This publication is a Technical report by the Joint Research Centre (JRC), the European Commission’s science and knowledge service. It aims to provide evidence-based scientific support to the European policymaking process. The scientific output expressed does not imply a policy position of the European Commission. Neither the European Commission nor any person acting on behalf of the Commission is responsible for the use that might be made of this publication. For information on the methodology and quality underlying the data used in this publication for which the source is neither Eurostat nor other Commission services, users should contact the referenced source. The designations employed and the presentation of material on the maps do not imply the expression of any opinion whatsoever on the part of the European Union concerning the legal status of any country, territory, city or area or of its authorities, or concerning the delimitation of its frontiers or boundaries.

Contact information

Name: Vytis Kopustinskas

Address: European Commission, Joint Research Centre, via E. Fermi 2749, 21027, Ispra (VA), Italy

Email: vytis.kopustinskas@ec.europa.eu

Tel.: +39.0332.786257

EU Science Hub

https://ec.europa.eu/jrc

The European Commission’s science and knowledge service

Joint Research Centre

JRC Mission

As the science and knowledge service of the European Commission, the Joint Research Centre’s mission is to support EU policies with independent evidence throughout the whole policy cycle.

GETTING IN TOUCH WITH THE EU

In person

All over the European Union there are hundreds of Europe Direct information centres. You can find the address of the centre nearest you at: https://europa.eu/european-union/contact_en

On the phone or by email

Europe Direct is a service that answers your questions about the European Union. You can contact this service:

- by freephone: 00 800 6 7 8 9 10 11 (certain operators may charge for these calls),

- at the following standard number: +32 22999696, or

- by electronic mail via: https://europa.eu/european-union/contact_en

FINDING INFORMATION ABOUT THE EU

Online

Information about the European Union in all the official languages of the EU is available on the Europa website at: https://europa.eu/european-union/index_en

EU publications

You can download or order free and priced EU publications from EU Bookshop at: https://publications.europa.eu/en/publications. Multiple copies of free publications may be obtained by contacting Europe Direct or your local information centre (see https://europa.eu/european-union/contact_en).

JRC118083

EUR 29872 EN

Print

    ISBN 978-92-76-11829-9

   ISSN 1018-5593

   doi:10.2760/010525

   KJ-NA-29-872-EN-C

PDF

    ISBN 978-92-76-11830-5

   ISSN 1831-9424

   doi:10.2760/356320

   KJ-NA-29-872-EN-N

EPUB

    ISBN 978-92-76-14162-4

   ISSN 1831-9424

   doi:10.2760/044759

   KJ-NA-29-872-EN-E

Luxembourg: Publications Office of the European Union, 2019

© European Union, 2019

The reuse policy of the European Commission is implemented by the Commission Decision 2011/833/EU of 12 December 2011 on the reuse of Commission documents (OJ L 330, 14.12.2011, p. 39). Except otherwise noted, the reuse of this document is authorised under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence (https://creativecommons.org/licenses/by/4.0/). This means that reuse is allowed provided appropriate credit is given and any changes are indicated. For any use or reproduction of photos or other material that is not owned by the EU, permission must be sought directly from the copyright holders.

All content © European Union, 2019, except cover page photos, sources: AB Klaipėdos Nafta (left photo), AS Conexus Baltic Grid (middle photo), Elering AS (right photo).

How to cite this report: Kopustinskas, V., Šikas, R., Walzer, L., Vamanu, B., Masera, M., Vainio, J. and Petkevičius, R., Tabletop exercise: Coherent Resilience 2019 (CORE 19) - Final report, EUR 29872 EN, Publications Office of the European Union, Luxembourg, 2019, ISBN 978-92-76-11829-9, doi:10.2760/010525, JRC118083.

Printed in Italy

Tabletop exercise: Coherent Resilience 2019 (CORE 19)

Final report

Foreword

Coherent Resilience is a series of tabletop exercises (TTXs) aimed at enhancing resilience of energy systems. It started in 2017 in Ukraine, continued in 2018. Coherent Resilience 2019 (CORE 19) was jointly organised by the European Commission’s Joint Research Centre (JRC) and the NATO Energy Security Centre of Excellence (ENSEC COE). The exercise evaluation team was led by Naval Postgraduate School (NPS). The CORE 19 TTX was prepared in a series of preparatory meetings – initial planning conference (January 15-16, 2019, Ispra, Italy), scenario development workshop (March 5-6, 2019, Vilnius, Lithuania), main planning conference and vignettes/injects development workshop (April 26-28, 2019, Riga, Latvia). The TTX evaluation was performed in a post-TTX discussion meeting (June 17, 2019, Tallinn, Estonia).

Acknowledgements

The authors acknowledge very active participation of many stakeholders during preparatory meetings and during the main TTX event. In particular, the authors acknowledge contribution of moderators leading discussions in the syndicates:

S1: Monika Zsigri (European Commission, Directorate-General for Energy) and Vytis Kopustinskas (JRC)

S2: Julia Vainio (NATO ENSEC COE) and Matus Misik (Comenius University)

S3: Viktorija Čieminytė (MoD, Lithuania) and Federico Lucidi (NATO STRATCOM COE)

S4: Vytautas Butrimas (NATO ENSEC COE) and Stefano Bracco (ACER)

The authors acknowledge excellent contribution of the TTX Evaluation group in collecting information for this report: Mr Alan Howard (NPS), CAPT Mark Murphy (USN Reserves), Mr. Jack Templeton (NPS), Mr. Mitchell Friedman (NPS), CDR Chad Bollmann (NPS), CDR Ryan Hughes (USN Reserves), CDR Charlie Schwarze (USN Reserves), CDR Thomas Ryan (USN Reserves), CDR Sheila Sklerov (USN Reserves), CDR Chad Brahler (USN Reserves), LT Ethan Mansel (USN Reserves), LT Brandon Davis (NPS), MAJ Brad Hull (USMC, NPS).

The authors are grateful for contribution in various stages of the TTX implementation: Robert Ziegler (JRC), Vismantė Dailidėnaitė (MFA, Lithuania), Mantas Šabanas (Klaipėdos Nafta).

Authors

Dr. Vytis Kopustinskas (JRC)

MAJ Rimantas Šikas (NATO ENSEC COE)

Mr. Lawrence Walzer (NPS)

Dr. Bogdan Vamanu (JRC)

Dr. Marcelo Masera (JRC)

Ms. Julia Vainio (NATO ENSEC COE)

COL Romualdas Petkevičius (NATO ENSEC COE)

Abstract

Coherent Resilience 2019 (CORE 19) was a Tabletop Exercise (TTX) on the Baltic States and hybrid threats related to regional gas supplies and critical energy infrastructure protection. The TTX took place 14-16 May 2019 in Vilnius, Lithuania. The goal of the exercise was to support the national authorities and gas transmission system operators (TSO) of the Baltic States in ensuring supply of gas to consumers and mitigating the disruption over the Baltic region. This three-day regional, multilateral, interagency, and public-private sector event was divided into three phases including an academic seminar, a two-day TTX, and a distinguished visitors’ day that included after-action briefings. This report focuses largely on syndicate responses to the exercise scenario vignettes and injects to include capturing areas of improvement, best practices, and recommendations. The event brought together 108 participants from 14 NATO and European Union countries, who came from 35 different organisations representing gas supply and energy security stakeholders.

1   Overview of Coherent Resilience 2019

Coherent Resilience 2019 (CORE 19) was a Tabletop Exercise (TTX) on the Baltic States and hybrid threats related to regional gas supplies and critical energy infrastructure protection. The TTX took place 14-16 May 2019 in Vilnius, Lithuania and was co-organised by the European Commission’s Joint Research Centre and the NATO Energy Security Centre of Excellence. The event brought together 108 participants from 14 NATO and European Union countries, who came from 35 different organisations representing gas supply and energy security stakeholders (Figure 1).

Figure 1. CORE 19 participants gathered for “family photo” ahead of the TTX

1.1  Purpose

The goal of the exercise was to support national authorities and gas transmission system operators of the Baltic States in ensuring supply of gas to consumers and mitigating the disruption over the Baltic region through the execution of a tabletop exercise, where national plans and regional cooperation were exercised.

The target audience for the event included: energy related ministries (Baltic States, Finland, Poland; gas transmission system operators (Baltic States, Finland, Poland); crisis management officers (Baltic States, Finland, Poland); energy (gas) traders and distributors; main gas consumers (Baltic States); national CERTs (Baltic States); national regulators (Baltic States); and other invited guests. A list of organisations that were in attendance is included in Annex 1 of this report.

1.2  Concept for the Event

The CORE 19 TTX was opened by welcome messages of COL Romualdas Petkevičius, deputy director of NATO ENSEC COE and Dr. habil. Piotr Szymański, Director of Directorate C – Energy, Transport and Climate of the JRC (Figure 2).

The TTX was divided into three phases that included an academic seminar, the tabletop exercise, and the distinguished visitors’ day/after action session.

Phase One, the academic seminar (Figure 3), consisted of a series of expert presentations to better prepare participants for the TTX. Lectures included: Solidarity Mechanism of Gas Supply in EU, presented by Monika Zsigri (European Commission, DG Energy); Public-Private Partnership – Case Study: Baumgarten Incident presented by Gerhard Siegl; National Gas Networks and Future Infrastructure Developments presented by an array of Baltic State, Finland, and Poland TSOs; Ukrainian gas transmission and storage system was presented by Andrii Prokofiev (Ukrtransgaz, TSO of Ukraine); Rules of the TTX were presented by Lawrence Walzer (NPS) and Scenario of the TTX by Vytis Kopustinskas (JRC).

Phase Two of CORE 19 was the execution of the TTX, the main event of the three-day program. Participants were assigned to one of four different syndicate groups: (1) Solidarity Mechanism of the EU, (2) National Preventive Action and Emergency Plans, (3) Strategic (Crisis) Communications, and (4) Cyber Security. While the scenario and vignettes were the same for each syndicate, there were some different injects and each syndicate varied regarding which injects were considered and how the group responded and reported on outcomes. Phase Two is covered in detail in the next section of this report.

Phase Three of CORE 19 consisted of the TTX After Action (Hot Wash) and coincided with the Distinguished Visitors’ Day. This phase allowed each Syndicate to have presenters brief their syndicate assessment and response to a selected inject and highlight overall syndicate outcomes regarding areas for improvement and best practices. The distinguished visitors consisted of an impressive group of senior officials, diplomats, and industry representatives (full list is provided in Annex 2). The participants were addressed by LTC P. Fernandez (NATO ENSEC COE), M.Rute (JRC), R.Karoblis (MoD, Lithuania), M.Masera (JRC).

Figure 2. Welcome messages of COL R. Petkevičius (left) and Dr. Habil. P. Szymański (right).

Figure 3. M. Zsigri (left) and G. Siegl (right) at Academic seminar.

2   CORE 19 Tabletop Exercise

The exercise will be conducted in the light of hybrid threats that form a background for the scenario development. This includes not only the major component of security of natural gas supply in a form of supply disruption, but also a mixture of socioeconomic, geopolitical, strategic communication elements to be considered.

The starting time of the exercise is selected to be January 25 of year 20YY. The duration of the crisis during the exercise is 14 days.

For this time frame two infrastructure situations will be exercised: 2019 current situation and future 2020+ situation.

The scenario used to conduct the TTX was discussed and finalised during the scenario development workshop on March 5-6, 2019 in Vilnius (host: Amber Grid). It was also commented on Vignettes and injects development workshop on March 27-28, 2019 in Riga (host: Conexus Baltic Grid).

2.2  Syndicate 1 – Solidarity Mechanism of the EU: Key Takeaways

Areas for Improvement / Recommendations

Regional Regulations for Prioritising Solidarity Protected Customers. Under the current European Commission rules, solidarity agreements are only between adjacent connected countries’ competent ministries; however, in times of crisis, the use of market-based measures to solve regional crises can be maximised in time if solidarity protected customers are regionally (as opposed to nationally) prioritised and cooperation exists between Baltic States. Prioritising solidarity protected customers regionally allows market-based approaches and cooperation between Baltic States to avoid/delay requesting solidarity supply from each other. Note that solidarity protected customers are only a fraction of protected customers. Gas distribution mechanism must be defined to reflect situations of high demand under limited capacities at gas sources. Recommendation: Establish regional regulations/agreements that prioritise solidarity protected customers across the Baltic States over non-protected customers or protected customers and define allocation of limited volumes of available gas. Allocation procedure of limited volumes of available gas is also important under pre-solidarity phase of a crisis.

Minimisation of procedural delay when trigerring solidarity request: During times of crisis, it is of crucial importance to act quickly and without procedural delay. This concerns many crisis management steps, starting from minimising the time needed to curtail non-protected customers. Quick reaction allows maintaining the gas system operational as long as possible and avoiding request for solidarity gas. In case of need for solidarity gas, the counterpart country should be ready for fast decisions and actions. Recommendation: Consider review of existing procedures and timing estimation, possibly by executing operational tests, of all relevant steps during the crisis management and solidarity activation phases.

Clarification of priority for the needs of protected customers vs gas fired power plants: During severe crisis situations, gas fired power plants may be of vital importance to the stability of power system and supply of electricity to a country. If gas deficit takes place, how available gas is allocated among protected customers and critical power plants? It must be clear which stakeholder does what. For example, which gas shipper or supplier will acquire solidarity gas in another country, not necessarily neighbouring? Do all countries have a supplier designated by state? Recommendation: Consider clarification of rules for gas allocation among the protected customers and critical gas fired power plants.

Regional Distribution Plans when Competing Supply Requests Exist. Situations may exist where two Baltic States request solidarity that depletes the amount of supply available in the providing country. In these cases, it is important to determine how to prioritise the requests to ensure that all or most of the protected customer demand is met throughout the region, instead of disproportionally in certain countries. One method is to determine the regional availability of supply and divide that evenly across all Baltic States. Despite the solution, such prioritisations need cooperative agreement prior to such a crisis. Recommendation: Consider regional solutions to crises to distribute available gas evenly across Baltic States, as well as create the option to request solidarity from any country in the region, not necessarily just directly connected countries.

Common approach to compensation of losses during solidarity phase of a crisis: When solidarity is provided, gas physically comes by curtailing domestic customers and the price is expected to be regulated by agreements. In this case both customers curtailed and gas shippers may get losses due to non-supply or deliveries under non-market prices. Recommendation: Consider defining a common approach among Baltic States for compensation mechanism due to solidarity implementation.

Regional Gas Price Regulation: During times of crisis, particularly once solidarity measures are requested, an opportunity exists for gas supplies to upcharge for limited gas resources. These potential actions by the market could take advantage of a crisis by gouging protected customers based on market opportunity. Baltic States should ensure that protected customers not only have access to supply but also at fair market rates as set in regional solidarity agreements. Recommendation: Ensure regional gas market price monitoring under crisis situations in parallel with initiating the prioritisation of protected customers to protect these customers from price gouging. For the price of solidarity gas, an agreement on the methodology to set it needs to be made between the Baltic States. This price setting methodology could follow regional regulations for prioritising solidarity protected customers and EC recommendation on the legal, technical and financial elements of solidarity arrangements between Member States that includes also guidance on methodology for price setting of solidarity gas.

Authorities for Operators to Enact Emergency Measures: During the initial onset of a crisis, there may be operator actions that minimise the impacts to the overall system. In some cases, actions are not taken until an emergency declaration is official. While this official emergency declaration is under development, consideration/authorities needs to be outlined in regional/national emergency plans for gas operators to immediately implement emergency measures to stabilise the gas system. Recommendation: Consider creating regional/national authorisation for operators to execute emergency measures during times of crisis until emergency declaration is declared and implemented.

Clarification of roles of stakeholders during crisis: During crisis propagation, it must be clear which stakeholder does what. For example, which entity/entities will acquire solidarity gas in another country, not necessarily neighbouring? All countries should appoint reliable entity responsible for “solidarity” management. Recommendation: Consider clarification of roles of stakeholder when setting up a solidarity agreement among Baltic States.

Implement Technical Emergency Resilience Measures in the System: As with all critical infrastructures, planning for and building in technical emergency measures can increase the resilience of the overall system. While the measures themselves provide technical redundancy/robustness, the ability/decision to adapt from the standard system configuration to meet demand in the event of a disruption using a technical emergency measure provides the resilience necessary for the system to recover quickly. Recommendation: Ensure viable technical emergency measures are identified, tested, and included in the national emergency action plans and their regional chapters.

Emergency Action Plans are Critical to Mitigating Crises: Regional and national emergency planning is essential to crisis management. This is particularly important throughout the Baltic Region when it pertains to the complexity and interconnectedness of the gas system. Understanding both the regional and national emergency actions plans can minimise confusion, expedite actions to mitigate the severity of the event, ensure protected customers are supplied, and reinforces the benefits of regional cooperation. Recommendation: Ensure regional and national emergency crisis plans include energy infrastructure contingencies to distribute resources to Baltic State neighbours whom are interconnected and interdependent.

Regional Communication Plans: During times of crisis, a clear need exists for emergency communications cooperation throughout the Baltic States. The importance of identifying communication methods, key stakeholders, critical communication nodes, and prioritisation of customers is vital to ensuring regional solutions exist cooperatively while minimising regional impacts to national-level solutions during times of crisis. Recommendation: Ensure that regional communication requirements between Baltic States exists in National Emergency Plans.

Leverage European Commission for Crisis Information: During crises, Baltic States suffer from a lack of national and regional ability to pull information from Russia. Additionally, it is important to understand information during all phases of a crisis (pre-, during, and post-crisis). In order to ensure that Baltic States have critical crisis information, they must leverage European Commission diplomatic capabilities to receive information from Russia. Recommendation: Establish mechanisms at the European Commission for Baltic States to use and gain vital information regarding gas supplies coming from Russian suppliers, also involving the existing Gas Coordination Group.

Best Practices

Baltic State Regional Cooperation: Syndicate 1 encountered multiple situations where individual Baltic States could source market-based solutions focusing specifically on a national approach. What became clear in this syndicate is the benefit of prioritising a regional approach to crises across the region. When the Baltic States work collaboratively and see the crisis as a regional concern, they were more likely to find innovative solutions that leveraged the flexibility of the overall Baltic State gas system. An example of this is a key takeaway that Baltic States should prioritise protected customers regionally instead of just nationally. Cooperation among Baltic States is a key element of successful gas crisis management and mitigation strategy.

Market-based Measures Solves Short-Term Crises: The ability of a system to reroute distribution, use alternative fuel for power generation, identify alternative fuel supplies, leverage regional contingency supply contracting, and identifying on-the-spot delivery of LNG (prepositioning supply delivery ships) are market-based measures that can be used to solve short-term gas disruptions. These measures delay the need to declare emergency and at later stages avoid triggering solidarity measures.

Interconnection Agreements between Neighbouring Countries: such agreements are in place already today and are in particular helpful not only to optimise operation of the gas network, but also to mitigate system misbalancing issues that could potentially lead to crisis onset or escalation. Agreements are expected to be signed as soon Finland and Poland get their connections to Estonia and Lithuania.

2.3  Syndicate 2 – National Preventive Action and Emergency Plans: Key Takeaways

Areas for Improvement / Recommendations

Notifications to Non-Protected Customers. Participants noted that while there are requirements to notify non-protected customers during supply disruptions, current methods do not result in timely notifications. Recommendation: This is an issue that requires an effective study in order to source proper means and procedures for energy companies to notify non-protected customers of demands in order to reduce consumption due to supply disruptions. The same recommendation is valid also for protected customers.

Notifications to Protected Customers. Notifying protected customers of potential gas shortfalls was a concern for many. Lithuania participants noted that in their plans, it is now the obligation of supply companies to inform protected users to alert levels rather than TSOs and DSOs. Such a regulation would free up government entities to focus on resolving supply shortfalls rather than notifying customers paying for gas from supply companies. Recommendation: Baltic States should conduct their own analysis regarding who should notify protected customers when alert levels are increased to early warning or emergency.

Demand for Protected Customers. Baltic States have plans to prioritise gas to protected customers during supply disruptions. However, there is no clear understanding of the demand of protected customers specifically during summer and winter months or during peak periods. As well, such information would be useful at regional levels. Recommendation: Ensure demand for protected customers is identified during different seasons, peak periods, and at the state and regional level.

Demand for Industrial and Non-Protected customers. If the need to curb the consumption of gas for non-protected customers arises, the regional TSOs and DSOs do not hold the resources to identify the exact data on actual and current gas consumption of each individual, non-protected customer. This lack of data would provide the TSOs and DSOs with limited possibilities for verifying the required decreases in the gas consumption of each non-protected customer. Thus, some customers might benefit from the disruption by continuing to consume gas above the desired amount. Recommendation: TSOs and DSOs would benefit from testing or experimenting with both the time needed to turn off gas supply to many industrial and non-protected customers, as well as refining the metrics used to gather data of the non-protected customers.

Improve gas traders’ crisis communication channels. Participants discussed the importance of including gas traders in situational awareness discussions from early on. In large-scale gas disruptions, where market situation in the region might change considerably during a period outside trading hours, the gas market traders might not be reachable for gas re-distribution discussions, such as sudden solidarity measures. Recommendation: The trading platform should investigate possibilities of maintaining emergency channel of communication that could respond to any major disruptions.

Electricity Emergency Management. The Baltic States have emergency action plans and committees in place to manage the emergency response inn power sector. Recommendation: Develop a cross functional committee in gas sector to implement lessons learned and best practices from the electric power emergency action plans.

Common Language. Regional industry communications are conducted in Russian. Many participants noted that Russian language may not be commonly known in the near future. Recommendation: Regional states should consider codifying the necessity for a common language for regional communications during crises.

Best Practices

Mass Communications to Customers. Each Baltic State’s gas providers use a wide range of communications means (radio, text messages etc.) for mass notifications, which have proved to be effective.

Required Notifications to Non-protected Customers. All energy supply companies are required to inform non-protected customers when there are supply disruptions.

Figure 4. Syndicate 2 discussions during TTX portion of CORE 19

2.4  Syndicate 3 – Strategic (Crisis) Communications: Key Takeaways

Leveraging the full spectrum of communications. Participants referred to specific communications vehicles in discussing communications responses to challenges posed by the vignettes and injects. Regardless of whether the individual communications representatives or crisis response group served as the primary actor, press releases were identified as the primary means of relaying information. In turn, news media (print and broadcast outlets, in the traditional sense of the term) were the primary audience for such documents. As vignettes and injects also frequently mentioned Web sites as sources of information on power availability and related issues, they too merited commentary and discussion as part of the group’s deliberations. Recommendation: Consider incorporating alternate communication vehicles, especially those made possible through social media outlets, when responding to ongoing issues. Reliance on multiple communications vehicles increases the likelihood that key messages will reach stakeholders most likely interested in them.

Integrity of information and sources. Vignettes/injects typically posit that sources of information are under attack, or are otherwise providing inaccurate information. A premium is placed on correcting inaccuracies, confirming the validity of information, and acting to ensure that said information is available as soon as is practical. Recommendation: Identify and use multiple information channels to overcome any potential diminution in credibility among specific sources typically used. Cull information from other, varied sources to enrich narrative (and to in part counter misinformation efforts). Craft key messages for every aspect of operations, and incorporate said messages into boilerplate language made available via information channels.

Misinformation (”fake news”) provides ongoing challenges and opportunities. Vignettes/injects posed several instances of misinformation campaigns that challenged the ability of participant organisations to communicate with key stakeholders in support of their overall mission. In the broadest sense of the term, the challenge seems evergreen as participants have long navigated choppy waters replete with rumour and innuendo. Recommendation: Cultivate new information sources in reference to organisational initiatives that enrich the overall narrative and counter sources and/or arguments that fuel misinformation efforts. Connect with officials/entities in national government that monitor, respond to misinformation (including National Crisis Centres).

Decision making informed by range of geopolitical and technical factors. Participants referenced a range of issues when discussing how to assess and respond to vignettes/injects. These included the complicated, historical relationship with Russia, along with their current role in providing energy resources and shaping local market developments (see related point below); contracts and agreements related to the transmission and storage of energy; and the particulars of sourcing and delivering gas within their service areas. Recommendation: List all factors informing decisions; rank them; and ensure they are accessible for future reference.

Different stakeholders incorporated into strategic communications decisions. Participants repeatedly referenced “the market” as the primary “stakeholder” group that guided their responses to vignettes and injects. Sensitivity to different organisations involved in energy transmission and storage was palpable, as was the need to involve NATO (and to leverage their resources). Consumers of energy (i.e., local citizens) were incorporated into deliberations as dysfunctions of energy markets grew more acute, and thus supply was threatened. Recommendation: Identify specific individuals, subsets within broader stakeholder groups, to be referenced in subsequent communications (both routine and during situations identified as crises). Flesh out communications activities directed towards residents/consumers in service areas. Consider incorporating internal stakeholders (e.g., employees) in subsequent communications efforts, and/or being more explicit in terms of their role in emergency response situations.

Rational, non-critical, and non-accusatory/emotional response to crisis situations. Participants moved into problem-solving mode in response to circumstances presented in vignettes/injects. Reactions to the evolving scenario were non-emotional, with an emphasis on looking to legal and practical considerations. In other words, what mattered above all else was addressing energy transmission/access and storage issues-not responding to parties that might be responsible for difficulties. Syndicate members did not focus on finding a party to blame or hold responsible. Recommendation: Maintain this approach, while leveraging stakeholder relationships to identify potential reactions/perspectives that lay outside it.

Making sure gas flows represents the bottom line. Participant responses to vignettes/injects focused solely on ensuring that gas flowed to their respective service areas. In this sense they employed strategic communications to serve the core missions of the organisations they represented. Recommendation: Identify outcomes and metrics related specifically to communications, in order to better gauge the success of efforts in isolation from other factors that lay outside the communications arena but which nonetheless shape the outcome of business operations.

How “crisis” is defined determines who responds to situations, and how. Participants grappled with the issue of whether a situation represented a “crisis.” That determination proved critical and formative in terms of their overall assessment of each vignette/inject. Whether or not they responded (or a TSO did) or referred a response to an entity outside their organisation (or country) was based on such an assessment. Recommendation: Pinpoint what constitutes a crisis; create process flow identifying communications strategies, participating entities, and messages for crisis and non-crisis scenarios.

Communicators possess technical expertise to determine appropriate strategies for responding to crisis scenarios. Participants assumed the role of technical experts first and foremost and communicators second. To this point, one of the more outspoken syndicate participants oversaw the corporate strategy division for his organisation and thus technical considerations largely informed his comments. In other words, while professional communicators were represented in the syndicate, the group collectively displayed a breadth and depth of technical knowledge that appeared to enable them to make decisions independently without any references to coordinating responses to more technical specialists within their organisation. Recommendation: Identify, cultivate supplemental internal resources who can speak to particular aspects of gas production and delivery operations, while investing more time and energy in exploring other communications strategies and tactics critical for emergency response scenarios.

2.5  Syndicate 4 – Cyber Security: Key Takeaways

Areas for Improvement / Recommendations

Supply Chain Security is the Largest Identified Gap: External factors native to the Baltic States (and other EU countries as well) lead to large supply chain cyber security issues. The small Baltic population, coupled with still-used legacy USSR infrastructure, produce a demand base that is too small to drive custom vendor solutions or behaviour. Operator control over the provenance of their systems and services is reduced by the reality that many products (both technical and labour) must be outsourced and national regulations and laws restrict what provenance requirements can be written into contracts. Outsourcing leads to delayed responses to equipment and cyber issues, and the use of outsourced labour frequently requires remote access, creating additional cyber-attack access vectors. Recommendation: Create a larger (regional or EU-wide) market mechanism for operators to exert pressure on vendors through equipment purchasing consortiums, for instance. Develop mechanisms for ensuring vendor provenance and improving contracting implementation of common cyber security practices; this may require EU legislative relief.

Demonstrated Familiarity with Cyber Security Requirements. The participants in Syndicate 4 were generally unanimous in their assessments of and responses to vignette scenarios and injects; national differences in the Baltic region with regards to crisis processes or laws were few and minor. There were no noted disagreements between participants along public-private lines regarding responses or requirements. This unanimity indicates that there is frequent cross-organisation and cross-border coordination between operators and regulators in the Baltic region. As long as it is feasible, this routine communication creates resiliency and flexibility during crises. Recommendation: Governments should continue to support cross-organisational linkages and communication. Both operators and regulators should consider developing and implementing backup communications methods into National Emergency Plans (i.e., how to replace informal telephone communications with more resilient methods to mitigate telecommunications disruption attacks similar to Ukraine in 2015).

Regional Cooperation is Robust and should be Broadened. There was little difference between national reactions to vignette scenarios and injects, in-line with Takeaway #2 comments. There was specific discussion of ongoing, robust cyber cooperation efforts between Baltic nations. The participants believed a voluntary, regional intelligence-sharing and cyber security agency could add flexibility and improve response time in the event of a crisis. Recommendation: Continue existing national and inter-national coordination efforts and give consideration to increasing national encouragement of their efforts. These existing regional efforts could serve as a model for a formally-chartered regional threat exchange and cyber defence agency.

Regulation is a Double-Edged Sword. The operators in Syndicate 4 universally cautioned against additional regulation because it has the effect of diverting limited cyber security resources to focus on reactive compliance rather than proactive investigation and risk mitigation. If required, regulations should focus on providing general guidance and recommended best practices rather than prescriptive solutions. Regulation review and improvement could help address difficult problems beyond the capability of individual operators and even nations, though, by standardizing equipment supply chains and creating larger equipment pools, improving system and support provenance, removing low-quality vendors, and addressing equipment lifecycle support problems. Recommendation: In consultation with operators, review existing regulations for overlapping or conflicting requirements; develop new or adjust existing regulations to enhance supply chain security and address provenance and support issues.

Best Practices

Baltic State Inter- and Intra-national Cooperation. Numerous injects required private-public coordination and cooperation; Syndicate 4 consistently and rapidly developed consensus assessments and courses of action with little conflict. The public- and private-organisation representatives were knowledgeable of each other’s’ perspectives and actions, implying that robust communications channels already exist and are utilised. Additionally, methods and solutions were consistent across nations in nearly all cases; this is the result of cross-border coordination between TSOs and CERTs as well as national initiatives and exercises for cyber resilience.

Baltic State Vision for Improvement. The Syndicate 4 participants in CORE 19 were committed to identifying best practices and recommendations for improving cyber security, as presented in the Vignette 3 & 4 summaries. Good communications practices between TSOs and CERTs have begun to create de-facto mechanisms for regional coordination.

3   Evaluation of the CORE 19 Tabletop exercise

The execution of CORE 19 was hugely successful in that the event brought together technical experts from the Baltic States and the greater region in order to discuss common threats, emergency plans, crisis communications, and solidarity measures related to regional and national gas supply in order to test plans, share best practices, and identify areas for improvement. Following a tabletop exercise, the next step is generally to produce an Improvement Plan, where detailed and specific actions are identified for completion in order to further develop preparedness and improve resilience in the areas tested during the conduct of the exercise. Given the broad extent of this regional exercise, a single Improvement Plan is unlikely. Rather, it will be incumbent on participating nations and organisations to develop their own Improvement Plans based on the lessons learned from their respective technical experts who participated in this event. While such plans are certain to be executed, another key takeaway from CORE 19 is the close relationships that were developed among national organisations and indeed across the Baltic States and the greater region. It will be important that such relationships, indeed partnerships, continue for such interactions are imperative to the cumulative resilience of gas supply in the region.

Evaluation by participants (Annex 3) during the course of the TTX shows that majority of the participants marked this type of event as highly beneficial, expressed the need for more similar exercises in the future. Many said it was beneficial for their current job duties and also to other colleagues were they be able to attend. Many believed that their engagement helped their agencies to strengthen their capability to enhance emergency planning, prevention and threat response, also from personal involvement perspective.

The TTX evaluation was performed during a dedicated discussion in a post-TTX meeting June 17 2019 in Tallinn, hosted by Elering. The meeting was well attended and many participants confirmed the key takeaways from this exercise.

4   Conclusion

The following key conclusions were identified by the participants:

Tabletop Exercise as a Tool. Participants noted the value of the tabletop exercise as a forum to share best practices, discuss challenges, and review national and regional plans. Having a community of interest to focus on energy security challenges can lead to improvements in resilience of supply and systems through cooperation and communications. CORE 19 participants could see a continuous cycle of annual exercises, where this event is followed organisation, interagency, national, and again a regional-level exercise.

Future Infrastructure as a Positive Change. Planned future additions to regional energy infrastructure - as identified in the scenario 2020+ – was identified as having a significant positive effect on regional and state energy security. It was very clear to the participants that additional infrastructure would significantly lower chances for solidarity request situations. Such solidarity needs are rather low even with today’s infrastructure as it became evident during the exercise. Nonetheless, it was also clear that additional work is required in all areas as it is imperative to further improve resilience.

Cyber Security Remains a Challenge. While tremendous gains have been made in cyber security, experts participating in CORE 19 acknowledged that such security is not yet mature and that energy supplies remain at risk due to current vulnerabilities. Many in attendance further highlighted the importance of ensuring manual operating capability – where practical – be maintained in the event automated systems are catastrophically hacked.

Consider Establishment of Regional Crisis Centers. Given current vulnerabilities in energy security and regional threats, the potential value of establishing Regional Crisis Centres was noted by several technical experts. Participants noted that without a dedicated entity able to view regional atmospherics from such a vantage point, developing campaigns by potential adversaries may be missed in a timely manner necessary to most effectively thwart such activities.

Layered Consumer Levels. Regional national plans all contained measures for both protected and non-protected customers. While there remain challenges in cutting supplies to non-protected customers when shortfalls demand, many participants noted that it would be advantageous to further delineate the two categories into several in order to best facilitate cutting supply and returning supply to customers in a manner that best mitigates challenges and enables a return to normalcy following such events.

Superior Techical Expertise of Regional Gas Suppliers. CORE 19 indeed brought together an array of technical experts from the Baltic and partner states, who represented gas suppliers, regulators, and numerous organisations with cognisance over national and regional energy security matters. It is clear that regional governments and populations are well-represented by these experienced professionals, who gathered at this event in an effort to share best practices and discuss mutual challenges. The many lessons learned during this event by each of the participants are sure to be brought back to their respective organisations and acted upon in an effort to facilitate continued improvements in regional and national energy security/resilience – continue to support these professionals.

A number of key takeaways was identified by each of 4 syndicates and these are provided in the corresponding sections of the report.

Figure 5. R.Karoblis, Minister of Defence of the Republic of Lithuania is addressing the TTX participants and Distinguished Visitors.

Figure 6. M. Masera, Head of Energy Security, Markets and Distribution Unit of the JRC is addressing the TTX participants and Distinguished Visitors.

List of abbreviations and definitions

ACER

Agency for the Cooperation of Energy Regulators

CBP

Cross Border Point

CERT

Computer Emergency Response Team

CS

Compressor Station

DSO

Distribution System Operator

EC

European Commission

ENSEC COE

Energy Security Centre of Excellence

ENTSO-G

European Network of Transmission System Operators - Gas

EU

European Union

FSRU

Floating Storage and Regasification Unit

GCG

Gas Coordination Group

GIPL

Gas Interconnector Poland-Lithuania

JRC

Joint Research Centre

LNG

Liquefied Natural Gas

NATO

North Atlantic Treaty Organisation

PC

Protected Customers

SME

Subject Matter Expert

SPC

Solidarity Protected Customers

STRATCOM COE

Strategic Communications Centre of Excellence

TSO

Transmission System Operator

TTX

Tabletop exercise

UGS

Underground Gas Storage

UMM

Urgent Market Message

List of figures

Figure 1. CORE 19 participants gathered for “family photo” ahead of the TTX

Figure 2. Welcome messages of COL R. Petkevičius (left) and Dr. Habil. P. Szymański (right)

Figure 3. M. Zsigri (left) and G. Siegl (right) at Academic seminar.

Figure 4. Syndicate 2 discussions during TTX portion of CORE 19

Figure 5. R.Karoblis, Minister of Defence of the Republic of Lithuania is addressing the TTX participants and Distinguished Visitors.

Figure 6. M. Masera, Head of Energy Security, Markets and Distribution Unit of the JRC is addressing the TTX participants and Distinguished Visitors.

List of tables

Table 1. List of confirmed Distinguished Visitors of CORE 19.

Annexes

Annex 1. Participating Organisations

ACER

Amber Grid

Conexus Baltic Grid

ELERING

ENTSOG

EPSOG

ESO

Estonian Competition Authority

European Commission, DG Energy

European Commission, Joint Research Centre

European External Action Service

GASO

GASUM

Gaz System

Information System Authority of Estonia

LATVENERGO

LITGRID

Klaipėdos Nafta

Naval Postgraduate School

NFIU

Ministry of Economic Affairs and Communications of the Republic of Estonia

Ministry of Economic Affairs and Employment of Finland

Ministry of Energy of the Republic of Lithuania

Ministry of Foreign Affairs of the Republic of Lithuania

Ministry of Economics of the Republic of Latvia

NAFTOGAZ

National Commission for Energy Control and Prices

NATO Energy Security Centre of Excellence

NATO Strategic Communication Centre of Excellence

NESA

PGNiG

Public Utility Commission

State Security Department

UKRTRANSGAZ

US NAVY

Annex 2. Participants of Distinguished Visitors Day

Table 1. List of confirmed Distinguished Visitors of CORE 19.

Title

Name

Last Name

Institution

Position

Mr.

Saulius

Bilys

AB Amber Grid

CEO

LTC

Pascal

Fernandez

NATO ENSEC COE

Deputy Director

Ms.

Barbara

Jinks

Gas Infrastructure Europe

Director Government Relations

Mr.

Raimundas

Karoblis

MoD, Lithuania

Minister

Mr.

Dzintars

Kauliņš

Ministry of Economics, Latvia

Deputy State Secretary

Ms.

Sigita

Kavaliūnaitė

MFA, Lithuania

Counsellor

Mr.

Mindaugas

Keizeris

ESO

CEO

Ms.

Zane

Kotāne

Conexus Baltic Grid

CEO

Mr.

Deividas

Matulionis

Office of the Government of the Republic of Lithuania

First Deputy Chancellor of the Government

Mr.

Marcelo

Masera

European Commission, Joint Research Centre

Head of Unit, Energy Security, Markets and Distribution

Mr.

Christer

Michelsson

Embassy of Finland

Ambassador

Ms.

Maive

Rute

European Commission, Joint Research Centre

Deputy Director General

Mr.

Robertas

Šapronas

MoD, Lithuania

Defence Policy Director

Mr.

Timo

Tatar

Ministry of Economic Affairs and Communications, Estonia

Deputy Secretary General of Energy

Mr.

Virgilijus

Žukauskas

ESO

Director

Annex 3. Results of Participant Exercise Evaluation Surveys

Quantitative Response Part I

1. Having a mix of inter-agency representatives highly benefitted the event.

2. There should be more similar exercises (TTX, SP, and Full Exercises) in the future.

3. My participation in CORE19 was very beneficial for my current job duties.

4. Participation in CORE19 would be beneficial to my colleagues were they able to attend.

Quantitative Response Part 2

1. How would you rate the strength of your agency with regard to collaborating with other agencies?

2. How would you rate the strength of other agencies you work with in regard to interagency cooperation?

3. Do you believe the engagement helped your agency to strengthen their capability to enhance emergency planning, prevention, and threat response to incidents targeting Critical Energy Infrastructure?

4. After participating in this engagement, would you say your ability to support your agency in building resilience has increased?