Critical Infrastructure Working Group

The Arbeitsgruppe Kritische Infrastrukturen (AG KRITIS), or Critical Infrastructure Working Group, is a German group of professionals dedicated to improving the IT security and resilience of critical infrastructures (KRITIS) as defined in § 2 (10) of the BSI Act. It was founded in 2018 following the 34th Chaos Communication Congress of the CCC during a working meeting, and it considers itself independent of companies and business associations. The group's founding idea was that Germany's resources for responding to major damage incidents caused by cyber incidents in critical infrastructures are insufficient to cope with the resulting crises and disasters. Through subsequent workshops, the group refined its profile, and in 2019 it decided to separate from the CCC to achieve the greatest possible independence and neutrality. AG KRITIS consists of experts who deal daily with critical infrastructures under the BSI Act and the BSI-Kritis Ordinance, for example through planning, construction, operation, consulting, or auditing of the involved IT systems and facilities. Its members are professionally active in KRITIS sectors including energy, health, nutrition, transport and traffic, finance and insurance, information technology and telecommunications, water, as well as state and administration, and media and culture. The working group coordinates every two weeks by telephone or video conference and meets irregularly for workshops. Besides two leaders, individual members are designated as official spokespersons of AG KRITIS. The group is active in public discourse and policy consultation. Members are regularly interviewed or cited as experts on security vulnerabilities, the IT Security Act 2.0, and other topics around critical infrastructures and digitalization. In September 2020, the BMI conducted an official civil society consultation on the 2016 Cybersecurity Strategy (CSS2016), to which AG KRITIS was invited. Since November 2020, AG KRITIS has been listed in the BMI's online compendium Cybersecurity in Germany as a relevant actor in the German cybersecurity landscape. On 1 March 2021, Manuel 'HonkHase' Atug, one of the founders and spokespersons, was invited as an expert to the Bundestag Committee on Internal Affairs and Home Affairs hearing on the draft amendment to the IT Security Act. On 25 January 2023, Atug was again invited as an expert to the Digital Committee of the Bundestag for the hearing on cybersecurity responsibilities and instruments in Germany. The group publishes statements and position papers on various legislative and technical topics, including the IT Security Act 2.0, the BSI-KritisV draft, the EU NIS and RCI directives, and the DE-Alert technical guideline. It also developed a concept for increasing response capacities in major cyber damage situations (CHW concept). The name 'AG KRITIS' has also been used by other organizations, such as the Interministerial Working Group on Critical Infrastructures and the Working Group on Critical Infrastructures of the Hamburg Authority for Internal Affairs and Sport.

The Arbeitsgruppe Kritische Infrastrukturen (AG KRITIS) was founded in 2018 in the aftermath of the 34th Chaos Communication Congress of the CCC during a working meeting. The founding idea was that the resources of the Federal Republic of Germany for responding to major damage situations caused by cyber incidents in the area of critical infrastructures were insufficient to cope with the effects of the resulting crises and disasters. In subsequent workshops, this problem was discussed in depth and the profile of the working group was sharpened. In 2019, it was decided to separate from the CCC in order to achieve the greatest possible independence and neutrality. At an authority workshop on 2 October 2019 in Bonn, the idea of a cyber relief organization (Cyber-Hilfswerk) was presented for the first time and discussed with participants from BBK, BSI, and CCC. The resulting concept was then presented at the DefensiveCon conference on 7 February 2020 in Berlin and received broad press coverage. Members of AG KRITIS are regularly interviewed or cited as experts, for example on security vulnerabilities, the IT Security Act 2.0, or other topics around critical infrastructures and digitalization. As part of the development of the new Cybersecurity Strategy 2021 for Germany, the BMI conducted an official civil society consultation in September 2020 on the 2016 Cybersecurity Strategy (CSS2016), to which AG KRITIS was invited. Since November 2020, AG KRITIS has been listed in the BMI's online compendium Cybersecurity in Germany as a relevant actor in the German cybersecurity landscape. On 1 March 2021, Manuel 'HonkHase' Atug, one of the founders and spokespersons of AG KRITIS, was invited as an expert in the context of the hearing in the Bundestag Committee for Internal Affairs and Home Affairs on the draft amendment to the IT Security Act. On the occasion of the GSM-R failure at Deutsche Bahn on 8 October 2022, he pointed out that the danger situation in telecommunications, shipping, banks, and insurance was similar. "We have the whole range," he said. "However, there is a lack of understanding for security at all levels." On 25 January 2023, Manuel 'HonkHase' Atug was again invited as an expert in the context of the "Hearing on Cybersecurity – Responsibilities and Instruments in the Federal Republic of Germany" in the Digital Committee of the Bundestag. "Atug spoke of a hidden-object picture of responsibility diffusion. 'Everyone wants to play along, but no one is responsible when something happens.' There is a lack of a defensive cybersecurity strategy in Germany. Moreover, there is no need for vulnerability management. Vulnerabilities should not be managed but fixed, demanded Atug." A statement was submitted by AG KRITIS and represented by Atug. The group consists of experts who deal daily with critical infrastructures (KRITIS) according to § 2 (10) BSI Act in conjunction with the BSI-Kritis Ordinance, for example through planning, construction, operation, consulting, or auditing of the involved IT systems and facilities. The members are professionally active in the KRITIS sectors: energy, health, nutrition, transport and traffic, finance and insurance, information technology and telecommunications, water, as well as state and administration, and media and culture. The working group coordinates every two weeks by telephone or video conference and meets irregularly for workshops. Besides two leaders, individual members are designated as official spokespersons of AG KRITIS. The name "AG KRITIS" has also been used by other organizations: the Interministerial Working Group on Critical Infrastructures and the Working Group on Critical Infrastructures of the Authority for Internal Affairs and Sport in Hamburg.

• 2019

  Decided to separate from the CCC to achieve independence and neutrality.

• 2018

  Founded in the aftermath of the 34th Chaos Communication Congress during a working meeting.

• At an authority workshop in Bonn, the idea of a cyber relief organization was presented for the first time and discussed with BBK, BSI, and CCC participants.

• The resulting concept was presented at the DefensiveCon conference in Berlin and received broad press coverage.

• Invited by the BMI to an official civil society consultation on the 2016 Cybersecurity Strategy (CSS2016).

• Listed in the BMI's online compendium Cybersecurity in Germany as a relevant actor.

• Manuel 'HonkHase' Atug invited as an expert to the Bundestag Committee on Internal Affairs and Home Affairs hearing on the IT Security Act amendment.

• On the occasion of the GSM-R failure at Deutsche Bahn, spokesperson Atug commented on similar danger situations in other sectors.

• Manuel 'HonkHase' Atug again invited as an expert to the Digital Committee of the Bundestag for the hearing on cybersecurity responsibilities and instruments.

Independent, non-commercial working group of critical infrastructure professionals providing expertise and policy consultation on IT security and resilience in Germany.

Product categories. Position papers and statements · CHW concept for cyber major damage response · Expert testimony in legislative hearings

1. 1Startseite - AG KRITISag.kritis.info
2. 2Wikidata: Critical Infrastructure Working Groupwikidata.org
3. 3Arbeitsgruppe Kritische Infrastrukturen - Wikipediade.wikipedia.org