Council of theEuropean Union
Brussels, 7 June 2017
(OR. en)9916/17CYBER 91
RELEX 482
POLMIL 58
CFSP/PESC 476'I/A' ITEM NOTE
From:

General Secretariat of the Council

To:

Permanent Representatives Committee/Council

No. prev. doc.:

7923/2/17 REV 2

Subject:

Draft Council Conclusions on a Framework for a Joint EU Diplomatic
Response to Malicious Cyber Activities ("Cyber Diplomacy Toolbox")- Adoption

1.

At the PSC meeting of 14 March 2017 the EEAS/Commission services presented a joint
issues paper on a joint EU diplomatic response to cyber operations ("Cyber toolbox") 1. The
latter was welcomed by delegations as well as its suggested follow up in the Horizontal
Working Party on Cyber Issues (HWPCI). As a result the PSC invited the HWPCI to examine
the paper in more detail in consultation with other Council preparatory bodies, whereappropriate, before it would revert to the issue by the end of June, taking into account theoutcome of that examination.

2.

Following the tasking by PSC the joint paper was also presented and discussed at the HWPCIon 22 March 2017. Delegations welcomed the paper, specifying the need to take the necessary
time to discuss it in detail. As a way forward, a large number of them voiced a preference forthe development of Council conclusions accompanying the toolbox itself.

1WK 2569/2017 INIT.

9916/17

MK/ec
DGD2B

1EN

3.

In view of this, the Presidency prepared draft Council Conclusions as set out in doc.7923/17
which were presented and examined at two consecutive meetings of the HWPCI meeting,respectively of 19 April and 12 May 2017 where the text was further streamlined andimproved according to the comments provided by Member States.

4.

On 6 June 2017 the final text of the draft Council Conclusions was submitted to PSC in linewith the tasking of March and it was agreed with several additions 2 with a view to theiradoption by the Council.

5.

Against this background, COREPER is requested to invite the Council to approve the draftCouncil conclusions on a Framework for a Joint EU Diplomatic Response to Malicious Cyber
Activities, as set out in the Annex.

2

WK 6162/2017 REV 1

9916/17

MK/ec
DGD2B

2EN

ANNEXDRAFT COUNCIL CONCLUSIONS ON A FRAMEWORK FOR A JOINT EUDIPLOMATIC RESPONSE TO MALICIOUS CYBER ACTIVITIES ("CYBERDIPLOMACY TOOLBOX")The Council of the European Union adopted the following conclusions:
1. The EU recognises that cyberspace offers significant opportunities, but also poses continuously
evolving challenges for EU external policies, including for the Common Foreign and Security
Policy, and affirms the growing need to protect the integrity and security of the EU, its Member
States and their citizens against cyber threats and malicious cyber activities.
The EU recalls its conclusions on the EU Cybersecurity strategy 3, in particular its determination tokeep cyberspace open, free, stable and secure where fundamental rights and the rule of law fully
apply. It also recalls its Conclusions on Cyber Diplomacy 4, in particular that a common andcomprehensive EU approach for cyber diplomacy could contribute to conflict prevention, themitigation of cybersecurity threats and greater stability in international relations.
The EU and its Member States note the importance of the ongoing EU cyber diplomacy
engagement and of the need for coherence among the EU cyber initiatives to effectively strengthen
the cyber resilience, and are encouraged to further intensify their efforts on cyber dialogues within
the framework of effective policy coordination, and emphasise the importance of cyber capacity
building in third countries.
2. The EU is concerned by the increased ability and willingness of State and non-state actors topursue their objectives by undertaking malicious cyber activities of varying in scope, scale,duration, intensity, complexity, sophistication and impact.

34

12109/13.
6122/15.

9916/17
ANNEX

MK/ec
DGD2B

3ENThe EU affirms that malicious cyber activities might constitute wrongful acts under internationallaw and emphasises that States should not conduct or knowingly support ICT activities contrary totheir obligations under international law, and should not knowingly allow their territory to be used
for internationally wrongful acts using ICTs, as it is stated in the 2015 report of the United Nations
Groups of Governmental Experts (UN GGE).
3. The EU recalls its and its Member States' efforts to improve cyber resilience in particular throughthe implementation of the NIS Directive and the operational cooperation mechanisms provided
therein, and that malicious cyber activities against information systems, as defined under EU law,
constitute a criminal offence and that effective investigation and prosecution of such crimes remains
a common endeavour for Member States.
The EU and its Member States take note of the ongoing work of the United Nations Groups ofGovernmental Experts on Developments (UN GGE) in the Field of Information andTelecommunications in the context of international security, building on the 2010, 2013 and 2015
reports 5, and are encouraged to strongly uphold the consensus that existing international law isapplicable to cyberspace. The EU and its Member States have a strong commitment to actively
support the development of voluntary, non-binding norms of responsible State behaviour incyberspace and the regional confidence building measures agreed by the OSCE 6 to reduce the riskof conflicts stemming from the use of information and communication technologies.
The EU reaffirms its commitment to the settlement of international disputes in cyberspace bypeaceful means, and that all of the EU’s diplomatic efforts should as a priority be aimed atpromoting security and stability in the cyberspace through increased international cooperation, andat reducing the risk of misperception, escalation and conflict that may stem from ICT incidents. Inthat regard the EU recalls the UN General Assembly call to the UN Member States to be guided by
the UNGGE reports' recommendations in their use of ICTs.

5
6

A/68/98 and A/70/174.
PC.DEC/1106 of 3 December 2013 and PC.DEC/1202 of 10 March 2016.

9916/17
ANNEX

MK/ec
DGD2B

4EN

4. The EU stresses that clearly signaling the likely consequences of a joint EU diplomatic responseto such malicious cyber activities influences the behavior of potential aggressors in cyberspace thus
reinforcing the security of the EU and its Member States. The EU reminds that attribution to a Stateor a non-State actor remains a sovereign political decision based on all-source intelligence andshould be established in accordance with international law of State responsibility. In that regard, theEU stresses that not all measures of a joint EU diplomatic response to malicious cyber activities
require attribution to a State or a non-State actor.
5. The EU affirms that measures within the Common Foreign and Security Policy, including, ifnecessary, restrictive measures, adopted under the relevant provisions of the Treaties, are suitable
for a Framework for a joint EU diplomatic response to malicious cyber activities and should
encourage cooperation, facilitate mitigation of immediate and long-term threats, and influence thebehavior of potential aggressors in a long term. The EU will work on the further development of aFramework for a joint EU diplomatic response to malicious cyber activities, guided by thefollowing main principles:•serve to protect the integrity and security of the EU, its Member States and their citizens,•take into account the broader context of the EU external relations with the State concerned,•

provide for the attainment of the CFSP objectives as set out in the Treaty on the EuropeanUnion (TEU) and the respective procedures provided for their attainment,•

be based on a shared situational awareness agreed among the Member States and correspondto the needs of the concrete situation in hand,•be proportionate to the scope, scale, duration, intensity, complexity, sophistication andimpact of the cyber activity,•

respect applicable international law and must not violate fundamental rights and freedoms.

6. The EU calls on the Member States, the European External Action Service (EEAS) and theCommission to give full effect to the development of a Framework for a joint EU diplomatic
response to malicious cyber activities and reaffirms in this regard its commitment to continue thework on that Framework in cooperation with the Commission, EEAS and other relevant parties by
putting in place implementing guidelines, including preparatory practices and communication
procedures and to test them through appropriate exercises.

9916/17
ANNEX

MK/ec
DGD2B

5EN