Dear Mr. Bergstr?m,

> sorry for not getting back to you before.

Thank you for getting back at all. I for one wasn’t sure this would be a ground where a communication with you could be established 😉

> Yes, I do indeed only correct those two things that touched upon ENISA and were wrong. They were consequently also corrected by the Register.

Good. It’s better that this is corrected, and of course you’ve been right in doing so. Not that I would be in the position of a judge over this, but I can express my agreement with you there nonetheless I hope.

> “The low level of correctness” referred only to the mentioned errors and that a journalist always should check facts from two sources. And you all know that the Internet has low barriers for facutal errors, so there is particular reasons to check with the original sources. In our case, we do exist on the web, so any journalist could easily find, contact us and checked out these factual errors out about the alleged affiliation.

I agree with you there, I only want to point you to the fact that I *did* write to you on Oct 31st, two days before the Register article was published. This piece of news here at the top (TechDirt) was referenced in my mail, as was Mr. Downes’ contact address. Okay, I’m not a journalist, but maybe you could have helped to avoid many misunderstandings if you had intervened earlier.

Now, to the matter at hand, I don’t go along too easily:

> Any other matters, right or wrong, is not in our scope.
> ENISA is not involved in any criminal justice affairs, so you are quite right about why we do not state an opinion on any (!) criminal case. It is very clear in our EU-regulation that criminal law is matter for national member states. So we have no reason and more importantly, no right to comment anything on that, regardless of where a IT-crime, committed or not, takes place in the EU. It is only up to the Member States.

I agree to some extent. Namely insofar as public statements about ongoing investigations are concerned. These should of course not be expected.
However, I think it is evident that “Network and Information Security” can not be dealt with if one keeps out of everything as soon as criminal investigations and forensics, or, in other words, matters of prosecution and trials come into play. There are other aspects of ‘NIS’ as well (like e.g. secure application/OS development or raising awareness, two of Mr. Downes pet subjects, BTW), but keeping away from IT crime amounts to crippling the agency’s objectives.

In a similar vein, see e.g. page 3 of ENISA’s work programme 2005 at http://www.enisa.eu.int/doc/pdf/management_board/decisions/work_programme_2005.pdf:
> However, securing modern networks is not
limited to technical options. It involves legal and policy issues, requires awareness and promotion of best practices, and it is very much dependent on the improved cooperation and information exchange among all stakeholders: from public to private sector organisations, as well as from judicial to law enforcement agencies and services of the Members States.

Of course, the autonomy of the respective national prosecution and jurisdiction must be respected, but this is taken care of in the way that ENISA’s activities are projected anyway:

From http://www.enisa.eu.int/about/context/index_en.htm:
> The Agency was set up to enhance the capability of […] the Member States […] to prevent, address and respond to network and information security problems.

Now, if either the allegations made to Mr. Downes (drug sales by unsolicited email) are true or false, there is the capability of the greek authorities to adress and respond to network and information security problems (in this case a suspected spammer/internet dealer operating from within their area of responsibility) at issue. Either the resp. state’s capability is sufficient or it isn’t – but it’s an affair that is bound to deserve your attention, and even more so, since the person suspected of those crimes is an IT expert (which either way should present special challenges for the greek authorities’ capabilites of addressing and responding etc.), even more so since this affair is taking place in a country which … okay, let’s try to play it cool … is at least not represented in Interpol’s “European Working Party on Information Technology Crime” (http://www.interpol.org/Public/TechnologyCrime/WorkingParties/Default.asp#europa), and since the case is handled in such a way that presently it seems (from what I’ve been told) that not even the involved police force knows much, if anything, about the “Athens computer lab” where the seized computer is supposedly being examined now, and finally even more so since it is all happening in front of your door!

The mentioned ENISA page gives more detail on what ENISA could do:
> the Agency?s tasks will be focused on:
> – Advising and assisting […] the Member States on information security […]. [The work programme says assistance needs to be called for, advice doesn’t. p.4]
> – Collecting and analysing data on security incidents in Europe and emerging risks;
> – […]
> – Awareness-raising and co-operation between different actors in the information security field, notably by developing public / private partnerships with industry in this field.

Three out of four activities that ENISA says it’s focusing on could be deployed in the present case, which isn’t so bad, is it?
(The work programme lists 6 operational functions, 4 of which would be applicable, but everyone will have to look these up him-/herself 😉

So, I hope to have shown that the case in question falls in your scope and that you have means and activities projected which could by deployed in it.
Of course, I know that ENISA is also still in the process of being consolidated itself and may have other priorities, but IMHO to decline from getting involved with it – when you’re asked to get involved by or on behalf of a local, european IT SME – would require a more substantial consideration. You don’t have to share it, but I think I am founded to expect you to effectuate such a consideration.

…And then, on my journey through the ENISA website, I saw this:
From ENISA’s What’s New Page:
> The Swedish Emergency Management Agency (SEMA) is visiting ENISA?s premises in Crete 10 November.

I’m not sure SEMA has been contacted in this case – not by me at any rate. But if they’ve been to your place and the disputed arrest of a Swedish citizen who is an IT expert just around the corner wasn’t mentioned at all, then I would think this to be a dramatic failure of the involved parties. This would namely reinforce all the prejudices one might have about EU bodies and agencies being just parts of some bureaucracy and having cut off all roots to ‘RL’ – to ‘R’eal ‘L’ife, in this case of people literally next door having immense problems in an area where one is internationally showing off one’s expertise.
Again, I don’t expect a statement on this, but I would expect “raised awareness” and attention.
… And sometimes it would be a good, meaning noble and diplomacy-wise non-suspicious, sign to just say – “Yes, it has our attention.”

best regards,
Andreas Wagner