4 Risks and vulnerabilities

The health and care sector is facing changing and more complex risk and threats. Our work on health emergency preparedness must be based on the risks and vulnerabilities we face, so that we are best prepared to address future crises. At the same time, we must have basic emergency preparedness that takes unforeseen events and crises into account. It is particularly important to focus on risk areas involving a high probability and major consequences, as well as risk areas involving a lower probability but major consequences. Six key risk and vulnerability areas are discussed in this Report to the Storting:

• hybrid threats and war

• cybersecurity

• security of supply

• pandemics and infectious diseases

• secure supply of safe drinking water

• nuclear incidents that threaten lives and health

Climate change entails serious consequences. Work on health emergency preparedness must integrate incidents and consequences of climate change. This will apply both to the strategic work of the Health Emergency Preparedness Council and to the committees at the agency level, as well as locally in municipalities and the health service. The Norwegian Government will consider how the national analysis of vulnerability and adaptation needs in the health and care sector as a result of climate-related changes and acute climate events, should be followed up to ensure adequate health emergency preparedness.

4.1 Hybrid threats and war

A demanding and more complex security environment

Europe is in the midst of its most serious security situation since the Second World War. Russia’s unlawful invasion of Ukraine marks a watershed moment for Europe and demonstrates the threat that Russia can pose.

The rules-based international order is under attack. Fundamental values and perception of the rules governing international politics are the crux of the conflict between Russia and the West. Democracies and human rights are under pressure in an increasing number of countries. China’s global ambitions are being made clear, and the rivalry between China and the U.S. is growing. China’s development is also increasingly important for Norway. Norway must therefore be aware of China’s increasing ability and capacity to exploit economic instruments for its own gain.

The open society we enjoy is being exploited by threat actors. The instruments used may in isolation be of minor significance, but the total sum challenges Norwegian decision-making processes and our national security interests. Hybrid threats may include instruments such as information gathering, influence operations, the spread of disinformation, cyberattacks, strategic acquisitions of Norwegian enterprises and mapping of critical infrastructure.

The sabotage of the Nord Stream gas pipelines in the Baltic Sea, high levels of mapping activity against critical Norwegian infrastructure and cases of serious insider activity are examples that shed light on the range of challenges we are facing. The health and care sector can be a target for destabilising operations, the purpose of which is to undermine the public’s trust in critical societal functions. The attacks carried out by pro-Russian actors against Norwegian hospitals in January 2023 are an example of this. The attacks posed no real risk to either patients or operations, and this type of operations must be viewed as part of a deliberate and continuous grey zone aggression through influence and propaganda operations. However, these examples show how important it is to protect critical infrastructure.

The intelligence threat against Norway persists. Norwegian emergency response systems will probably be of interest to foreign intelligence services. The intelligence and security services highlight Russia, China, Iran and North Korea as countries that have an interest in conducting intelligence activities in Norway in 2023.1

The terrorist threat to Norway is very real. Attacks carried out by individuals with or without links to extremist organisations continue to pose the greatest terrorist threat. The shooting attack in Oslo on 25 June 2022, and the terrorist attacks on the government building complex and Utøya on 22 July 2011, are examples of such attacks in Norway.

Health emergency preparedness – a key component of total defence

Complex instruments, artificial intelligence, technological development and cognitive warfare will influence the threat situation and warfare of the future. Among other things, the Defence Commission points out how it is likely that the distinction between peace, crisis and war will become more blurred in the years to come. This distinction is being challenged by both state and non-state actors. In order to meet the serious security situation, there is a need to strengthen cooperation between the Norwegian Armed Forces and civil society. Total defence constitutes an important framework for this strengthening. Several coordination forums have been established to ensure the cross-sectoral coordination necessary for effective and appropriate development. For example, the Ministry of Justice and Public Security and the Norwegian Directorate for Civil Protection have coordinating tasks related to the further development of Norway’s total defence. The civil-military work of the health and care sector will be viewed in the context of work in the established coordination arenas.

The Defence Commission highlights health emergency preparedness as a vulnerability in total defence and an area that will require particular attention.2 Measures proposed in the Report to the Storting are a component of strengthening health emergency preparedness and can contribute to a more robust health and care sector with an increased ability to support the Norwegian Armed Forces in war.

Clear procedures for management and governance

The Minister of Health and Care Services is constitutionally responsible for ensuring that health and care services are provided across the crisis spectrum. The Ministry of Health and Care Services will strengthen the strategic governance of civil-military health cooperation. This requires close cooperation with relevant ministries, which includes ensuring coordination in the management of subordinate agencies in areas that affect health emergency preparedness. The Norwegian Government will establish a committee at the agency level for civil-military health emergency preparedness cooperation. This committee will replace the current formalised civil-military cooperation arena.3 The committee shall be complementary and support the work at the ministerial level, in the Central Total Defence Forum and the Agency Forum for Total Defence.

Although health services have emergency preparedness, training and experience in handling mass casualties, security crises and military conflicts will involve a higher degree of complexity and the rules will differ from those in civilian crises. It may be necessary to subject all health resources in Norway to common national governance for the best possible utilisation and coordination of available resources such as personnel, means of transport, land, pharmaceuticals and equipment. Such an adaptation will include both private and public service providers. The Health Preparedness Act and other health and emergency preparedness legislation contain provisions that provide the necessary powers. At the same time, the Norwegian Armed Forces will play a prominent role in coordinating the necessary resources for national defence or the defence of Alliance members in war.

Currently, civil-military health emergency preparedness cooperation is primarily based on agreements and various cooperation schemes. Furthermore, there is extensive coordination and use of liaisons in the agencies. While the Norwegian Armed Forces’ operational efforts are managed by the Norwegian Armed Forces Joint Headquarters, the health and care sector has several administrative parts and enterprises that are partners of the Norwegian Armed Forces. The Norwegian Directorate of Health is the main administrative focal point for the Norwegian Armed Forces in civil-military cooperation, heads the current formalised civil-military cooperation arena4, and administers the cooperation agreement between the health and care sector and the Norwegian Armed Forces. At the same time, cooperation agreements have also been drawn up between the Norwegian Armed Forces and several health authorities. The Norwegian Government will strengthen civil-military cooperation on health emergency preparedness to address mass casualties and war, and will clarify lines of leadership and governance between the Norwegian Armed Forces and the health and care sector.

A unified health service – planning prerequisites and emergency preparedness plans

Health emergency preparedness must be further developed in order to be able to address serious security situations. Health and care services must be coordinated with relevant actors with regard to how the health service is to address the entire crisis spectrum, including war. The starting point is that we have a unified health service in Norway that is responsible for medical evacuation, diagnostics, treatment and rehabilitation including in war and for mass casualties in war. The Norwegian Armed Forces have very limited medical services that are adapted to urgent military needs. It is necessary to look at medical services and the health and care services in context.

Zoom in on image

Photo: The Norwegian Armed Forces, Ole Sverre Haugli.

A joint risk and vulnerability analysis shall form the basis for the development of scenarios and common planning prerequisites for civil-military health emergency preparedness. This requires unambiguous clarifications of mutual expectations between the Norwegian Armed Forces and the health and care sector. The health and care sector must review what this entails for civilian preparations and preparations coordinated with the defence sector.

A military conflict in which Norway is a warring party will require major restructuring and trigger a need for mobilisation of personnel, competence and resources. A military conflict in which Article 5 is triggered outside of Norwegian territory will also involve the health and care sector. Decisions concerning the control of resources, treatment capacity and prioritisation of patients will be subject to challenging prioritisation assessments in the health and care sector. The Norwegian Government will ensure that the health and care sector develops plans and guidelines for this in cooperation with relevant emergency preparedness actors, and practises interaction in all parts of the crisis spectrum.

Healthcare personnel – a limited resource

The Norwegian Armed Forces are dependent on personnel and competence from the health and care services to safeguard functions and their own needs for medical services. Emergency preparedness agreements and mobilisation control are arrangements that ensure the Norwegian Armed Forces health personnel and competence. These personnel work in the health and care services on a daily basis. Health personnel and specialist competence are already a vulnerable resource in the health and care services. It is therefore important to clarify which personnel must be made available to the Norwegian Armed Forces. As part of the pilot project for the development of health emergency preparedness plans, efforts are underway to coordinate the allocation of forces between the regional health authorities and the Norwegian Armed Forces. The general guidelines relating to the use of personnel will be determined by the Norwegian Government.

Real-time information sharing

Shared situational awareness increases our ability to manage crises across the crisis spectrum. Likewise, our ability to handle different events depends on access to information and communication. This requires good and coordinated communication systems between the Norwegian Armed Forces and health and care services, both on a day-to-day basis and in crises. For security reasons, parts of the planning system must be protected, and communication must take place via classified systems. Therefore, it is important that the health and care sector has access to systems for classified communication, personnel with security clearance, and that knowledge and culture in terms of handling classified information are further developed in the sector.

Common capabilities – medical evacuation

In principle, the capacity of the health and care services to carry out medical evacuations is not dimensioned for the handling of mass casualties. Medical evacuation of a large number of casualties over time therefore requires more and different transport solutions than those used in peacetime.

The Norwegian Government is investigating what capacities for medical evacuation Norway will require in the future. In addition to the need for strategic aeromedical evacuation, the Norwegian Government will examine solutions for means of transport by road, rail and sea. The aim is to further develop a generic toolbox where means of transport can quickly be mobilised. One example could be requirements for restructuring transport solutions when entering into agreements with bus companies. The war in Ukraine has shown how repurposed buses can be effective means of transport in an armed conflict. The work is cross-sectoral and involves examining how society’s resources can best be utilised.

Textbox 4.2 Medical evacuation from Ukraine

Zoom in on image

Photo: The Norwegian Armed Forces, Maria Smørholm.

Norway is contributing with aeromedical evacuation of patients from Ukraine for treatment in Norway and in other countries. The medical evacuation from Ukraine is a collaboration between several government ministries, the regional health authorities, the Norwegian Directorate of Health and other Norwegian health services, the Norwegian Armed Forces, SAS, the Directorate for Civil Protection, the Directorate of Immigration and the Directorate of Integration and Diversity. The medical evacuation takes place through the EU’s Civil Protection Mechanism. Since the start of the medical evacuation in August 2022, 333 patients have arrived in Norway as of 15 November 2023. Furthermore, during the same period, Norway has contributed to medical evacuation by flying 1,067 patients to hospitals in other countries. In addition, 591 relatives have been transported with the patients.

SAS makes aircraft available and the Norwegian Armed Forces provide medical personnel and materiel. These are health personnel who work in Norwegian hospitals on a daily basis. The Norwegian Government has decided to extend the provision of transport of patients until the end of February 2024, at the request of the EU. If needed, a further extension of this service will be possible. The current agreement between the Norwegian Armed Forces and SAS on strategic aeromedical evacuation is valid until May 2025. After this time, a new agreement will be in place as a result of SAS’ fleet change.

Inter-ministerial Working Group

The Norwegian Government will better equip health and care services to address security crises and war. The Norwegian Government will therefore appoint a fast-track inter-ministerial working group headed by the Ministry of Health and Care Services and with representatives from the Ministry of Defence and other relevant government ministries, as well as relevant agencies and the Norwegian Armed Forces. Among other things, the working group will prepare a framework for civil-military health emergency preparedness work, clarify the Norwegian Armed Forces’ needs and expectations for services from the health and care sector, help clarify lines of leadership and governance, and prepare a mandate for the Committee for Civil-Military Health Emergency Preparedness Cooperation, cf. section 2.2.1. The working group will submit its report by the end of 2024.

Increased awareness of complex threats

Addressing complex threats places great demands on cooperation across sectors. The establishment of the National Intelligence and Security Centre (NESS) is an important measure in this context, where the three security and intelligence services (the Norwegian Intelligence Service, the Norwegian Police Security Service and the Norwegian National Security Authority) and the ordinary Norwegian Police cooperate on analysing and disseminating information regarding complex threats. The Ministry of Justice and Public Security has the main responsibility for following up and coordinating the Norwegian Government’s work on issues related to complex threats. At the same time, each sector is responsible for establishing sufficient resilience to withstand complex threats based on the overall assessments of central authorities.

The ability of health emergency preparedness to address complex threats is strengthened through increased resilience. Important components of understanding what complex threats include knowledge of the threat situation, one’s own values and vulnerabilities and having a shared situational awareness, both within the sector and across sectors. The Ministry of Health and Care Services will actively use the newly established Health Emergency Preparedness Council in this work. At the same time, the Ministry will facilitate a competence boost in the areas of security, emergency preparedness and defence as part of the health emergency preparedness through the preparation of a competence plan.

The Norwegian Government will:

• strengthen civil-military cooperation on health emergency preparedness

• appoint a fast-track inter-ministerial working group, chaired by the Ministry of Health and Care Services and with the participation of the Ministry of Defence and other relevant government ministries, to establish an overall framework for civil-military health emergency preparedness work

4.2 Cyber threats and vulnerabilities

A heightened digital risk situation

Cyberattacks and the handling of digital threats and incidents have become part of the normal condition. Cyber threats to the health and care service are steadily increasing. The 2021 Defence Commission notes that there is “a heightened digital risk situation”.5 Digital solutions constitute an increasingly larger part of the health and care sector. This is a desirable development that strengthens patient safety, contributes to better collaboration and documentation and streamlines and simplifies everyday life. Digital systems are also essential for logistics, management, research, procurement and supply lines. At the same time, digitalisation also represents increased complexity and creates new vulnerabilities and attack surfaces. ICT systems and electronic communications infrastructure are exposed to both intended and unintended incidents.

The complexity and diversity of systems increases the risk of user error and system failure, and the threat actors know how to exploit the vulnerabilities. Health data is an attractive target for many and is noted as one reason why the health and care sector is of particular interest to threat actors. Threat actors range from individual hackers and opportunistic criminals, to organised criminals and states with the capacity and willingness to use methods that can have drastic consequences. State actors are willing and able to engage in long-term, strategic operations.

In recent years, accessibility to digital systems in the health and care sector has failed on several occasions. There have been power failures, fires, climate events and cases of viruses or attacks on the systems. The health and care sector has procedures for shutting down and isolating parts of the ICT infrastructure when an incident is detected, in order to avoid spreading and reduce the scope of harm. Given the current threat situation, the sector must prepare for even larger incidents, where it may be necessary to reduce services locally or regionally, relocate patients and reschedule services. This involves planning for scenarios that have major societal consequences. The planning framework for such scenarios must be kept up to date and exercises are necessary for learning and improvement.

Cyberattacks in health and care services can lead to downtime and loss of systems, or that data are affected, damaged or are lost. Cyberattacks can affect patient care and patient safety, or pose a financial and privacy-related threat. Power failure and electronic communications infrastructure can also render ICT systems inaccessible, with many of the same consequences. ICT systems can function locally and in individual departments, even if regional and national services become inaccessible. Emergency power and generators can keep local systems running for a certain period of time, but this is cumbersome and may require manual follow-up work and control on medical records.

Preventive measures adapted to the diversity of actors and needs of the sector

Preventive measures are continuous improvement efforts to which the sector devotes considerable resources. However, the many actors and enterprises in health and care services have different capacities for following up cyber security. Some actors are large enterprises with their own security environments, such as regional health authorities and large municipalities. There are also thousands of small actors such as GP surgeries, private specialists and municipalities. They are dependent on support and guidance to safeguard operational responsibility for ICT systems and infrastructure.

Instruments for preventing cyberattacks must be adapted to the diversity of actors in the health and care sector. The enterprises are subject to a number of requirements and regulations relating to information security and internal control. The GDPR requires “measures to achieve a level of security appropriate to the risk”, and sectoral legislation stipulates requirements for internal control and risk assessments. Agencies in the health administration and the regional health authorities have been tasked with working systematically on cyber security, including the introduction and implementation of the National Security Authority’s Basic Principles, risk and vulnerability analyses, updating of plans and implementation of exercises. Value and damage assessments of health data registries and associated ICT systems shall be included as routine analyses. Independent actors, such as municipalities and GP practices, are subject to the same statutory requirements.

An code of conduct has been prepared for information security in the health and care sector to support the actors. The code of conduct stipulates requirements that specify and supplement the formal legislation. The code of conduct is intended to promote mutual trust in the exchange of information within the sector and to maintain an acceptable level of security therein. The Norwegian Directorate of eHealth is the secretariat for the code of conduct. In the revised 2023 National Budget, the Norwegian Government presented a decision on changes to central health administration. The authorities’ tasks related to digitalisation, including cyber security, will be included in the Norwegian Directorate of Health’s tasks when the Directorate merges with the Directorate of eHealth from 1 January 2024. The Ministry of Health and Care Services will ensure that the code of conduct is updated and further developed as new technologies emerge, when relevant legislation is renewed or new forms of service are adopted.

The Norwegian Health Network state enterprise has established HealthCERT (Computer Emergency Response Team) for the health and care sector. The HealthCERT is a central and important surveillance and competence environment that assists enterprises in the sector. The HealthCERT monitors traffic and incidents in the health network and cooperates with the Norwegian National Security Authority and other actors, both domestically and internationally. It provides security services to all actors in the health and care sector and assists the sector in preventive activities and in the management of incidents. HealthCERT supplements corporate responsibility, but does not replace it.

Zoom in on image

Photo: The Norwegian Health Network, Vegar Herstrøm.

Through Proposition to the Storting No. 78 (2021–2022) Economic measures as a result of the war in Ukraine, NOK 40 million have been allocated to funding a CERT to support and strengthen the municipalities’ work on cyber security in general - a cross sectoral CERT for the municipalities. The Norwegian Government has decided that this CERT for the municipalities will be established in affiliation with HealthCERT. The new CERT will function as a front-line service for the municipalities and coordinate inquiries from other response teams so that the municipalities have a single point of contact in the event of incidents.

The Norwegian Government has established a health technology stimulous package to support municipalities in their digitalisation efforts. A guidance service will also be established for the requirements and standards that apply to the sector. Security requirements and how regulations related to privacy and security are to be interpreted will, among other things, be part of the scheme. The health technology scheme is presented in the National Health and Collaboration Plan together with the general digitalisation policy for the sector.

Competence prevents errors and reduces risk

It is crucial that enterprises in the health and care sector acquire the necessary knowledge and keep abreast of the changes in risks and threats. Competence in cyber security at all levels is a prevention element in all enterprises. Weak security behaviour can offer threat actors a pathway into systems. The Norwegian National Security Authority notes that it is often the same mistakes that are made in both public and private enterprises, and that most cyberattacks could have been averted or limited had the Norwegian National Security Authority’s Basic Principles been followed. Errors include weak passwords, sharing access with more people than necessary to perform tasks, outdated systems, and exploitation of human weaknesses.6 Competence and a security aware culture can have a positive effect on trust in the population in relation to and between health personnel and between enterprises. The Norwegian Government will assess existing competence measures with the aim of ensuring that instruments that function well can be shared and reused throughout the sector. The Norwegian Government follows up the number of student admissions in the annual budget processes and has proposed an increase of 100 admissions to ICT programmes for 2024.

Long supply chains that are difficult to control

ICT-systems consist of components from many different manufacturers. Furthermore, the software in each component can use source code and software libraries from many different companies, and not all suppliers have an overview of their own software dependencies. The Defence Commission7 notes that a “-large proportion of Allied countries’ critical digital infrastructure is owned and operated by private enterprises, often outside their own borders and, jurisdiction. This means that important decisions on development and security in the digital spaces are largely made by commercial and non-state actors outside the traditional inter-governmental arenas.” Managing risk in such chains is demanding at both the enterprise and government levels. It is challenging to have to review all subcontractors and contractual relationships involved.

In Report to the Storting No. 9 (2022–2023) National control and cyber resilience to safeguard national security – As open as possible, as secure as necessary, the Norwegian Government highlights the need for an overview of complex supply chains through preventive security measures pursuant to the Security Act, use of other relevant legislation and national ownership. As a follow-up to the Report, the Norwegian Government presented Proposition to the Storting No. 109 (Bill and Resolution) (2022–2023) Lov om digital sikkerhet [Act related to cyber security] in the spring of 2023.

Artificial intelligence has major security implications

New technologies such as artificial intelligence, synthetic biology and neurotechnology are being developed globally across state and private actors. There are major constructive and destructive possibilities in these technologies.

Artificial intelligence is important for the health and care sector, and although there is considerable activity, we have only just begun to use this technology. Increased competition, large volumes of data and the improvement of machine learning have led to major breakthroughs and advances in recent years. Both the human and non-human contributions in such systems have major security implications – and thus a considerable potential for harm.

The Norwegian Government is increasing its research efforts in artificial intelligence by at least NOK one billion over the next five years. The one-billion kroner research allocation will contribute to greater insight into the consequences of this technological development for society. The health and care sector is well positioned to create good projects as part of this initiative. Norwegian health authorities are also closely following the establishment of basic security principles for the development of artificial intelligence, particularly through the European Commission’s proposed regulation – the AI Act. We are actively working in several environments in the sector to clarify how this technology can be used in a responsible manner, and what is needed for us to maintain sufficient control over any security-threatening aspects of the technology. Artificial intelligence will be one of the topics in the Norwegian Government’s national digitalisation strategy, which is being prepared.

The EU as a driving force for enhanced cyber resilience

The EU is working broadly to develop its resilience and reduce vulnerabilities after its cooperative relationship with Russia ceased in conjunction with the war in Ukraine. Several regulations have been adopted to secure critical infrastructure and information security in enterprises and in digital equipment connected to the Internet. In particular, the directives on security of network and information systems (NIS Directive) and the EU’s Cyber Resilience Act are key to cyber security. The NIS Directive covers enterprises in the health sector, and the implementation of the Directive is part of the Norwegian Government’s proposal for an Act related to cyber security. The Act will set minimum requirements for security in network and information systems and reporting of incidents. The NIS2 Directive, recently adopted by the EU, expands its scope and clarifies the security and reporting requirements. The Directive proposes information security requirements for products connected to the Internet, and that manufacturers of the equipment be held liable for the information security of the equipment. Through this legislation and a number of other directives related to data and digital services, the EU is working to establish itself as a geopolitical centre for digital development. Democratic values such as solidarity, privacy, sustainability and freedom of choice shall be key to the Digital Decade8 until 2030.

The European Commission’s proposed regulation for the European Health Data Space is intended to contribute to more comprehensive and cohesive requirements for ICT systems in the health sectors in the EU. Minimum requirements for security and privacy in digital solutions are part of the proposal. The proposed regulation is of relevance to the EEA and will be considered for incorporation into the EEA Agreement once a decision has been made in the EU.

Systematic approach for strengthened cyber security

Despite good preventive measures, cyber incidents can hardly be avoided altogether. Incidents in the health and care sector in recent years, such as the attack on the South-Eastern Norway Regional Health Authority in 2018 and the Northern Norway Regional Health Authority in 2022, have highlighted the need for a better integration of the digital space into the sector’s emergency preparedness plans and systems. Significant improvements have been made in the cyber resilience of the regional health authorities in recent years, based on assignments from the Ministry, experience and incidents. Digital solutions are an integral part of enterprises and must be an integral part of corporate governance in the sector. This must be reflected in the emergency preparedness plans. Plans must take into account different types of scenarios, where ICT-systems and electronic communications infrastructure may be a smaller or larger part of the crisis. Plans for addressing disruptions of ICT-systems must be practiced and updated regularly. The same applies to the disruption of electronic communications infrastructure. In the event of major incidents, cross-sectoral cooperation and efforts will have a major impact on the outcome where the objective is to reduce the extent of the damage. This must also be reflected in emergency preparedness and exercise plans.

Risk assessments and security measures must be changed more frequently, and in line with an ever-changing risk situation. A systematic approach throughout the health and care sector will strengthen cyber security. This applies to the preparation of risk and vulnerability analyses, threat assessments, planning frameworks and good scenarios, exercises and updated emergency preparedness plans. The Norwegian Government will ensure that cyber incidents are integrated into planning, scenario descriptions and exercises. The new health emergency preparedness structure will ensure this, cf. section 2.2.

The Norwegian Government will:

• establish a committee at the agency level for cyber security for enterprises in the health and care sector, which will also work across sectors

• develop competence regarding threats and security measures in the health and care sector and further develop competence measures adapted to different target groups

• further develop surveillance, detection and analysis of digital vulnerabilities and threats in health and care services and establish CERT for the municipalities in connection with the CERT already established for the health and care sector.

4.3 Security of supply

Significant dependencies and vulnerabilities – complex reasons.

Norway has an open economy and is dependent on access to global markets for imports and exports. A changed geopolitical landscape implies that both Europe and the U.S. are emphasising increased strategic autonomy in their own markets. Economic repercussions of Russia’s invasion of Ukraine have led to shocks on supply and demand aspects of global trade, resulting in increased price pressure on a number of goods.

An inadequate overview of supply chains, long production and supply lines and few alternative suppliers render small countries particularly vulnerable. Major crises are often transboundary. Natural disasters, epidemics, wars and conflicts, or sudden changes in medical needs, can have major impacts on both the supply and demand of pharmaceuticals and medical devices, as well as affect transport and distribution. Normal market mechanisms are then incapacitated, and small markets without major alliance partners are particularly vulnerable. During the pandemic, major countries, such as India and the U.S., implemented export restrictions. This halted deliveries to Europe.

Health emergency preparedness depends on a number of input factors. Access to pharmaceuticals and medical devices is crucial for the provision of health and care services. Water supply is dependent on chemicals for the purification of water. Nuclear emergency preparedness requires measuring equipment in the event of a nuclear incident. The dependencies are equally great for input factors that are outside the constitutional responsibility of the Minister of Health and Care Services. There are significant cross-sectoral dependencies. This places major demands on cross-sectoral cooperation. Without access to chips, the digitised systems in the health administration and the health and care services will not work. Without access to power, systems quickly grind to a halt. Food safety is another example. If one link in the supply chain fails, the consequences for emergency preparedness may be considerable.

For health emergency preparedness, access to pharmaceuticals and medical devices is, as mentioned, a critical input factor. There are approximately 3,000 approved active substances for pharmaceuticals in the world, and the number is rising. More than 500,000 product types are covered by the definition of medical devices. Characteristics of these products, markets and supply chains are highly complex. Therefore, there are special vulnerabilities and dependencies for access to such products. Pfizer’s original COVID-19 vaccine, for example, consisted of 280 inputs from suppliers in 19 countries. Overall, this demonstrates why Norway needs international cooperation to ensure access to pharmaceuticals and medical devices.

Textbox 4.6 Collapse of the market for personal protective equipment

Zoom in on image

Photo: Peder Mathisen.

The pandemic demonstrated the vulnerability of Norway and the rest of the world when the market for personal protective equipment collapsed as a result of demand shocks. Overnight, personal protective equipment became scarce in both the primary and specialist health services. The Ministry of Health and Care Services gave broad powers to the Norwegian Directorate of Health and the South-Eastern Norway Regional Health Authority, which monitored the situation closely. The South-Eastern Norway Regional Health Authority quickly established a transport and logistics organisation and used purchasing competence in the Norwegian Hospital Procurement Trust to probe the market for direct purchases of personal protective equipment. The usual market mechanisms were not functioning and the Health Authority established close cooperation with the Ministry of Foreign Affairs and Avinor. Cargo flights were chartered through Ethiopian Airlines and Qatar Airways. A combination of skill, cooperation and luck enabled Norway to succeed in obtaining the necessary personal protective equipment.

The establishment of the Medical Products Agency

A robust organisation of the security of supply ensures an important foundation for good emergency preparedness. From 1 January 2024, the Norwegian Government will establish a Medical Products Agency. The Agency will be given overarching and full responsibility for monitoring the entire supply chain for pharmaceuticals and medical devices. Covering research and development, as well as placement on the market, emergency preparedness and security of supply. This responsibility is currently shared among different actors in the health and care services and in the health administration. By combining responsibility for monitoring market actors and market regulation of pharmaceuticals and medical devices, together with emergency preparedness and security of supply, a holistic approach is ensured that strengthens health emergency preparedness. One important task for the Agency will be to maintain an overview and insight into the global market and to know the actors. The Agency shall have a clear responsibility of following the developments in the supply chains, including an overview of the supply chains. This will include analyses and monitoring, both in normal circumstances and when circumstances may indicate that access to pharmaceuticals and medical devices is threatened. Further development of the Norwegian Medical Products Agency means that the need for legislative and regulatory amendments will be reviewed.

Procurement mechanism for pharmaceuticals and medical devices

In order for the Norwegian Agency for Medical Products to fulfil its responsibilities for the security of supply, the Norwegian Government will strengthen its work on negotiation and procurement of pharmaceuticals and medical devices for the public sector. Currently, the national responsibility for negotiations and procurement of pharmaceuticals and medical devices is fragmented, where several agencies in the central health administration, municipalities and health trusts are responsible for procurement. This means that no comprehensive assessments are made in relation to use and potential, and that bargaining power is not utilised effectively. By joining professional environments for procurement in the central health administration, specialist competence can be enhanced in an area that has a significant potential to contribute to a more robust health emergency preparedness. Joining negotiations and procurement will also enable Norway to increasingly utilise the opportunities that exist in procurement cooperation at Nordic and European levels. This will contribute to strengthening security of supply, while at the same time not deviating from responsibilities of municipalities and health trusts.

Our participation in the European cooperation on pharmaceuticals is important in the efforts to secure Norway’s access to pharmaceuticals and medical devices. Nordic cooperation can actively support the European cooperation. Through the Nordic Pharmaceutical Forum, the Nordic countries cooperate on procurement to ensure security of supply of selected pharmaceuticals. As a result of the EU’s strengthened cooperation on health emergency preparedness, the Nordic Pharmaceutical Forum has decided to strengthen cooperation in order to contribute a strong Nordic voice in the European cooperation. The Forum’s cooperation has produced results and gained recognition in Europe. This cooperation shows how countries can form a larger market through joint procurement to achieve access to pharmaceuticals that they cannot achieve on their own.

In order to meet the challenges associated with antimicrobial resistance, incentives must be established to facilitate the development of new antibiotics and the production of older antibiotics. Norway’s restrictive use of antibiotics means that we are still one of the few countries that can use narrow-spectrum antibiotics. Nordic cooperation on the procurement of selected older antibiotics has been a success. The use of procurement as an incentive for access to both new and older antibiotics should be further developed and expanded. Both a shortage of antibiotics and antimicrobial resistance can thereby be prevented. Nordic cooperation should be a model for European cooperation.

Stocks of pharmaceuticals and medical devices

Access to pharmaceuticals and medical devices must be based on a balance between national and international measures. Important national measures are implemented through the use of regulatory instruments. This can ensure that pharmaceuticals and medical devices remain in the country, or that dispensing from pharmacies and wholesalers can be rationed and prioritised. Furthermore, there is a need for sound planning that ensures coherence between national and European joint measures.

National stocks of pharmaceuticals and personal protective equipment are important to support security of supply, particularly during the initial phase of a health crisis. In order to strengthen national emergency preparedness, significant circulated stocks of pharmaceuticals were therefore established with pharmaceutical wholesalers during the pandemic. The aim is to put in place a regulation of this system through the legislation on pharmaceuticals in 2023. Large national stocks of personal protective equipment were also established during the pandemic. This has now been established as a permanent national emergency stockpile operated by the regional health authorities. In the event of a new pandemic or crisis where there is a need for withdrawal from the national stocks, the State, represented by the Agency of Medical Products will assume management of the stocks. Furthermore, the Norwegian Government intends to establish regulations stating that all health and care institutions must have stocks corresponding to six months’ normal consumption of personal protective equipment. However, stocks will not be able to meet all our needs for medical countermeasures in a major or prolonged crisis. The pharmaceuticals and medical devices included in the stockpiles should to a greater extent be dynamic and based on risk and vulnerability analyses, while at the same time special arrangements for CBRNE and antimicrobial resistance should be considered. The Norwegian Government will ensure that the emergency stocks for pharmaceuticals and personal protective equipment are maintained and further developed.

Zoom in on image

Photo: South-Eastern Norway Regional Health Authority.

Through the EU Civil Protection Mechanism (UCPM) and HERA, strategic stocks of pharmaceuticals and medical devices are being established in Europe for, among other things, the handling of CBRNE and antimicrobial resistance. These stockpiles are established in different countries and can be distributed in a crisis.

The establishment of a European stocks in Norway will contribute to enhanced emergency preparedness through proximity and integrated participation in an effort that is important for the whole of Europe. The Ministry of Health and Care Services will, in dialogue with the relevant ministries, consider whether Norway should offer to host such a strategic EU stockpile.

An integral part of the European cooperation

Given the number of pharmaceuticals and the wide range of medical devices marketed in Norway and in Europe, it is unrealistic to believe that Norway can become self-sufficient. Norway’s access to pharmaceuticals and medical devices in crises requires cooperation through full affiliation with the strengthened European health emergency preparedness cooperation. In line with the recommendation in the second report of the Coronavirus Commission, the Norwegian Government has therefore decided to conduct negotiations with the EU with a view to concluding an agreement on Norway’s affiliation with the strengthened European health emergency preparedness cooperation.

The EU is stepping up its efforts in the field of emergency preparedness of pharmaceuticals and medical devices. The European Medicines Agency (EMA) has been given an expanded mandate to monitor Europe’s security of supply in this area. The legislation on pharmaceuticals and medical devices is largely fully harmonised within the EEA, and Norway is therefore an integral part of the work of the EMA and the European cooperation.

HERA was established to ensure Europe has access to pharmaceuticals and medical devices in a crisis. HERA is to ensure monitoring of supply and access to crisis-relevant pharmaceuticals and medical devices, research and development, tendering, procurement and production of pharmaceuticals and medical devices during a crisis. HERA has been given a major role in joint negotiations and procurement to secure access to pharmaceuticals and medical devices. In addition, the European Commission is working on targeted measures at the European and regional levels to also secure access to pharmaceuticals outside of crises in case of shortages or in circumstances where market dynamics are particularly demanding. This applies, for example, to antibiotics and access to new, expensive pharmaceuticals. Through its strengthened cooperation on health emergency preparedness, the EU has access to various funding mechanisms for joint European procurement. The aim is for Norway to be able to participate in all forms of common European procurements through a future agreement. Because markets for pharmaceuticals and medical devices have special characteristics and challenges, Norway is unable to safeguard the security of supply through national measures alone. In order to safeguard the area from an overall perspective, participation in the EUs cooperation is therefore important to ensure a national security of supply for pharmaceuticals and medical devices.

The Norwegian Government will:

• placing the responsibility for security of supply and emergency preparedness for pharmaceuticals and medical devices in the Norwegian Medical Products Agency

• ensure the supply of medical countermeasures through Norway’s participation in the EU’s strengthened health emergency preparedness cooperation

4.4 Pandemics and infectious diseases

Infectious diseases remain a threat

The world will come to face new pandemics in the future. Some modelling studies have shown approximately a 25 per cent probability that an outbreak similar to the COVID-19 pandemic will affect us in the next decade, and around a 50 per cent probability that it will occur within the next 25 years.9

The risk posed by infectious diseases encompasses a wide range of threats, both nationally and globally. New outbreaks of infectious diseases and pandemics are often caused by diseases transmitted between animals and humans (zoonoses). The number of such diseases has increased substantially in recent decades. Environmental and climate changes, population growth, increased travel activity, lifestyle changes and displacement of large population groups due to war, food shortages, floods, droughts or other natural disasters can make it difficult to contain infectious diseases.

Antimicrobial resistance is a global threat to health, and it amplifies the threat posed by infectious diseases. Antimicrobial resistance entails, among other things, a reduced possibility for treating serious infections with standard medical treatment. Globally, this is a rapidly growing problem, and it also affects Norway. Both the EU and the World Health Organization consider resistance to antimicrobials to be one of the most serious threats to public health.

Lost control of dangerous infectious agents can cause serious illness in humans, animals and plants. This can occur following laboratory accidents, or as an intentional act to cause harm (bioterrorism). Synthetic biology makes it possible to create new, dangerous infectious agents. Readily available methods of synthetic biology increase the risk of unwanted spread of dangerous infectious agents.

The COVID-19 pandemic – a crisis that impacted all of society

In March 2020, Norway and most countries in the world introduced the most comprehensive measures since the Second World War to protect lives and health, followed by comprehensive measures to protect the economy. The COVID-19 pandemic showed how vulnerable Norway and the world are to infectious diseases that easily spread across borders. Norway was not prepared for a protracted health crisis that affected the entire society. Many of the restrictive measures remained in place for almost two years. Future pandemics may have higher infectiousness and higher mortality rates than the COVID-19 pandemic.

Zoom in on image

Photo: Mimsy Møller, NTB.

Although Norway emerged from the pandemic relatively well in terms of the number of fatalities and economic impact, there was a major social crisis here as well. As of 22 October 2023, 5,824 COVID-19-associated deaths have been registered in the Norwegian Cause of Death Registry.10 1,983 of these deaths were persons under 80 years of age. The pandemic exacerbated social inequalities in health in the population, and there were major social differences in morbidity and mortality.

We do not yet have an overview of the long-term consequences of the pandemic, but we do know that it had several major health and psychosocial consequences. A complete socioeconomic assessment of the costs of the pandemic for Norway has not been prepared. The total real economic costs of the pandemic in the period 2020–2023, measured by lower GDP, amount to about 270 billion 2019 Norwegian kroner.11

Weaknesses in preventive infection control efforts

The pandemic has revealed weaknesses both in preventive infection control efforts and in emergency preparedness. Infection control competence in the health sector varies. As described in section 2.3, the Coronavirus Commission has highlighted the crucial role that municipalities have played in addressing the pandemic, including the key function of chief municipal medical officers. At the same time, many municipalities, especially smaller municipalities, are vulnerable due to lack of competence in infection control and not enough personnel working in this area. Part 2 of the Coronavirus Commission recommends that the chief municipal medical officer role should be strengthened. The Commission highlights the importance of having a professional environment, which can be difficult to maintain in smaller municipalities. It also notes that inter-municipal schemes can help create professional networks for chief municipal medical officers in smaller municipalities. As discussed in section 2.3, national guidelines for the public health tasks of the municipalities will help to clarify the role of the chief municipal medical officer and the expectations of the municipalities. Municipalities and health and care services should receive better infection control and legal guidance. Cooperation between municipalities and specialist health services should be strengthened. Infection control considerations should be safeguarded in the planning and design of health institutions. Both long-term care facilities and hospitals can lay the groundwork for better isolation, cleaning and ventilation. Good infection control routines are also particularly important for the prevention of antimicrobial resistance. The Norwegian Government will revise the Action Plan for better infection control in the health and care services 2019–2023. Lessons learned from the COVID-19 pandemic will be part of this effort.12

Inadequate control of dangerous infectious agents can cause serious illness in humans, animals and plants. This may also be due to acts of terrorism or intentional use to cause fear, disease and harm. The Norwegian Government will develop legislation on biosecurity, including guidance and competence-building in relevant sectors.

Good surveillance systems and registers

Every year, more than 100 infectious disease outbreaks are reported to the Norwegian Institute of Public Health, most of which are followed up locally in the municipalities and healthcare institutions. In the years just before the pandemic, between 30,000 and 50,000 cases of infectious diseases were reported to MSIS13 annually. Municipalities and regional health authorities need quick and simple solutions for access to data and reporting of infection in control efforts, both during normal routine work and in crises. Good systems to ensure that outbreaks and possible threats are detected quickly, and that provide a knowledge base for situational awareness and risk assessment, are essential for rapid response. The piloting of wastewater surveillance during the pandemic showed that this type of surveillance can contribute to both signals and changes in the distribution of virus variants being detected 1–2 weeks earlier than through ordinary surveillance. Experiences from the pandemic show, among other things, that people who need this information in the health services and municipalities require quick access to data for contact tracing and follow-up of individuals in order to limit further infection.

Textbox 4.9 Management tools in infection control work

Zoom in on image

Source: Helseetaten i Oslo kommune.

Both in normal situations and during crises, municipalities must have an overview of the infection situation and developments in their municipality. During the pandemic, the Norwegian Institute of Public Health developed a common national solution that municipalities and county governors could use for an overview of their infection situation. In collaboration with the Norwegian Association of Local and Regional Authorities (KS), the Norwegian Institute of Public Health has initiated a project to establish a more permanent digital solution that can cover more needs and is better integrated into other solutions used by the municipalities.

Several municipalities also developed their own solutions specially adapted to the needs of the municipality. In the City of Oslo, it was important to look at developments in the various districts in order to target efforts involving testing, contact tracing and vaccination. The illustration shows the tool the City of Oslo used during the pandemic for an overview of the infection situation.

In the long term, the infection control registries should be developed into a comprehensive infection registry. Currently, there are five different infection control registries. These have been established at different times and in response to different needs. Data for the various registries are received in different formats, including from the same notifiers. There is currently no common platform for data reception and reporting.

As part of the work to achieve a more comprehensive infection registry, the Norwegian Institute of Public Health has developed a strategy that describes solutions for automated processes for reporting data, message flow, data processing and analysis, quality assurance and accessibility of data. This applies both during normal situations and for adaptation for use in crises. This includes solutions for interaction with users in specialist healthcare services and the municipalities, and to facilitate quick access to necessary data and message exchange.

The aim of a national infection registry is to achieve a faster and better utilisation of existing data for patient treatment, surveillance, infection control measures and research. A comprehensive surveillance system must, among other things, facilitate interaction and access to data in the municipalities and health services. Experiences with the emergency preparedness registry for COVID-19 (Beredt C19) will form the basis for this work.14

Based on this, the Norwegian Government will work on a plan for modernising surveillance systems in the area of infection control. This includes, but is not limited to:

• Digital infrastructure for reporting, message flow, interactions and access to data in infection control between municipalities, specialist health services and the central health administration.

• Digital tools and infrastructure for linking and secondary use of existing data sources based on experience with Beredt C19.

• Investigation of legal consequences, including privacy.

In collaboration with the Norwegian Association of Local and Regional Authorities (KS), the Norwegian Institute of Public Health has initiated a project to establish a digital infrastructure that supports seamless services for health surveillance, analysis, statistical production and sharing of data as part of a comprehensive system for digital infection control emergency preparedness in the municipalities.

Contact tracing systems and infection control apps are other sources of knowledge in the area of infection control. The Norwegian Government will consider how data from municipal contact tracing systems can easily be integrated into national systems and from national systems to municipal systems. Experiences with the Smittestopp [Infection Stop] app that was developed during the COVID-19 pandemic will be incorporated into the work on health emergency preparedness.

Broader involvement in pandemic emergency preparedness and management

The Coronavirus Commission’s first report notes that it was known in advance that pandemic influenza was the most likely national crisis, and the one which would have the greatest adverse impact. Nevertheless, emergency preparedness to handle the COVID-19 pandemic could have been better when it occurred. There was inadequate preparation of scenarios, plans or exercises that take into account the use of instruments such as setting requirements for or shutting down activities in all or parts of the country, as permitted by the Infection Control Act. The plans did not address curbing infection and what this would entail in terms of measures and consequences in other sectors. Other sectors had little involvement in the preparation of the general planning, and had not taken into account being covered or affected by infection control measures in their own emergency preparedness plans. There was little indication that the crisis would last over a longer period. Experiences from the pandemic demonstrated that when different sectors participate in the development of packages of measures, these are more effective and have fewer negative consequences. Packages of national infection control measures that were developed during the latter part of the COVID-19 pandemic will be further developed, following involvement by the various sectors of society.

The Norwegian Government will facilitate broader participation in the organisation of health emergency preparedness, updating relevant plans for pandemic management and in crisis management. Relevant actors are authorities from other sectors, the local government sector, the specialist healthcare service, voluntary organisations, vulnerable groups and the business sector.

Targeted infection control measures in testing and contact tracing

In outbreaks of serious infectious diseases, contact reducing measures, testing, tracing, isolating and quarantining (TTIQ) are all relevant actions. TTIQ are measures that target people who may be infected, and have fewer consequences for society as a whole. Effective TTIQ that enables control of the spread of infection can reduce the need for comprehensive contact-reducing measures. Therefore, the Norwegian Government believes there should be plans and systems for effective testing and tracing, as well as opportunities for isolation and quarantining that can be implemented quickly if needed. There should be assessments of the costs and benefits of different TTIQ schemes.

Zoom in on image

Photo: Bergen Hospital Trust.

A rapid and flexible response is based on systems for detecting trends in infection and systems for rapid feedback of results to municipalities, the health and care services and the central infection control authority. Digitalisation and modernisation provide opportunities for automatic surveillance and thereby faster reporting and follow-up with infection control measures in relation to individuals, local communities, regionally or nationally. A rapid scaling up of testing and laboratory analyses, including sequencing in the event of larger outbreaks will also be facilitated. Sequencing capacity is important for detecting new virus variants and the development of transmission variants that are of significance for the effective design of infection control measures. Testing capacity will be rapidly scalable, especially if the symptoms are non-specific, as with the COVID-19 virus. This presupposes that there are good national reference laboratories that can quickly set up analyses for new agents, plans for large-scale analyses and plans for scaling up testing capacity in the municipalities using human resources.

The Norwegian Government will clarify the possibilities for rapidly increasing sequencing capacity as part of pandemic emergency preparedness. This may also include capacities in other sectors. Effective contact tracing systems are a key tool in the event of larger outbreaks, in addition to surveillance. In cooperation with the municipal sector, the Norwegian Government will facilitate the development of user-friendly contact tracing tools with data that can be shared and used across municipalities and between municipalities and health trusts.

Strong professional infection control environments

Considerable capacity and strong professional competence are required for managing a pandemic. A strong professional national infection control professional network that ensures a continuously updated knowledge base, good contact with the municipalities, health services and the central administration is crucial to ensure safe handling of outbreak situations.

In addition to professional infection control competence, close organisational links are needed to other professional environments that can contribute knowledge and comprehensive assessments. This includes, among other things, i) professional registry competence for the development of emergency preparedness registries, etc.; ii) competence in other health and societal consequences of measures, such as mental health and socioeconomics; and iii) capacities for dialogue with other parts of the central administration, municipalities, the health and care services and voluntary organisations.

The Norwegian Government will:

• strengthen and modernise surveillance systems in the area of infection control

• maintain strong professional environments in the area of infection control, and facilitate professional support and competence locally

4.5 Safe water supply

Contamination of drinking water can pose a risk of loss of lives and health. Loss of water also has other major societal consequences, which may lead to the need for evacuation. Drinking water in Norway is generally safe, and most residents receive drinking water of good quality. Nevertheless, there are several vulnerabilities in the water supply in many municipalities that will require measures to maintain resilience and emergency preparedness in the face of challenges. Safe water supply has been identified as a fundamental national function, cf. Section 2-1 of the Security Act. Drinking water is used for drinking and cooking, but the largest share of it is used for hygienic purposes such as cleaning, showering and toilet flushing. Water supply is necessary to maintain functions in schools, kindergartens, hospitals and other health institutions, as well as in the business sector.

Vulnerabilities in the water supply

The municipal pipe network is generally in poor condition, and the leakage rate is high. On average, 30 per cent of the water leaks out of the pipe network. The renewal rate is low and not sufficient to avoid increasing decay. A report prepared for Norsk Vann [Norwegian Water] describes an investment need of about NOK 330 billion in the period 2021–2040 to secure the infrastructure for water and sewerage.15 The risk of both loss of water and contamination of the water supply is therefore increasing.

More torrential rain, floods and droughts increase the risk of failure of the water supply systems. The Askøy case in 2019 where more than 2,000 people became ill with gastrointestinal infection, 2018 summer drought, 2021 winter drought involving water shortages in several places along the coast from Western Norway to Troms, the scarcity of water in the Oslo area in the summer of 2022 and the extreme weather Hans in 2023 that had major consequences for the water supply in many parts of the country, are examples of risks and vulnerabilities in the water supply.

Zoom in on image

Photo: City of Oslo Agency for Water and Sewerage Works, Simen Strand Jørgensen.

Critical infrastructure can also be the target of acts of sabotage.16 This includes both physical damages, but also contamination of sources and attacks on digital infrastructure and power supply. Through contracts on the supply of equipment and services, foreign governments can gain access to information about critical Norwegian infrastructure. Norwegian enterprises that manage important assets, including waterworks, must be aware of hidden supplies of equipment and services.

Changes in technology have made water supply systems more vulnerable to shortages of basic intermediate goods. These include both technical equipment and chemicals necessary to maintain the production of drinking water. These products are part of the global trade in goods, and access is often dependent on conditions outside Norway’s borders. Furthermore, the water sector has undergone extensive digitalisation and is potentially more vulnerable to cyber threats.

Based on the current and future threat and risk situation and the identified vulnerabilities, it is necessary to implement actions. This involves reducing vulnerabilities in the water supply systems (especially with regard to the distribution system) and strengthening the work on security and emergency preparedness (competence, planning, exercises, backup water, emergency water, security of supply, ICT security, physical security, supervision, etc.).

Funding and organisation

In 2021, the Ministry of Local Government and Regional Development, the Ministry of Climate and Environment and the Ministry of Health and Care Services commissioned a feasibility study to highlight the potential for improving the efficiency of the water and wastewater sector.17 The report describes that water and wastewater organisations should be equipped to ensure that they are better able to use the appropriate technologies and working methods to catch up with the backlog in improving the water and wastewater network. Smaller municipalities in particular face challenges with access to competence, and the professional environments are small. According to the report, regional organisation of the municipal water and wastewater units, combined with more state governance of the sector, will be the most socioeconomically beneficial to address the challenges in the sector. Municipalities and waterworks companies should consider whether the organisational structure enables them to deliver satisfactory services in the face of the risk situation and identified vulnerabilities in the water supply, or whether other forms of cooperation are necessary with regard to civil protection. A recent report from Norsk Vann18 describes various organisational forms for the municipal water and wastewater sector. The report presents examples of different forms of inter-municipal cooperation and the factors that should be considered.

Major investments are needed to increase the rate of renewal in the water mains. Municipal drinking water services are generally fully funded by water fees to subscribers according to the full cost principle. Increases in municipal charges result in increased expenses and living costs for residents, and involve difficult political trade-offs. There is a broad consensus that charges should be kept at a low level. At the same time, a lack of investment will result in a situation involving a low replacement rate. Furthermore, the water supply is in a monopoly situation which may entail insufficient attention to whether operations are efficient or can be optimised. According to the Office of the Auditor General’s report on the authorities’ work on safe drinking water, the chief municipal executives believe that the most important obstacles to the renewal of the water supply network are factors related to funding and to competence and recruitment.19 The Office of the Auditor General finds it unacceptable that not enough measures have been implemented to achieve the goals of reducing leaks and renewing the water mains for drinking water. They note that there is insufficient management data and knowledge, and that there is a need to look at legislation, policy instruments and funding models. In the feasibility study, identified weaknesses are small professional environments and opposition to inter-municipal cooperation.

The Norwegian Government will consider whether, and how, various measures can contribute to municipalities upgrading water and wastewater facilities and infrastructure in the best possible manner. Measures to be considered include stronger state instructions, measures that can stimulate stronger professional environments and greater inter-municipal cooperation, as well as advantages and disadvantages associated with the funding schemes in the water and wastewater sector. The full cost pricing principle shall continue to be a guiding principle.

Zoom in on image

Photo: Anders Bekkelund.

Competence and knowledge

In Norway, there are just over 1,300 water supply systems supplying more than 50 people. In addition, there are a number of smaller, private water supply systems. In the face of the risk situation and vulnerabilities in the water supply systems, a lack of competence and limited cooperation between municipalities in the water and wastewater sector are challenges. In 2017, the National Waterworks Crisis Support Team was established to ensure support for the waterworks in handling incidents that may affect the water supply. Waterworks owners can receive advice from a broad knowledge environment and persons with extensive experience from waterworks operations. This contributes to reducing the adverse consequences of incidents that affect the water supply, including consequences arising from disruptions.

Stronger professional environments in water and wastewater, for example through more cooperation between municipalities, are necessary to reduce vulnerability and risk. There are also challenges in adopting new and advanced technology, and there are few subscribers among whom costs can be distributed in small municipalities. Knowledge and innovation are needed to reduce vulnerabilities in the water supply.

Increased competence requires further stimulation to increase educational capacity and technological development, as well as the adoption of new technology. A programme for technological development in the water sector shall be evaluated.20 The evaluation will form a basis for assessing continuation, including the need for adjustment or expansion.

Better reporting systems

The water supply systems annually report a number of data to the Norwegian Food Safety Authority. The current system for reporting drinking water data is outdated, resource-intensive, does not provide an overview of or the opportunity to describe the status when needed, and does not provide sufficient management data to be able to implement targeted measures. The system limits the municipalities’ opportunities to use digital systems the municipalities already have. The Ministry of Health and Care Services has asked the Norwegian Food Safety Authority to commence work on facilitating digital reporting in the area of drinking water. This will contribute to a better knowledge base for targeting efforts to reduce vulnerabilities in the water supply and contribute to safer drinking water, nationwide.

Revision of national goals for water and health

The Norwegian Government will set new goals for water and health with a cross-sectoral implementation plan to reduce vulnerabilities and increase the resilience of the national water supply. The need for stricter regulatory requirements will also be assessed. A more comprehensive discussion of expectations for the municipalities’ work on drinking water supply is included in the National expectations regarding regional and municipal planning (2023–2027).

The role of the Norwegian Food Safety Authority

The Norwegian Food Safety Authority shall guide and supervise the water supply systems, as well as obtain knowledge regarding the status and situation. Where appropriate, drinking water and wastewater should be considered in conjunction with each other. The Norwegian Food Safety Authority and the supervisory authorities in the area of wastewater should be coordinated vis-à-vis the municipalities. The Norwegian Food Safety Authority will be asked to ensure that the municipalities follow up the point in the National expectations regarding regional and municipal planning 2023–2027, that drinking water supply shall be included in the assessment of civil protection in the social part and land-use part of the municipal master plan. In addition, consideration will be given to whether legislation relating to drinking water should be amended with a view to increasing the robustness and security of the water supply.

There are emergency preparedness plans for about 90 per cent of the water supply systems, but only about half of the plans are up to date. Furthermore, emergency exercise have been carried out for around a third of the systems in the past year.21 Based on the threat and risk situation, the Norwegian Government will consider the need for clarifying the requirements in the Drinking Water Regulations. The Ministry of Health and Care Services has asked the Norwegian Food Safety Authority to enhance guidance and supervision of security and emergency preparedness in the water supply. This will encompass security of supply, updating plans and carrying out emergency preparedness exercises. In order to clarify the Norwegian Food Safety Authority’s coordinating role in relation to security and drinking water emergency preparedness, the Norwegian Government will establish a committee at the agency level for water, cf. section 2.2.1.

Security and emergency preparedness in the water supply

Emergency preparedness in the water and wastewater sector is closely linked to other emergency preparedness in the municipality and the region. Up-to-date planning, interaction and exercises are essential for being able to handle incidents. This involves everything from emergency water cooperation to crisis communication with residents. Practice in incident management and good systems for interaction are key aspects in making this work. The Norwegian Government has designated a response team for cyber security for the municipalities, cf. section 4.2. This will also contribute to strengthening the security work for municipal waterworks.

Together with Finland and Sweden, Norway uses a lot of surface water for drinking water. Therefore, large amounts of water purification chemicals are used for both drinking and wastewater. The countries also have companies that are important in a Scandinavian and European context to ensure access to and production of water purification chemicals. In line with the Nordic Public Health Preparedness Agreement, cooperation has been strengthened, and work is underway to examine the need and opportunities for measures to strengthen own emergency preparedness in the area.

Waterworks owners shall ensure that subscribers have access to drinking water at all times. According to the Norwegian Food Safety Authority, many water supply systems lack plans and measures that provide adequate security of supply. In the period 2018 to 2020, the Norwegian Food Safety Authority implemented an action plan to ensure progress in the work to establish good security of supply. Deficiencies related to backup water supply are being improved, and the proportion of residents connected to alternative water supplies will increase from 67 per cent today to almost 80 per cent when this is implemented in Oslo.

Even with good prevention, situations may arise when the ordinary distribution system cannot be used. In such cases, it will be necessary to distribute drinking water using tanks, water cans or similar – referred to as emergency water supply. Municipalities shall have plans for emergency water supply as part of their emergency preparedness plans. There is currently no national overview of emergency water supply in the municipalities. There is a need to identify the extent to which the municipalities have followed up the work and what proportion of the population can be supplied with emergency water, as well as whether vulnerable groups and hospitals and other health institutions will be covered and have the opportunity to receive emergency water. The Norwegian Directorate of Health’s latest RVA analysis from 2019 highlights partly unclear responsibilities in emergency preparedness for and supervision of emergency water supply to health institutions in situations where ordinary distribution is not available. This includes drinking water, sanitary water and other necessary utility water that health and care services depend on to carry out their social mission. The Norwegian Government will assess the situation for emergency water supply and review any needs and measures.

The Norwegian Government will:

• establish a national committee at the agency level for safe water supply

• assess the situation for emergency water supply and assess the need for measures

• reduce vulnerabilities and increase water supply resilience, including by setting new water and health goals with a cross-sectoral implementation plan

4.6 Nuclear emergency preparedness

A changed threat and risk situation for nuclear emergency preparedness

A nuclear incident would affect society as a whole. The release and spread of radioactive substances can have consequences for life, health, the environment and other important public interests. A major nuclear incident abroad would also have major consequences for Norway and Norwegian interests, including major consequences for food production and impacts on food supply.22 The 1986 nuclear accident in Chernobyl is still the largest source of radioactive contamination in Norwegian food chains, land areas and freshwater systems. Russian warfare in Ukraine has increased the risk of a nuclear incident at Europe’s largest nuclear power plant in Zaporizhzhia. Since Russia’s full-scale invasion of Ukraine on 24 February 2022, nuclear emergency preparedness has been increased.

Europe’s nuclear power plants are aging and the risk of serious accidents is increasing. The Fukushima and Chernobyl accidents showed that nuclear incidents can have major consequences. Furthermore, there are changes in technology that affect the risk situation. This includes new types of weapon systems, mobile reactors and floating nuclear power plants.

A nuclear incident abroad may also have implications for Norwegian citizens travelling to and from or nearby the area. A nuclear incident abroad can also lead to mass migration of people with a need for accommodation and medical follow-up upon entry, which will require considerable efforts from many sectors.

The Total Preparedness Commission highlights the risk of when more countries develop nuclear weapons, there is a greater chance for nuclear material and radioactive sources ending up outside government control and be used to create improvised nuclear or radiological weapons. Furthermore, it notes that security policy changes could jeopardise international cooperation on nuclear safety and non-proliferation of nuclear weapons. The prospects for continued and new agreements on arms control and disarmament of nuclear weapons are uncertain, and there is a risk that new countries will seek to develop nuclear weapons or acquire the capacity to develop them. Russia’s threats to use nuclear weapons under certain conditions in connection with its war against Ukraine are serious. Furthermore, traffic with nuclear-powered vessels along the Norwegian coast is increasing. An accident involving such a vessel could result in radioactive pollution that affect Norway.

The Defence Commission has expressed that developments in the security situation indicate the need to strengthen nuclear emergency preparedness in many sectors. Furthermore, the Defence Commission has noted the need to continue and develop cross-sectoral efforts. The Total Preparedness Commission has also clearly highlighted the strength of today’s cross-sectoral cooperation.23 The Total Preparedness Commission has also recommended that nuclear emergency preparedness work be subject to a national assessment and prioritisation in light of changes to the risk and threat situation.

Norway is entering a phase where the nuclear reactors at Kjeller and Halden are to be decommissioned. This means that they are to be dismantled, removed and that radioactive waste must be handled. This process involves risk because the plants are old and will undergo major changes during the period in which this will take place. After the research reactors were closed in 2018 and 2019, there has been limited transport of nuclear material in Norway. In the process of decommissioning, there is a risk of undesirable incidents involving both accidental and intentional acts. The risk will vary over time and during the different phases of handling radioactive material, including transport and storage.

There are many radioactive sources in Norway, including in industry. Accidents related to these sources, or loosing control of the sources can also pose a health risk.

Strengthening prevention of nuclear and other radiation protection incidents

Zoom in on image

Photo: Arctic RHEIN, Norwegian Directorate for Civil Protection.

Sound management and clear regulations contribute to strengthening preventive efforts and reducing the risk of nuclear incidents, nationally. For Norway, this includes requirements for – and supervision of – the Norwegian nuclear facilities, the arrival of reactor-powered vessels, other types of use of radioactive sources and the handling of radioactive waste, including used nuclear fuel. In 2019, the International Atomic Energy Agency (IAEA) conducted an audit of the Norwegian public administration to assess the effectiveness of national infrastructure and national legislation on radiation protection and nuclear safety. The review showed that much of this was good. The IAEA noted that the cross-sector and civil-military cooperation in nuclear emergency preparedness was an example of good practice that can be followed by other states. At the same time, the review also indicated a need for improvements. This applied, among other things, to matters surrounding the strategy for handling radioactive waste, security, competence and resources. Follow-up of the recommendations is ongoing and carried out in collaboration with national actors and the IAEA.

Norway works actively internationally to reduce the risk of serious accidents, radioactive contamination and nuklear material getting lost. The international work is an integral part of the work on threat assessment, risk understanding and emergency preparedness in Norway. International cooperation on nuclear safety must be continued and developed, including through the IAEA, the European Atomic Energy Community (Euratom) and the OECD’s Atomic Energy Agency.

Development of warning systems, situational awareness and analysis

There is extensive international cooperation on warning and surveillance capacities, both linked to the IAEA and Euratom. In addition, Norway has a number of bilateral agreements on reporting and information exchange. Norway has a functioning surveillance and reporting system, but there is a need to consider updating the existing system. Among other things, the measuring capacity in Northern Norway will be strengthened.

Nuclear emergency preparedness requires rapid response and coordinated measures in several sectors, at different levels and in different geographical locations. In the event of an incident, there will immediately be a strong need for information in the population and to support decisions regarding measures. Critical factors include data access in order to assess exposure and risk, the capacity to carry out analyses and interpretation, as well as the capacity to communicate updated knowledge adapted to different target groups. It is important to have good systems and plans for this with the actors who are part of nuclear emergency preparedness organisations, which must be ready and practiced regularly, such as the coordinated planning system of the Crisis Committee for Nuclear Preparedness.

Systems and plans must, among other things, include the possibility of as fast as possible establishing an emergency preparedness registry to gain an overview of health risks and consequences, as well as to cover other knowledge needs that are relevant for handling a nuclear incident, cf. the Health Preparedness Act. The Norwegian Radiation and Nuclear Safety Authority and the Norwegian Institute of Public Health shall, in collaboration with other relevant agencies, prepare the establishment of an emergency preparedness registry for nuclear incidents.

Review of organisation and decision-making processes in nuclear emergency preparedness

The national nuclear emergency preparedness is dimensioned based on various scenarios for nuclear accidents and incidents that may involve ionizing radiation or the spread of radioactivity. Nuclear incidents include accidents and incidents as a result of intentional acts in peacetime, security crises and armed conflict.

Nuclear emergency preparedness in Norway is the constitutional responsibility of the Minister of Health and Care Services. Furthermore, Section 16 of the Radiation Protection Act grants the King authority to organise nuclear emergency preparedness. During an acute phase, the King may, unimpeded by the allocation of authority in other laws, order state and municipal bodies to implement evacuation, restriction of access to areas and measures related to securing foodstuffs, including drinking water and the protection of animals. Implementation of measures is regulated in sectoral acts, including the Police Act, the Pollution Control Act and the Food Act.

Authority to determine the defined measures in an acute phase has since 2013 been delegated to the Crisis Committee for Nuclear and Radiological Emergency Preparedness and Response by a Royal Decree. The Crisis Committee for Nuclear and Radiological Emergency Preparedness and Response is chaired by the Norwegian Radiation and Nuclear Safety Authority, and is a cross-sectoral committee with representatives from central authorities who have a special responsibility in the event of a nuclear incident. In addition, the Crisis Committee for Nuclear and Radiological Emergency Preparedness and Response has advisers as a professional support system from institutions and agencies with special competence related to nuclear emergency preparedness. The county governors and the Governor of Svalbard comprise the Crisis Committee for Nuclear and Radiological Emergency Preparedness and Response’ regional branches. The Crisis Committee for Nuclear and Radiological Emergency Preparedness and Response’ decisions on the implementation of measures require consensus among the Committee’s members. Measures that affect military matters and operations must always be cleared with the Ministry of Defence. Furthermore, according to the current Royal Decree, government ministries or the Norwegian Government have no powers, entailing that political decisions in a nuclear incident must, pursuant to the Radiation Protection Act, be taken by the King in Council.

The Crisis Committee for Nuclear and Radiological Emergency Preparedness and Response also has tasks in the ongoing emergency preparedness efforts, and serves as an adviser to the authorities in the late phase of a nuclear incident.

In accordance with the sectoral principle, the government ministries are responsible for ensuring that emergency preparedness within their respective sectors is satisfactory and coordinated with other sectors. In the event of any nuclear incidents, the individual government ministries and specialist authorities are responsible for measures where the powers have not been assigned to the Crisis Committee for Nuclear and Radiological Emergency Preparedness and Response. The relevant ministries’ cooperation in the ongoing emergency preparedness efforts is organised through the Civil Servant Group for Coordinating Nuclear and Radiological Preparedness, which is chaired by the Ministry of Health and Care Services. In the event of a serious nuclear incident, the Norwegian Radiation and Nuclear Safety Authority and/or the Crisis Committee for Nuclear and Radiological Emergency Preparedness and Response shall immediately notify the Ministry of Health and Care Services, the designated lead ministry, other affected government ministries and the Office of the Prime Minister. The Crisis Council ensures the coordination at the government ministry level through the lead ministry. In addition, the entire emergency preparedness organisation shall be notified, and the incident shall be reported internationally.

It is important to ensure good emergency preparedness for local incidents with an accident site in Norway. According to the Police Act, the police shall organise and coordinate the relief effort at the scene of the accident until responsibility is taken over by another authority. This also applies to nuclear incidents. A local incident with rapid development will depend on clear and rapid decision-making processes locally, where emergency services, rescue services and municipalities will be the central actors, with assistance and advice from the specialist authorities. The county governors shall ensure the coordination of regional and local measures in the event of a nuclear incident. In the event of incidents that affect Svalbard, the Governor and Longyearbyen Community Council will be included. Nuclear incidents are included in the Governor of Svalbard’s risk and vulnerability analysis 2022–2026.

Experiences from exercises, pandemic management, changes in central health administration and developments in the international security situation, including long-term heightened nuclear emergency preparedness for the Crisis Committee for Nuclear and Radiological Emergency Preparedness and Response in connection with the war in Ukraine, give reason to review current nuclear emergency preparedness to ensure that it is organised and functions appropriately today.

On this basis, the Norwegian Government will review the Radiation Protection Act and the Royal Decree on nuclear emergency preparedness. In the work, it is important to continue the provisions in the current legislation that work well. Based on, among other things, experiences from the COVID-19 pandemic, the review will also assess whether the existing Royal Decree sufficiently clarifies the need for political consideration of intrusive measures of considerable societal significance. At the same time, it must be ensured that measures can be implemented as quickly as possible at the correct level to protect life, health and other values. The emergency preparedness system must allow for flexibility in response so that the measures are adequate to different situations and the development of situations. There must be clear criteria for what does and does not constitute an acute phase, so that there is no uncertainty about the scope and duration of the authorisation given to the Crisis Committee for Nuclear and Radiological Emergency Preparedness and Response. There is also a need to review responsibility and reporting procedures at all levels. The Radiation Protection Act shall be assessed to determine whether it should contain a legal authorisation for the imposition of measures that may be necessary in any nuclear emergency preparedness context. There is also a need for a review of members of the Crisis Committee for Nuclear and Radiological Emergency Preparedness and Response and the advisory group.

A nuclear incident affects society as a whole, and different responsibilities and a wide range of considerations must be safeguarded. The review of the legal framework for nuclear emergency preparedness will therefore involve all affected government ministries and responsible sector authorities.

Strengthen the Norwegian Radiation Protection Authority’s capacity and competence for handling nuclear incidents

The Norwegian Radiation Protection Authority is an agency with considerable professional competence, and with good capacity adapted to a normal situation. The Norwegian Radiation Protection Authority and the Crisis Committee for Nuclear and Radiological Emergency Preparedness and Response have, however, worked for an extended time with heightened emergency preparedness, and on extensive handling and coordination linked to an increased risk of a nuclear incident in Ukraine due to Russia’s warfare. A nuclear incident will, within a very short time, require considerable resources and interdisciplinary competence to analyse the situation and ensure communication, advice and guidance to the Norwegian Government, the health service, other sectors, municipalities, county governors, the business sector and the general population. In addition, there is a need to ensure capacity and competence to assess the societal, environmental, economic and health consequences of nuclear incidents and necessary measures. It is assumed that much can be ensured by the actors in the Crisis Committee for Nuclear and Radiological Emergency Preparedness and Response and the advisory group.

The Norwegian Government will assess how to ensure sufficient capacity and necessary competence for the Norwegian Radiation and Nuclear Safety Authority in a major crisis and war linked to a nuclear incident, including assessing the need for planning and agreements with other agencies and organisations. This includes, among other things, the ability to assist with different types of competence from the Crisis Committee for Nuclear and Radiological Emergency Preparedness and Response’s other members and advisors related to, among other things, analyses, information work and advice. E.g, the Norwegian Directorate of Health shall assist in information work on health matters in the event of nuclear incidents. It must also be considered how an expert group described in Chapter 2 can contribute if there is a need for more long-term comprehensive analyses.

In the event of a major incident linked to war, terror or threats from other states, there is an increased risk of simultaneous or complex incidents. This will entail a challenge related to overall capacity in several sectors and a need for broad cross-sectoral coordination. Challenges involving simultaneous events must be assessed in nuclear emergency preparedness.

Zoom in on image

Photo: The Norwegian Armed Forces, Frederik Ringnes.

Further develop and strengthen the work with scenarios in nuclear emergency preparedness

Nuclear emergency preparedness is based on six dimensioning scenarios. As part of the work on developing scenarios for health crises in general, the Norwegian Government will assess the scenarios for nuclear incidents, including what these entail in terms of requirements for emergency preparedness in all sectors. This includes access to the necessary equipment for measuring radioactivity and cleaning equipment, in addition to medical devices for, among other things, protection and measures in the environment that also include handling radioactive waste following an incident. Furthermore, health services’ capacity to handle a major nuclear incident with mass casualties shall also be assessed. Through the establishment of the Health Emergency Preparedness Council, where the regional health authorities participate together with the Norwegian Radiation and Nuclear Safety Authority, the Minister of Health and Care Services will strengthen the health service’s work on emergency preparedness to handle casualties related to nuclear incidents.

During an initial phase of a nuclear incident affecting Norwegian territory, the focus area at the municipal level will be characterised by local emergency services, rescue services and local authorities. There is a need for increased competence and capacity to be able to respond to a radioactively contaminated area. There is also a need to assess better national and regional support for municipalities in such crisis management.

The Government will strengthen nuclear emergency preparedness, partly by updating and expanding the scope of public information, including ensuring both broad and targeted dissemination to the population; expand the capacity for measurement and assessment, including the acquisition of more measurement equipment and protective equipment for emergency personnel; competence development, regionally and locally; procurement of modelling and analysis tools; as well as improved capacity to detect any emissions in the High North. The need for the development of classified means of communication will also be relevant to assess in nuclear emergency preparedness, cf. section 4.1.

Against the backdrop of a changed security situation, work is underway to assess a seventh scenario, which concerns the use of nuclear weapons on or near Norwegian territory. Measures shall be considered to address such a scenario.

The Norwegian Government will:

• further develop warning systems and strengthen nuclear emergency preparedness through expanded measurement capacity, competence development and modelling and analysis tools

• review the Radiation Protection Act and the Royal Decree for nuclear emergency preparedness to ensure an appropriate organisation of nuclear emergency preparedness

• strengthen the Norwegian Radiation and Nuclear Safety Authority’s capacity and competence to handle nuclear incidents through cross-sectoral cooperation