTRODUCTION

This progress report describes the work carried out by the Commission in the first semester of 2009 concerning the development of the second generation Schengen Information System (SIS II) and the migration from SIS 1+ to SIS II. It is presented to the Council and the European Parliament in accordance with Article 18 of Council Regulation (EC) No 1104/2008 and of Council Decision 2008/839/JHA on migration from the Schengen Information System (SIS 1+) to the second generation Schengen Information System (SIS II). This report also constitutes a test status report.

2. PROJECT STATUS

2.1. Progress during the period under review

2.1.1. Overview

An analysis and repair period for SIS II was conducted between January and April 2009. This process was triggered by a failure of the main development contractor to pass the Operational Systems Test (OST) in December 2008. During the analysis and repair period a large number of known issues and bugs were repaired and an in-depth technical architecture review was performed. Solutions were either designed or implemented, leaving nonetheless a few issues pending.

In parallel and in the framework of the Council an alternative technical scenario for developing SIS II based on SIS 1+, known as "SIS 1+ renewal and evolution" (SIS 1+ RE), was explored as a contingency plan.

The Council on 26-27 February requested that the Presidency and the Commission, in close cooperation with the SIS II Task Force, and in consultation with the appropriate instances, submit as soon as possible, but at the latest by May, a report containing an in-depth assessment and comparison of both scenarios.

The report[1] concluded that both the current project and the alternative SIS 1+ RE scenario are, under certain conditions, technically feasible and have the potential to realise the objectives of SIS II set out in the legal framework governing its establishment, operation and use.

Based on this report, the Council concluded on 4-5 June that the development of SIS II will continue on the basis of the current SIS II project and that SIS 1+ RE will be retained as the contingency plan for a period necessary to back the project. The Council also agreed to two project milestones. The aim of these milestones is to prove the stability, reliability and performance of the central SIS II and the proper functioning of vital core functionalities, such as data consistency and reliable message transfer, after significant and important development phases of the SIS II project. The related tests will start as soon as the Commission and the Member States declare their readiness and the technical support function in Strasbourg (C.SIS) confirms that the SIS 1+ test tools are qualified and ready.

The first milestone is scheduled to occur after the performance tests of the system, foreseen for the fourth quarter of 2009. The second milestone is to take place, at the earliest, in summer 2010, after the implementation of central system functional testing. The alternative solution will be kept as a contingency plan until the tests defined in the milestones are accomplished.

2.1.2. Preparations for migration

2.1.2.1. Migration legal instruments

The legal instruments governing the migration from SIS 1+ to SIS II - Council Regulation (EC) No 1104/2008[2] and Council Decision 2008/839/JHA on migration from the Schengen Information System (SIS 1+) to the second generation Schengen Information System (SIS II)[3] (the "migration instruments"), were adopted by the Council on 24 October 2008. Both legal instruments foresee migration to SIS II by 30 September 2009. This date may be postponed by comitology decisions. In any event, the migration instruments would expire no later than 30 June 2010. Given the time required to resolve outstanding issues, and the need to adapt the plan in order to take into account the milestones, neither the initial date for migration from SIS 1+ to SIS II nor the date on which the legal instruments are set to expire, are any longer realistic. Therefore, the Council invited the Commission to submit, as soon as possible but by October 2009 at the latest, appropriate legislative proposals to amend the migration instruments.

2.1.2.2. Converter specification

Regular monthly " SIS II Migration " workshops took place with Member States and the main development contractor in order to define the requirements and specifications for a converter as well as the SIS II migration procedures. The converter is a technical tool to allow consistent and reliable communication between the central systems of SIS 1+ and SIS II during the migration.

The SIS II converter requirements have been prepared by the Commission in close cooperation with Member States' experts and the main development contractor is proceeding with its development.

2.1.3. SIS II network

The SIS II project includes the provision of a wide area communications network, meeting the requirements of availability, security, geographical coverage and level of service, to enable the national and central systems to communicate[4].

The Commission fully implements Article 16 of Regulation (EC) 1987/2006 and of Council Decision 2007/533/JHA as regards the elements of the SIS II network which are under the responsibility of the Commission. The SIS II network has been built up making use of the sTESTA Framework Contract (ENTR 2006 024). The supervision of the SIS II network takes place at the Service Operation Centre (SoC) of the consortium "Orange Business Services/HP" in Bratislava.

The SIS II network implements security requirements and safeguards, including technical and procedural safeguards, to ensure the confidentiality of the SIS data that will be exchanged through the SIS II network. The Commission regularly audits their implementation.

Member States have identified issues regarding the architecture of the SIS II network and that of the Service Operation Centre that they would like to see improved. A meeting with Member States' experts took place on 20 April to discuss the already available and existing security measures related to access to data as well as issues that need further investigation. The Commission has asked its quality contractor to investigate possible solutions to mitigate these risks with an end-to-end security perspective. Work is also under way to tackle other issues identified by Member States to ensure a high level of security for the SIS II network.

The European Data Protection Supervisor will check that the personal data processing activities of the Management Authority are carried out in accordance with the legal instruments. The National Supervisory Authorities monitor independently the lawfulness of the processing of SIS II personal data on their territory and its transmission from that territory, and the exchange and further processing of supplementary information. The European Data Protection Supervisor presented its findings concerning SIS II network security at the meeting of the SISVIS Committee on 12 May.

2.1.4. SIS II security health check

The SIS II security health check was carried out at the central SIS II site in Strasbourg in March 2009. The Commission's security quality assurance contractor assessed the actual implementation of the security safeguards described in the security plan relevant at this stage of the project.

The security health check report provides a number of recommendations. The Commission has prioritized them and is working on scheduling the implementation of the relevant recommendations with the main development contractor. The implementation of the recommendations will ensure that the central SIS II is compliant with the security plan before the end of the development.

An additional security health check will be organised to validate the correct implementation of the recommendations ensuring that an optimal level of operational security will be reached at the start of the migration.

2.1.5. Testing central SIS II

2.1.5.1 Repair of bugs and subsequent testing

Before January 2009, the list of pending bugs was above an acceptable level. The software version deployed in March achieved the correction of most bugs leaving only a small number of bugs assigned to central SIS II, the majority of the latter being resolved in a later software version installed and tested in May.

2.1.5.2 The analysis and repair period

The aim was to drive the system, by the end of the period, to a point where significant progress had been made on all issues, i.e. either the bugs were repaired or, for those which had not been fixed either at national or central level, it was clearly identified how much time and money would be needed to finalize the entire project.

This process provided the Commission with an estimate of the time and financial means needed to complete the project. This information was incorporated in the document that the Commission prepared to allow a comparison of technical scenarios, on the basis of the criteria developed by the Commission and the Council.

This phase focussed on the mechanisms and processes managing communication and consistency between the central and national components of SIS II, as well as the performance and robustness of the SIS II solution. It addressed the following issues:

- Ensuring that messages are correctly exchanged between the national systems and the central SIS II - The tests led to the conclusion that messages are consistently exchanged between the central and national components of SIS II.

- Data consistency on a large volume of data to prove that the system is able to handle the full data consistency process - Data consistency is ensured by a complex set of check and comparison mechanisms. This feature has been extensively probed involving an increasing number of alerts and a variety of Member States with diverse national technical implementations.

- Handling messages and broadcasts - The corresponding tests have shown that the central SIS II correctly handles the manipulation of data, its broadcast and notification; however without meeting the speed specification required. The main development contractor has developed several improvements which were included in a new software version. In order to remove complexity in this area the main development contractor proposed a different implementation of the broadcast mechanism which was developed into a 'proof of concept' and tested with two Member States.

- Measuring the performance of the system in varied conditions - The main development contractor provided a proposal to improve query performance to ensure that border and police queries can be handled in less than one second. A prototype was developed for testing in June and July.

- Robustness of the system - Tests have shown some improvement in this regard.

The various intensive testing and in-depth analysis processes performed during the analysis and repair period led to the resolution of a large number of known issues and bugs. As to all outstanding issues, a root cause was identified and a solution was either designed or implemented.

2.1.6. Architecture review

A comprehensive architecture review was performed by a specialist IT consultant between March and April 2009. On this occasion, a wide consensus emerged amongst SIS II experts on the absence of major flaws in the SIS II architecture. The architecture serves the requirements of SIS II. The hardware is properly sized and "scalable" to ensure the system can grow beyond what is currently foreseen. In terms of design and implementation, a number of recommendations have been made that would improve certain aspects of the system, such as performance, software scalability and ease of maintenance. The business message architecture seems to be over-engineered and could be simplified.

2.1.7. Operational management

Ongoing negotiation with France covering the activities to be undertaken to prepare for the entry into operation of the system, and for the provision and training of staff for the joint management of SIS II, VIS (Visa Information System) and BMS (Biometric Matching System), took place during the period of this report. Amendments to existing contracts were signed in March 2009. The recruited staff have started to undertake technical training sessions as planned. A transition plan with hands-on coaching is under preparation.

The proposal for a legislative package for setting up an agency for the long-term management of large-scale IT systems in the area of justice, freedom and security was adopted by the Commission on 24 June.

3. MANAGEMENT

3.1. Financial implications

To date, the total budgetary commitments made by the Commission on the SIS II project amount to approximately € 72,5 million. The corresponding contracts include feasibility studies, the development of the central SIS II itself, support and quality assurance, the SIS II network, preparation for operational management in Strasbourg, security, biometrics preparations and communication.

Of this amount, around € 41 million had actually been spent at the end of June 2009. The main expenditure items were development (€ 22.4 million), network (€ 10.4 million) and support and quality assurance (€ 4.6 million).

Budget execution |

From 2002 to June 2009 | From January to June 2009 |

Commitments | Payments | Commitments | Payments |

Development | 35.927.151 | 22.448.261 | 0 | 2.792.193 |

Support & quality assurance | 7.660.448 | 4.655.401 | 1.092.950 | 45.934 |

Network | 21.301.901 | 10.368.609 | 1.699.871 | 3.327.614 |

Operational management preparation | 4.946.845 | 2.482.463 | 1.204.233 | 676.570 |

Security | 869.275 | 119.020 | 52.668 | 0 |

Studies | 919.831 | 895.095 | 0 | 227.559 |

Others | 834483 | 96525 | 786.236 | 71.639 |

TOTAL: | 72.459.934 | 41.065.374 | 4.835.958 | 7.141.509 |

During the period covered by the present report,

- approximately € 7,1 million was paid, primarily for the network (€ 3,3 million) and monthly recurring costs;

- about € 4,8 million had been committed (i.e. 12% of the total appropriations for SIS II activities provided in the 2009 General Budget). This lower-than-forecast figure represents the fact that the ordering of new services and products was postponed pending the resolution of technical problems encountered in the development and new Council orientations for the project. For instance, the Commission limited the extension of the network contract to September 2009 instead of the end of the year. The remaining amount is expected to be committed after the summer break.

3.2. Project management

The SIS II project has reached a stage of development and testing which requires the increased involvement of the Member States. Therefore, a global SIS II programme management approach has been in place since January 2009, as recognised by the Council on 26-27 February. The Council of 4-5 June invited the Commission to build upon the experience and lessons learned from that management structure and develop it further. These management changes could be incorporated into proposals for modifying the legal instruments governing migration from SIS 1+ to SIS II.

3.2.1. Global Programme Management Board

The Global Programme Management Board (GPMB) was established by the Commission to ensure enhanced management and coordination of the SIS II project and related activities, including ensuring consistency between the development of central and national systems.

The Board brings together, in compliance with their respective legally-defined competencies, the Commission staff, the Presidency, Member States' experts within the framework of the SIS II Task Force, project managers from the main development contractor and high-level experts from the support and quality assurance contractor.

The GPMB met 21 times during the period covered by this report and has contributed in a very positive way to programme management and has ensured increased Member States' involvement.

3.2.2. SISVIS Committee (SIS II)

The Commission is assisted in the development of SIS II by the SISVIS Committee. There were seven meetings of the SISVIS Committee on SIS II matters in the period January – June 2009.

The Committee is composed of Member State delegations and chaired by the representative of the Commission. Schengen associated countries are invited to attend the meetings of the Committee in accordance with their respective association agreements. Europol and Eurojust are also invited to attend the meetings as third parties, in accordance with Articles 41 and 42 of Council Decision 2007/533/JHA.

In addition to regular SISVIS Committee meetings, working groups of the Committee and workshops, involving Member States' experts, are organised to discuss detailed technical issues. These meetings generally focus on issues arising from specific project deliverables.

- The "Test Advisory Group" (TAG), provides the SISVIS Committee with an opinion on issues related to the organisation, implementation and interpretation of tests. This group held 21 meetings in this reporting period.

- The "Change Management Board" (CMB), provides advice on classification, qualification and the potential impact of correction of reported issues. This working group, which also reports to the SISVIS Committee, met six times during the reporting period.

- The SIS II Migration Workshops have been held since the delivery of the conclusions of the Migration Group, to advise the SISVIS Committee and pursue activities on this critical topic.

3.2.3. National planning and coordination

A working group composed of the Member States' and users' national project managers (NPM) is organised within the framework of the SISVIS Committee. The purpose of these NPM meetings is to deal with detailed planning issues, risks and activities both at the central and national project levels. During this reporting period six NPM meetings have taken place.

Via the SIS II Task Force, Member States and users have been asked to submit monthly reports to the NPM meetings, with a view to providing a detailed update on their state of development.

3.2.4. Council

The Commission takes part in the meetings of the Council working parties and each Council of Ministers responsible for the Schengen Information System, presenting them with an oral report on the progress of the SIS II project and the associated risks. The state of play of the SIS II project was presented at all meetings of the Article 36 Committee.

4. Priorities for the next reporting period

4.1. Global programme management approach

The Council Conclusions of 4-5 June invited the Commission to, "table and immediately implement an enhanced IT management structure and approach for the SIS II project building upon the experience of and the lessons learned from the global SIS II programme management approach established by the Council Conclusions of 26-27 February 2009, which:

- ensure utmost transparency, insight and increased participation of the Member States in order to best fulfil the needs of the project at its current stage of development and testing which require increased Member States involvement,

- meeting the requirements of managing large scale IT-projects, reflect the common will of all Member States to give a fresh impetus to the project while being compliant with SIS II legal instruments, as it is considered by the Council as a key element in the project,

- to this end further integrate GPMB into the whole management structure".

4.2. Testing

4.2.1. First milestone

The first milestone tests are scheduled for the fourth quarter of 2009. Preparatory work has started accordingly. To fulfil the requirements laid down in the Council Conclusions of 4-5 June 2009, the first milestone tests will involve eight Member States, three of which will act as back-ups.

4.2.2. Towards a global testing approach

The tests run since April 2008 highlighted some shortcomings in the current test plan. In particular, some issues related to understanding the system specifications were discovered at a very late stage once systems were connected together.

To address this problem, the Commission will design, together with experts from the Member States and other users, a new test plan based on a global approach to testing, which would guarantee full involvement of Member States and users. This directly reflects the desired new management approach for the project as a whole. This global test team should be directly established on the central SIS II site in Strasbourg to facilitate communication between Commission and test experts from the Member States and other users, the contractors, as well as the future SIS II operators undergoing training at C.SIS. Such a global approach is expected to both enhance the relevance of the tests and to speed up the test phases.

4.2.3. Global test preparations (GT)

The aim of the Global Test (GT) is to demonstrate that the central SIS II, the communication infrastructure and the interactions between central SIS II and the national systems (N.SIS II) work in accordance with the technical and functional requirements set out in the SIS II legal instruments. The tests will also demonstrate that the central SIS II, the communication infrastructure and the interactions between the central SIS II and the national systems (N.SIS II) can work in accordance with non-functional requirements such as robustness, availability and performance. Technical discussions are under way as to how the test results can best be evaluated.

4.3. Migration development

The development of the converter for migration will continue during the next reporting period. Some test activities should also start during this next period.

4.4. Security and data protection

Bilateral meetings between European Data Protection Supervisor staff and the Commission services continue to take place on a regular basis to discuss issues related to SIS II.

5. CONCLUSIONS

The various intensive testing and in-depth analysis processes performed during the analysis and repair period led to the resolution of a large number of known issues and bugs. A few issues are however still pending. Furthermore, the in-depth architecture review performed between March and April 2009 established that the SIS II architecture and overall conception were sound, although improvable.

The Conclusions of the 4- 5 June JHA Council provide orientations for the future of the SIS II project and support the continuation of the current technical solution for SIS II. They also set out the technical milestones for testing this solution in stages, whilst prudently keeping a contingency plan in reserve.

The Commission, in close cooperation with the Swedish Presidency intends to introduce an optimal collaborative project management structure to reflect the stage which the project has reached. This development will allow Member State experts to be even more closely associated with project management for SIS II.

The necessary elements to add new impetus to the SIS II project have therefore been put in place. Still, SIS II remains a challenging project which is not exempt from significant risks. In this regard, the first milestone test, scheduled for the fourth quarter of 2009, will be a crucial step to probe the viability of the technical solution under development.

Annex I

SISVIS Committee (SIS II) and Working Group Meetings

a) Meetings held during the reporting period

JANUARY 2009 |

19 | 'National Project Managers' Meeting |

20 | SISVIS Committee (SIS II Technical Formation) |

14 | Change Management Board |

6, 12 | SIS II Global Programme Management Board |

15, 22,29 | Test Advisory Group |

13 | SIS II project/tests managers |

14 | Migration Workshop |

15 | Project Management Board |

FEBRUARY 2009 |

2, 10, 16, 24 | SIS II Global Programme Management Board |

25 | 'National Project Managers' Meeting |

18 | Change Management Board / Migration Workshop |

26 | SISVIS Committee (SIS II technical) |

20 | SISVIS Committee (SIRENE) |

18 | Change Management Board |

5, 12, 19, 27 | Test Advisory Group |

MARCH 2009 |

3, 9, 17, 23 31 | SIS II Global Programme Management Board |

23 | 'National Project Managers' Meeting |

24 | SISVIS Committee (SIS II Technical) |

26 | Migration Workshop / Change Management Board |

5, 12, 19, 26 | Test Advisory Group |

12 | White paper review / Code and Architecture review |

4 | Test coordination |

13 | Global Schedule |

APRIL 2009 |

7, 21, 27 | SIS II Global Programme Management Board / |

22 | 'National Project Managers' Meeting/ SISVIS Committee(SIS II Technical) |

21 | Change Management Board / Technical Workshop on queries |

2, 8, 16, 23, 30 | Test Advisory Group |

24 | Architecture review workshop |

MAY 2009 |

6, 12, 19, 26 | SIS II Global Programme Management Board |

12, 27 | SISVIS Committee (SIS II Technical) |

27 | 'National Project Managers' Meeting |

7, 14, 21, 28 | Test Advisory Group |

13 | Migration Workshop |

13, 26 | Change Management Board |

JUNE 2009 |

2, 9, | SIS II Global Programme Management Board |

10 | Change Management Board / |

Migration Workshop |

23 | 'National Project Managers' Meeting |

26 | SISVIS Committee (SIRENE) |

4, 11, 18, 25 | Test Advisory Group |

b) Meetings already scheduled for the forthcoming reporting period

JULY 2009 |

7, 14, 28 | SIS II Global Programme Management Board |

18 | Change Management Board |

Migration Workshop |

20 | SISVIS Committee (SIRENE) |

15 | 'National Project Managers' Meeting |

14 | SISVIS Committee (SIS II technical) |

2, 9, 16, 23, 30 | Test Advisory Group |

SEPTEMBER 2009 |

1, 8, 15, 22, 29 | SIS II Global Programme Management Board |

Change Management Board |

Migration Workshop |

15 | 'National Project Managers' Meeting |

16 | SISVIS Committee (SIS II technical) |

3, 10, 17, 24 | Test Advisory Group |

OCTOBER 2009 |

6, 13, 20, 27 | 'National Project Managers' Meeting |

21 | SISVIS Committee (SIS II technical) |

Change Management Board |

Migration Workshop |

1, 8, 15, 22, 29 | Test Advisory Group |

6, 13, 20, 27 | SIS II Global Programme Management Board |

NOVEMBER 2009 |

3, 10, 17, 24 | SIS II Global Programme Management Board |

24 | 'National Project Managers' Meeting |

25 | SISVIS Committee (SIS II Technical) |

Migration Workshop |

Change Management Board |

5, 12, 19, 26 | Test Advisory Group |

DECEMBER 2009 |

1, 8, 15, 22 | SIS II Global Programme Management Board |

15 | 'National Project Managers' Meeting |

16 | SISVIS Committee (SIS II Technical) |

Migration Workshop |

Change Management Board |

3, 10, 17 | Test Advisory Group |

[1] Report on the further direction of SIS II

[2] OJ L 299, 8.11.2008, p. 1.

[3] OJ L 299, 8.11.2008, p. 43

[4] The necessary arrangements for the use of the encryption box for SIS II have to be completed.