Summary of audit results
Electricity supply is a vital service and physical protection measures of different levels have been applied on the objects related to the provision of this service. Requirements for ensuring physical security established by the procedure for protection of national defence objects have been followed on the energy supplying object belonging to AS Elering, so far the only one designated as a national defence object.
However, no specific physical security requirements have been established for other important objects ensuring energy supply which are not designated as national defence objects. Companies must decide for themselves which physical protection measures are appropriate, but to do this, they need more information from the Ministry of Climate as the authority that organises the vital service. So far, some of the measures applied by the companies are weaker than the requirements set for national defence objects. However, these objects are also important to ensure electricity supply.
An interruption in electricity supply has a very significant impact on the functioning of the state, other vital services and the population. It is therefore important that the physical security of significant objects that supply electricity is guaranteed.
During the audit, the National Audit Office assessed how the transmission system operator AS Elering, the distribution system operator Elektrilevi OÜ and the electricity producer AS Enefit Power have prepared for physical attacks against important objects supplying electricity. The National Audit Office assessed five objects, one of which, the object of AS Elering, has been designated as a national defence object related to the provision of a vital service and four have been designated by the electricity companies themselves as objects necessary for critical activities in their business continuity risk analyses.
Despite the changes in the security situation, only one energy supplying object has been designated as a national defence object since 2017, the physical protection of which is regulated by clear rules. For other important objects, it is up to the companies to analyse threats and implement measures, and this has not ensured a more thorough preparation against the threats of various physical attacks. This does not contribute to ensuring the continuity of the electricity supply service as a whole in the event of a physical attack.
In the opinion of the National Audit Office, it is not essential to designate these objects as national defence objects to ensure that the companies themselves apply principles similar to those applied to national defence objects. However, the companies in possession of the objects need more substantive information from the Ministry of Climate as the authority that organises the vital service on the possible threats of physical attack and measures to be taken against specific attacks, so they can take this information into account when selecting and implementing suitable measures.
Recommendations of the National Audit Office
Recommendations of the National Audit Office to the Minister of Climate and the Minister of the Interior:
- assess the need to designate objects that supply electricity as national defence objects.
A review and update of the list of national defence objects is planned for 2025. Electricity companies can apply principles similar to those applied to national defence objects also to critical objects that have not been designated as national defence objects.
Recommendation of the National Audit Office to the Ministry of Climate
- collect and share with electricity companies more substantive information on the threats of physical attacks as well as measures to counter possible attacks.
the Ministry of Climate communicates actively with electricity companies and has shared all the information related to security threats known to the Ministry, which security authorities have allowed to share with the companies. In the opinion of the Ministry of Climate, the identification of security threats should be carried out centrally by the competent authorities. The role of the Ministry of Climate and electricity companies is to assess the impact of risks on electricity supply and to plan appropriate measures.
Recommendation of the National Audit Office to the Minister of the Interior:
- analyse the state’s capacity to ensure protection of national defence objects related to the energy supply service when necessary.
The state’s capacity to ensure protection of national defence objects – including objects that supply energy – is regularly analysed when national crisis plans are prepared.
The minimal and additional security measures meant for national defence objects are not public information. In order to implement principles similar to those of national defence objects on objects that are not national defence objects, the Minister of the Interior and the Minister of Climate should find ways to introduce these measures to electricity companies and, if necessary, advise them on their implementation.