Keywords

1 The Notion of a Task Within the Domain of Public Administration—The Responsibilities Associated with the Activities of a Public-Administration Authority

The tasks involved in the activities carried out by a public administration authority are described by administrative law commentators as the notion of competence within which a given public administration authority should operate. In this sense, a “task” is often identified with the so-called material competence of a public administration authority.Footnote 1 However, the issue of the material responsibility of a public administration authority is worth analysing from a broader perspective. As Z. Cieślak suggests,

(…) the notion of “competence” in this context goes beyond legal categories, because it relates to the fundamentals of creating administrative structures (the organisational structure of public administration reflects the structure of its administrative objectives, tasks, and affairs) and the rules of their functioning (…).Footnote 2

According to the author, “competence” in its broader perspective may be characterised as “the sum, type, and content of affairs encompassed by the legally non-indifferent activities of an entity.”Footnote 3 On the other hand, from a strictly procedural perspective, competence is interpreted as only a specific “range of matters” assigned by Acts, which a given entity (a public administration authority or judicial authority) should resolve within its statutory powers.Footnote 4 Therefore, legal procedure experts associate the powers and obligations (competence) of a specific authority with the notion of the “legal capacity of authorities”, defining it as a “set of premises exerting a decisive impact on the capacity to take procedural steps in administrative proceedings”, and these premises, in turn, are determined by the norms of procedural law.Footnote 5

Traditionally administrative law commentators generally linked the notion of the “scope of the activities” (competence, or powers and obligations) of a specific authority to the so-called “task norms” regulating the tasks which should be carried out by a specific administrative authority. This approach was linked to the normative system of a specific public administration authority.Footnote 6 Task norms show the subjective correlation between the activities carried out by public administration authorities and the legal forms of conduct attributed to such activities. Therefore, administrative law norms combine a significance for the state political system with the obligations of a substantive law nature. It should also be stressed that when the tasks in the domain of public administration are carried out in specific matters, they are based on “competence norms”.Footnote 7 In the light of the constitutional principle of legality, concerning the activities of public administration authorities (defined in Article 7 of the Constitution of the Republic of PolandFootnote 8), the responsibility of a public administration authority must arise from the provisions of generally applicable law. Structural legal norms regulating competence—whether defined in a broader, political-system-related, or strictly procedural context—should encompass the four basic components: time, place, subjective features, and the subject of the activities. The essence of the time criterion in the reconstruction of competence (powers and obligations) of the activities of a public administration authority is the basis for the reconstruction of the “rules updating the capacity for action by an individualised entity.Footnote 9”

2 The Position of the Minister of National Defence in the State System

The Minister of National Defence is the central public administration authority, managing the activities carried out by the department of government administration called “national defence”,Footnote 10 and a monocratic component of the central collective authority, namely, the Council of Ministers.Footnote 11 In the light of the Constitution, the Minister of National Defence acts as an intermediary in the authority of the President of the Republic of Poland over the Polish Armed Forces in peacetime.Footnote 12 In a hierarchical structure, the role of the Minister of National Defence is threefold. First of all, the Minister of National Defence is an independent authority of the government administration with independent responsibilities and tasks (arising from the Act on the Authority of the Minister of National Defence and the Act on the Tasks of Government AdministrationFootnote 13). Second, it acts as an entity, being part of a collective authority that is the Council of Ministers subject to the authority of the Prime Minister.Footnote 14 Third, the Minister of National Defence is subject to a certain form of command of the President of the Republic of Poland in terms of having power over the Polish Armed Forces in times of peaceFootnote 15 and conferring the military ranks.Footnote 16 On the other hand, as regards the activities of an entity mentioned in the legal norms defining the responsibilities of the Minister of National Defence (apart from the task of “intermediation” in the authority of the President of the Republic of Poland over the Polish Armed Forces in peacetime), its role is limited only to managing the department of government administration called “National Defence”.Footnote 17 According to the GAD Act, the National Defence Department (limited in time—which is quite unique in comparison to other departments of government administration—to the “time of peace”) encompasses the following affairs: state defence, the Armed Forces of the Republic of Poland, the security of the cyberspace in the military dimension, the participation of the Republic of Poland in the military projects of international organisations, and fulfilling the military tasks arising from international agreements and offset agreements.Footnote 18 The task norm—defining the scope of activities—entrusts to the Minister of National Defence a wide scope of matters, from managing (in peacetime) the entire operations of the Armed Forces through the operational, executive, and personnel matters concerning the performance of state defence tasks, by implementing the commitments arising from the military obligations undertaken by the Council of Ministers, to the performance of tasks as statio fisci, a state or local government organisational unit acting for and on behalf of the State Treasury.Footnote 19

3 The National Cybersecurity System

Undoubtedly, globally noticeable technological advancements have taken place in the recent decades, especially in the field of telecommunications and information technologies, which have had an increasing (nearly decisive) impact, not only on the economic life of societies, but also on matters of the security of citizens, including national defence and security. Digital technologies provide not only huge opportunities but also pose significant risks, as reflected in the growing number of what is known as computer incidents.Footnote 20 The situation has been addressed at the supranational level. In particular, in 2013, the European Commission and the High Representative of the Union for Foreign Affairs and Security Policy published the Communication on a Cybersecurity Strategy of the European Union—An Open, Safe and Secure Cyberspace,Footnote 21 accompanied by a legislative proposal for a Directive concerning cybersecurity. Directive (EU) 2016/1148 of the European Parliament and of the Council concerning measures for a high common level of security of network and information systems across the Union was adopted on 6 July 2016. It imposed on all Member States the obligation to create a system capable of ensuring the necessary level of cybersecurity in information systems in service sectors of key importance for the maintenance of critical societal and/or economic activities, such as energy, transport, banking, financial institutions, health protection, water supply, and digital infrastructure. The specified administrative system, encompassing specialised public administration authorities and related administrative entities (such as Computer Security Incident Response TeamsFootnote 22), acting in line with the principle of a single point of contact responsible for the cybersecurity, is intended to be the mechanism supporting and coordinating the functioning of the entire system. The NIS Directive obliged the Member States of the European Union to implement its provisions until 9 May 2018 (however, it is an example of so-called minimum harmonisation, not preventing the Member States from extending the level of cybersecurity required under the Directive). While implementing the obligations imposed under the above-mentioned Directive, Poland began legislative action in April 2017 when the Council of Ministers issued Resolution No. 52/2017 adopting a strategic document on cyberspace in the form of the National Framework of Cybersecurity Policy of the Republic of Poland for 2017–2022. At that time, the Ministry of Digital Affairs started work on the draft of the Act implementing the NIS Directive. The process of inter-Ministry agreements and consultations,Footnote 23 completed with the decision of the Council of Ministers’ handing over the draft of the Act for parliamentary debate, was started on 8 January 2018.Footnote 24 The bill was submitted to the Sejm on 30 April 2018,Footnote 25 which adopted the National Cybersecurity System Act.

The main objective of the Act, in force as of 28 August 2018, was to organise and define the functioning of the National Cybersecurity System.Footnote 26 The statutory objective was reached in the form of a direct regulatory effect encompassing the named sectors of the national economy, defining the criteria for the identification of the operators of essential services, defining the minimum requirements for the information and communications security of the information systems belonging to operators of essential services and digital service providers, and stipulating the statutory requirements and responsibilities of the Computer Security Incident Response Teams in the field of cybersecurity. Undoubtedly, the test concerning the performance of control and supervisory functions of the responsible public administration authorities defined in the law, regardless of whether their status is of a systemic or just functional nature, will be of key importance for the reliable functioning of the system (administrative structure) from the praxeological point of view.

The systematics of the Act was established on the basis of a model entailing a link between a specific state system hierarchy of various categories and functions of public administration authorities and other administrative entities with tasks attributed to them, and correlated with the responsibilities of the administered entities, defined in the law and characteristic for regulatory legal acts. Customarily, the legislators have separated the control powers (slightly excessively combining them with control responsibilities) of the authorised staff of broadly defined administrative entities. The relatively modern penalty system in the form of financial administrative penalties was additionally implemented, and this will undoubtedly strengthen the importance and “effectiveness” of the control procedure. On the other hand, the “penal-administrative” procedure will definitely be the basic instrument for the implementation of the supervisory (ex-post) competences, and together with ex-ante supervision instruments (especially, involving decisions on permits) should result in a variety of regulating tools allowing the effective stimulation of the conduct of entities functioning on relevant markets.

4 The Task Norms of the Minister of National Defence Within the Framework of the National Cybersecurity System

In the National Cybersecurity System Act, the Minister of National Defence is mentioned in at least four basic state system dimensions. First of all, as the authority competent for these matters and a component of the National Cybersecurity System.Footnote 27 Second, as an independent coordination-control-management authority having the separate tasks entrusted to it by the legislators.Footnote 28 Third, as an authority supervisingFootnote 29 the Computer Security Incident Response Team (the CSIRT MON) functioning at the national level. Fourth, as a member of the collegial body (the College for Cybersecurity), being an advisory and opinion-forming authority of the Council of Ministers on cybersecurity.Footnote 30 It should also be noted that the adoption of the law on the National Cybersecurity System modified the Act on the Departments of Government AdministrationFootnote 31 to some extent, dividing a subdivision component of “cyberspace security”, into a unit functioning within the “civil dimension” (attributing this component to the department of “digitisation”)Footnote 32 and one functioning in the “military dimension” (attributing this component to the department of “national defence”).Footnote 33

As mentioned earlier, the Minister of National Defence is a component of the national security system due to being named in the law as the authority responsible for the cybersecurity of the following sectors: (1).The health-protection sector—encompassing entities subordinate to or supervised by the Minister of National Defence, including entities whose information and communication systems and networks are included in a uniform list of facilities, installations, equipment, and services forming critical infrastructure,Footnote 34 and encompassing enterprises of special economic and defence importance and their performance of tasks in the field of the national defence, as organised and supervised by the Minister of National Defence;Footnote 35 (2) The digital infrastructure sector—for entities listed in the same way;Footnote 36 (3) digital service providers encompassing the same entities as defined above.Footnote 37

Within the named sectors and in respect of the said digital service providers, due to their status as “authorities competent for cybersecurity”, the legislators entrust to the Minister of National Defence the authority of a superior (“imperial”) nature, encompassing, in particular, (1) the competence to issue decisions on recognising a specific entity as an operator of essential services;Footnote 38 (2) the competence to issue decisions on the annulment of decisions recognising an entity as an operator of essential services;Footnote 39 (3) the establishment of a cybersecurity team for a given sector or subsectorFootnote 40 (however, in discharging this duty, the authority competent for cybersecurity is obliged to provide information to the operators of essential services in a given sector and to the CSIRT MON, CSIRT NASK, and CSIRT GOV);Footnote 41 (4) the competence to impose administrative financial penaltiesFootnote 42 forming instruments of supervision exercised in respect of operators of essential services and digital service providers, and, under exceptional circumstances, also in respect of the head of an operator of an essential service.Footnote 43 In addition to the clearly defined tasks performed in the capacity of a superior authority, the legislators have entrusted to the Minister of National Defence, being the authority competent for cybersecurity, an entire set of tasks to be carried out in a non-superior, substantive, and technical or organisational capacity, arising from the control and information tasks.Footnote 44

The legislators have entrusted a separate group of tasks to the Minister of National Defence as a specialised, autonomous public administration authority distinguished in the National Cybersecurity System Act.Footnote 45 Within these tasks, the Minister of National Defence was entrusted with various competences, within the scope of the performance of these “superior”,Footnote 46 legal forms of activity, and those of a “non-superior”—controlFootnote 47 or strictly organisationalFootnote 48 or substantive and technical character.Footnote 49 The legislators entrusted the Minister of National Defence with responsibilities involving tasks in the field of cybersecurity in a specific manner.

The legislators have specified the performance of tasks entrusted to the Minister towards the newly established entity, namely, the CSIRT MON, in an extensive and open manner. Apart from the task of “operating” the CSIRT MON (specified in an extensive and open manner), the legislators do not regulate the mutual relations between these two entities, which are critical for the reliability of the cybersecurity system in the sphere of defence. The issue of the status of the CSIRT MON in the state system goes beyond the framework of this study. It may be even said that a specific kind of “discretion” by the Minister in the performance of this task has been sanctioned, to some extent.

On the other hand, the fact that no other powers have been entrusted to the Minister of National Defence as a member of the collegial body, namely, the College for Cybersecurity, recognised as an opinion-forming and advisory authority of the Council of Ministers, is not surprising, because this “gap” results from the essence of the activities of the collegial authority within the framework of which separate responsibilities are attributed only to the chairs of such authorities.Footnote 50

5 Summary

It is hard to resist the impression that the diversity and multiplicity of tasks attributed to the Minister of National Defence within the framework of the National Cybersecurity System can raise many doubts concerning interpretation within the activities of this supreme (constitutional) public administration authority, which can have unpredictable consequences, especially taking into account its undoubtedly highly responsible function within the public-administration system (directly involving state security). In the field of the cybersecurity of the state, special attention should be drawn to building such legal relations that will be an efficient instrument for the prompt making of correct key decisions. They should be characterised by the maximum elimination of any doubts over interpretation, and the avoiding of any overlapping individual tasks and responsibilities. In the field of cybersecurity, the legislators have expressed a precise definition of the tasks entrusted to the Minister of National Defence only in a limited scope, and have allocated to them a specific set of legal instruments in the form of appropriate legal actions. Clearly, numerous doubts concerning interpretation can be resolved and eliminated in the course of the authority’s practical performance of activities.