EUROPEAN COMMISSION Brussels, 16.12.2020 JOIN(2020) 18 final JOINT COMMUNICATION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL The EU's Cybersecurity Strategy for the Digital Decade



JOINT COMMUNICATION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL The EU's Cybersecurity Strategy for the Digital Decade I.INTRODUCTION: A CYBERSECURE DIGITAL TRANSFORMATION IN A COMPLEX THREAT ENVIRONMENT Cybersecurity is an integral part of Europeans’ security. Whether it is connected devices, electricity grids, or banks, aircraft, public administrations or hospitals they use or frequent, people deserve to do so within the assurance that they will be shielded from cyber threats. The EU’s economy, democracy and society depend more than ever on secure and reliable digital tools and connectivity. Cybersecurity is therefore essential for building a resilient, green and digital Europe. Transport, energy and health, telecommunications, finance, security, democratic processes, space and defence are heavily reliant on network and information systems that are increasingly interconnected. Cross-sector interdependences are very strong because networks and information systems, in their turn, depend on a steady supply of electricity to function. Connected devices already outnumber people on the planet, and their number is forecast to rise to 25 billion by 2025: a quarter of these will be in Europe. Digitisation of working patterns has been accelerated by the COVID-19 pandemic, during which 40% of EU workers switched to telework, with likely permanent effects on everyday life. This increases vulnerabilities to cyberattacks. Connected objects are often shipped to the consumer with known vulnerabilities, which further increases the attack surface for malicious cyber activities. The industrial landscape in the EU is increasingly digitised and connected; this also means that cyberattacks can have far greater impact on industries and ecosystems than ever before. The threat landscape is compounded by geopolitical tensions over the global and open Internet and over control of technologies across the whole supply chain. These tensions are reflected in the increasing number of nation states erecting digital borders. Restrictions of and on the Internet threaten global and open cyberspace, as well as the rule of law, fundamental rights, freedom and democracy – the core values of the EU. Cyberspace is increasingly exploited for political and ideological purposes, and increased polarisation at international level is hindering effective multilateralism. Hybrid threats combine disinformation campaigns with cyberattacks on infrastructure, economic processes and democratic institutions, with the potential for causing physical damage, obtaining unlawful access to personal data, stealing industrial or state secrets, sowing mistrust and weakening social cohesion. These activities undermine international security and stability and the benefits that cyberspace brings for economic, social and political development. The malicious targeting of critical infrastructure is a major global risk. The Internet has a decentralised architecture with no central structure and a multi-stakeholder governance. It has managed to sustain exponential increases in traffic volumes while being a constant target for malicious attempts at disruption. At the same time, there is increased reliance on the core functions of the global and open Internet, such as the Domain Name System (DNS), and essential Internet services for communications and hosting, applications and data. These services are more and more concentrated in the hands of a few private companies. This leaves the European economy and society vulnerable to disruptive geopolitical or technical events which affect the core of the Internet or one or more of these companies. The increased internet usage and changing patterns due to the pandemic have further exposed the fragility of supply chains that depend on this digital infrastructure. Concerns about security are a major disincentive to using online services. Around two-fifths of EU users have experienced security-related problems and three-fifths feel unable to protect themselves against cybercrime . One-third have received fraudulent e-mails or phone calls asking for personal details in the past three years, but 83% have never reported a cybercrime. One in eight businesses have been affected by cyberattacks . Over half of business and consumer personal computers that have been infected with malware once are re-infected within the same year. Hundreds of millions of records are lost each year through data breaches; the average cost of a breach to a single business rose to over €3.5 million in 2018 . The impact of a cyberattack often cannot be isolated, and can trigger chain reactions throughout the economy and society, affecting millions of individuals . The investigation of nearly all types of crime has a digital component. In 2019, the number of year-on-year incidents was reported to have trebled. There are an estimated 700 million new samples of malware – the most frequent means of furthering a cyberattack. The annual cost of cybercrime to the global economy in 2020 is estimated to be €5.5 trillion, double that of 2015 . This represents the largest transfer of economic wealth in history, greater than the global drugs trade. For one major incident, the WannaCry ransomware attack in 2017, the cost to the global economy was estimated at over €6.5 billion. Digital services and the finance sector are among the most frequent targets of cyberattacks, along with the public sector and manufacturing, yet cyber readiness and awareness among businesses and individuals remain low, and there is a major shortage of cybersecurity skills in the workforce. There were almost 450 cybersecurity incidents in 2019 involving European critical infrastructures like finance and energy. Healthcare organisations and professionals have been hit especially hard during the pandemic. As technology becomes inextricable from the physical world, cyberattacks put lives and the wellbeing of the most vulnerable at risk. Over two-thirds of companies, in particular SMEs, are considered ‘novices’ in cybersecurity, and European companies are considered less well prepared than companies in Asia and America . An estimated 291 000 posts for cybersecurity professionals in Europe remain unfilled. Hiring and training cybersecurity experts is a slow process leading to greater cybersecurity risks for organisations. The EU lacks collective situational awareness of cyber threats. This is because national authorities do not systematically gather and share information - such as that available from the private sector - which could help assess the state of cybersecurity in the EU. Only a fraction of incidents are reported by Member States, and information sharing is neither systematic nor comprehensive ; cyberattacks may be only one facet of concerted malicious attacks against European societies. There is currently only limited mutual operational assistance between Member States, and no operational mechanism is in place between Member States and EU institutions, agencies and bodies, in the event of a large-scale, cross-border cyber incidents or crisis. Improving cybersecurity is therefore essential for people to trust, use, and benefit from innovation, connectivity and automation, and for safeguarding fundamental rights and freedoms, including the rights to privacy and to the protection of personal data, and the freedom of expression and information. Cybersecurity is indispensable to the network connectivity and the global and open Internet that must underpin the transformation of the economy and society in the 2020s. It contributes to better and more jobs, more flexible workplaces, more efficient and sustainable transport and farming, and easier and fairer access to health services. It is also essential for the transition to cleaner energy under the European Green Deal, through cross-border grids and smart meters and avoiding unnecessary duplication of data storage. Lastly, it is essential to international security and stability and the development of economies, democracies and societies globally. Governments, businesses and individuals need therefore to use digital tools in a responsible, security-conscious manner. Cybersecurity awareness and hygiene must underpin the digital transformation of everyday activities. The EU’s new Cybersecurity Strategy for the Digital Decade forms a key component of Shaping Europe’s Digital Future, the Commission’s Recovery Plan for Europe, the Security Union Strategy 2020-2025, the Global Strategy for the EU’s Foreign and Security Policy, and the European Council Strategic Agenda 2019-2024. It sets out how the EU will shield its people, businesses and institutions from cyber threats, and how it will advance international cooperation and lead in securing a global and open Internet. II.THINKING GLOBAL, ACTING EUROPEAN This strategy aims to ensure a global and open Internet with strong guardrails to address the risks to the security and fundamental rights and freedoms of people in Europe. Following the progress achieved under the previous strategies, it contains concrete proposals for deploying three principal instruments –regulatory, investment and policy instruments – to address three areas of EU action – (1) resilience, technological sovereignty and leadership, (2) building operational capacity to prevent, deter and respond, and (3) advancing a global and open cyberspace. The EU is committed to supporting this strategy through an unprecedented level of investment in the EU's digital transition over the next seven years – potentially quadrupling previous levels – as part of new technological and industrial policies and the recovery agenda. Cybersecurity must be integrated into all these digital investments, particularly key technologies like Artificial Intelligence (AI), encryption and quantum computing, using incentives, obligations and benchmarks. This can stimulate the growth of the European cybersecurity industry and provide the certainty needed to ease the phasing out of legacy systems. The European Defence Fund (EDF) will support European cyber defence solutions, as part of the European defence technological and industrial base. Cybersecurity is included in external financial instruments to support our partners, notably the Neighbourhood, Development and International Cooperation Instrument. Preventing the misuse of technologies, protecting critical infrastructure and ensuring the integrity of supply chains also enables the EU’s adherence to the UN norms, rules and principles of responsible state behaviour. 1. RESILIENCE, TECHNOLOGICAL SOVEREIGNTY AND LEADERSHIP The EU’s critical infrastructure and essential services are increasingly interdependent and digitised. All Internet-connected things in the EU, whether automated cars, industrial control systems or home appliances, and the whole supply chains which make them available, need to be secure-by-design, resilient to cyber incidents, and quickly patched when vulnerabilities are discovered. This is fundamental to provide the EU’s private and public sector with the possibility to choose from the most secure infrastructures and services. The upcoming decade is the EU’s opportunity to lead in the development of secure technologies across the whole supply chain. Ensuring resilience and stronger industrial and technology capacities in cybersecurity should mobilise all necessary regulatory, investment and policy instruments. Cybersecurity by design for industrial processes, operations and devices can mitigate risks, potentially reduce costs to companies as well as to wider society, and thereby increase resilience.

1.1 Resilient infrastructure and critical services EU rules on the security of Network and Information Systems (NIS) are at the core of the Single Market for cybersecurity. The Commission proposes to reform these rules under a revised NIS Directive to increase the level of cyber resilience of all relevant sectors, public and private, that perform an important function for the economy and society. The review is necessary to reduce inconsistencies across the internal market by aligning scope, security and incident reporting requirements, national supervision and enforcement and the capabilities of competent authorities. A reformed NIS Directive will provide the basis for more specific rules that are also necessary for strategically important sectors, including energy, transport and health. In order to ensure a consistent approach as announced under the Security Union Strategy 2020-2025, the reformed Directive is proposed together with a review of the legislation on the resilience of critical infrastructure. Energy technologies embedding digital components and the security of the associated supply chains are important for the continuity of essential services and for the strategic control of critical energy infrastructure. The Commission will therefore propose measures, including a ‘network code’ setting rules for cybersecurity in cross-border electricity flows for adoption by end 2022. The financial sector must also strengthen digital operational resilience and ensure an ability to withstand all types of ICT-related disruptions and threats, as the Commission has proposed . In transport, the Commission added provisions on cybersecurity to the EU legislation on aviation security and will continue its efforts to enhance cyber resilience across all transport modes. Strengthening the cyber resilience of democratic processes and institutions is a core component of the European Democracy Action Plan for safeguarding and promoting free elections, and democratic discourse and media plurality. Finally, for the security of infrastructure and services under the future Space Programme, the Commission will continue to proceed with a deepening of the Galileo cybersecurity strategy for the next generation of Global Navigation Satellite System services, and other new components of the Space Programme. 1.2 Building a European Cyber Shield With the spread of connectivity and the growing sophistication of cyberattacks, Information Sharing and Analysis Centres, or ISACs, perform a valuable function, including at the sectoral level, in allowing information exchange between multiple stakeholders on cyber threats. In addition to this, networks and computer systems require constant monitoring and analysis to detect intrusions and anomalies in real time. Many private companies, public organisations and national authorities have therefore set up Computer Security Incident Response Teams (CSIRTs) and Security Operations Centres, or ‘SOCs’. Security Operations Centres are vital for collecting logs and isolating suspicious events occurring on the communication networks they monitor. They do this through signal and pattern identification and threat knowledge extraction from the large quantities of data that need to be assessed. They have contributed to the detection of the activities of malicious executables and in turn helped contain cyberattacks. The work required in these centres is highly demanding and fast-paced, which is why AI and in particular machine learning techniques can provide invaluable support to practitioners. The Commission proposes to build a network of Security Operations Centres across the EU, and to support the improvement of existing centres and the establishment of new ones. It will also support the training and skill development of staff operating these centres. It could commit, on the basis of a needs analysis conducted with relevant stakeholders and supported by the EU Agency for Cybersecurity (ENISA), over EUR 300 million to support public-private and cross-border cooperation in creating national and sectoral networks, involving also SMEs, based on appropriate governance, data sharing and security provisions. Member States are encouraged to co-invest in this project. The centres would then be able to more efficiently share and correlate the signals detected and create high-quality threat intelligence to be shared with ISACs and national authorities, and thus enabling a fuller situational awareness. The goal would be to connect, in phases, as many centres as possible across the EU to create collective knowledge and share best practices. Support will be made available to these centres to improve incident detection, analysis and response speeds through state-of-the-art AI and machine learning capabilities and complemented by supercomputing infrastructure developed in the EU by the European High-Performance Computing Joint Undertaking. Through sustained collaboration and cooperation, this network will provide timely warnings on cybersecurity incidents to authorities and all interested stakeholders, including the Joint Cyber Unit (see section 2.1). It will serve as a real cybersecurity shield for the EU, providing a solid mesh of watchtowers, able to detect potential threats before they can cause large-scale damage. 1.3 An ultra-secure communication infrastructure The European Union Governmental Satellite Communications, a component of the Space Programme, will provide secure and cost-efficient space- based communication capabilities to ensure the security- and safety- critical missions and operations managed by the EU and its Member States, including national security actors and EU institutions bodies and agencies. Member States have committed to working together with the Commission towards the deployment of a secure quantum communication infrastructure (QCI) for Europe. The QCI will offer public authorities a brand new way to transmit confidential information using an ultra-secure form of encryption to shield against cyberattacks, built with European technology. It will have two main components: existing terrestrial fibre communication networks linking strategic sites at national and cross-border levels; and linked space satellites covering the whole EU, including its overseas territories. This initiative to develop and deploy new and more secure forms of encryption, and to devise new ways of protecting critical communication and data assets, can help keep sensitive information and, in turn, critical infrastructures safe. In this perspective, and going further, the Commission will explore the possible deployment of a multi-orbital secure connectivity system. Building on GOVSATCOM and QCI, it would integrate cutting edge technologies (Quantum, 5G, AI, edge computing) adhering to the most restrictive cybersecurity framework in order to support secure-by-design services such as reliable, secure and cost-effective connectivity and encrypted communication for critical governmental activities. 1.4 Securing the next generation of broadband mobile networks EU citizens and companies using advanced and innovative applications enabled by 5G and future generations of networks should benefit from the highest security standard. Member States, together with the Commission and with the support of ENISA, have established with the EU 5G Toolbox of January 2020 a comprehensive and objective risk-based approach to 5G cybersecurity that is based on an assessment of possible mitigation plans and identification of the most effective measures. Moreover, the EU is consolidating its capabilities in 5G and beyond to avoid dependencies and to foster a sustainable and diverse supply chain. In December 2020, the Commission published a report on the impacts of the Recommendation of 26 March 2019 on the Cybersecurity of 5G networks. It showed that considerable progress has been made since the Toolbox was agreed, and that most Member States are on track to complete a significant part of the Toolbox implementation in the near future, albeit with some variations and remaining gaps as already identified in the Progress report published in July 2020. In October 2020, the European Council called on the EU and the Member States ‘to make full use of the 5G cybersecurity toolbox’ and ‘to apply the relevant restrictions on high-risk suppliers for key assets defined as critical and sensitive in the EU coordinated risk assessments, based on common objective criteria’. Looking forward, the EU and its Member States should ensure that the identified risks have been mitigated adequately and in a coordinated way, in particular as regards the objective of minimising the exposure to high risk suppliers and of avoiding dependency on these suppliers at national and Union level, and that any new significant development, or risk, is taken into account. Member States are invited to make full use of the Toolbox in their investments in digital capacities and connectivity. Based on the report of the impacts of the 2019 Recommendation, the Commission encourages Member States to accelerate the work towards completing the implementation of the main Toolbox measures by the second quarter of 2021. It also calls on Member States to continue monitoring together progress made and ensuring further alignment of approaches. At EU level, three main objectives will be pursued in order to support this process: ensuring further convergence in risk mitigation approaches across the EU, supporting continuous exchange of knowledge and capacity building, and promoting supply chain resilience and other EU strategic security objectives. Concrete actions related to these key objectives are set out in the dedicated Appendix to this Communication. The Commission will continue to work closely with Member States to fulfil these objectives and actions with the support of ENISA (see Annex).

1.5 An Internet of Secure Things Every connected thing contains vulnerabilities that can be exploited with potentially widespread ramifications. Internal Market rules include safeguards against insecure products and services. The Commission is already working to ensure transparent security solutions and certification under the Cybersecurity Act and to incentivise safe products and services without compromising on performance. It will adopt its first Union Rolling Work Programme in the first quarter of 2021 (to be updated at least once every three years) to allow industry, national authorities and standardisation bodies to prepare in advance for future European cybersecurity certification schemes. As the Internet of Things proliferates, enforceable rules require strengthening, both to ensure overall resilience and boost to cybersecurity. The Commission will consider a comprehensive approach, including possible new horizontal rules to improve the cybersecurity of all connected products and associated services placed on the Internal Market. Such rules could include a new duty of care for connected device manufacturers to address software vulnerabilities including the continuation of software and security updates as well as ensuring, at the end of life, deletion of personal and other sensitive data. These rules would bolster ‘the right-to-repair obsolete software” initiative presented in the Circular Economy Action Plan and complement ongoing measures which address specific types of products, such as mandatory requirements to be proposed for market access of certain wireless products (through the adoption of a delegated act under the Radio Equipment Directive), and the objective to implement cybersecurity rules for motor vehicles for all new vehicle types as from July 2022. They would, moreover, build on the proposed revision of general product safety rules, which do not directly address cybersecurity aspects. 1.6 Greater global Internet security A set of core protocols and supporting infrastructure ensures the functionality and integrity of the Internet worldwide. This set includes the DNS and its hierarchical and delegated system of zones, starting, at the top of the hierarchy, with the root zone and the thirteen DNS root servers on which the World Wide Web depends. The Commission intends to develop a contingency plan, supported by EU funding, for dealing with extreme scenarios affecting the integrity and availability of the global DNS root system. It will work with ENISA, the Member States, the two EU DNS root server operators and the multi-stakeholder community, to assess the role of these operators in guaranteeing that the Internet remains globally accessible in all circumstances. For a client to access a resource under a particular domain name on the Internet, its request (typically for a Uniform Resource Locator, or URL) needs to be translated or ‘resolved’ into an IP address, through reference to DNS name servers. However, people and organisations in the EU increasingly rely on a few public DNS resolvers operated by non-EU entities. Such consolidation of DNS resolution in the hands of few companies renders the resolution process itself vulnerable in case of significant events affecting one major provider, and makes it more difficult for EU authorities to address possible malicious cyberattacks and major geopolitical and technical incidents. With a view to reducing security issues related to market concentration, the Commission will encourage relevant stakeholders including EU companies, Internet Service Providers and browser vendors to adopt a DNS resolution diversification strategy. The Commission also intends to contribute to secure Internet connectivity by supporting the development of a public European DNS resolver service. This ‘DNS4EU’ initiative will offer an alternative, European service for accessing the global Internet. DNS4EU will be transparent, conform to the latest security, data protection and privacy by design and by default standards and rules and form part of the European Industrial Alliance for Data and Cloud. The Commission will also, in liaison with Member States and industry, accelerate the uptake of key internet standards including IPv6 and well-established internet security standards and good practices for DNS, routing, and email security, not excluding regulatory measures like a European sunset clause for IPv4 to steer the market if there is insufficient progress towards their adoption. The EU should promote (as for example under the EU-Africa Strategy) the implementation of these standards in partner countries as a way to support the development of the global and open Internet and to counteract closed and control-based models of the Internet. Finally, the Commission will consider the need for a mechanism for more systematic monitoring and gathering of aggregated data on Internet traffic and for advising on potential disruptions. 1.7 A reinforced presence on the technology supply chain With its planned financial support for cyber-secure digital transformation over the 2021-2027 Multiannual Financial Framework, the EU has the unique opportunity to pool its assets to propel its Industry Strategy and leadership in digital technologies and cybersecurity across the digital supply chain (including data and cloud, next generation processor technologies, ultra-secure connectivity and 6G networks), in line with its values and priorities. Public sector intervention should rely on the tools provided by the EU public procurement regulatory framework and Important Projects of Common European Interest. Beyond this, it can unlock private investments through public-private partnerships (including building on the experience of the contractual public private partnership on cybersecurity and its implementation through the European Cyber Security Organisation), venture capital in support of SMEs or industrial alliances and strategies on technology capacities. Special focus will be put also on the Technical Support Instrument and best use of the latest cybersecurity tools by SMEs - especially those not falling under the scope of the revised NIS Directive - including through dedicated activities under the Digital Innovation Hubs in the Digital Europe Programme. The objective is to trigger a similar amount of investments by the Member States, to be matched by industry under a partnership co-governed with Member States in the proposed Cybersecurity Industrial, Technology and Research Competence Centre and Network of Coordination Centres (CCCN). The CCCN should play a key role, with input from industry and academic communities, in developing the EU’s technological sovereignty in cybersecurity, building capacity to secure sensitive infrastructures such as 5G, and reduce dependence on other parts of the globe for the most crucial technologies. The Commission intends to support, potentially with the CCCN, the development of a dedicated cybersecurity Masters programme, and contribute to a common European Cybersecurity Research and Innovation Roadmap beyond 2020. Investments through the CCCN would also build on the cooperation in research and development performed by networks of cybersecurity excellence centres, bringing together Europe’s best research teams with industry to design and implement common research agendas, in line with the European Cyber Security Organisation roadmap. The Commission will continue to rely on the research work done by ENISA and Europol, and will also continue supporting, as part of Horizon Europe, individual Internet innovators developing privacy-enhancing and secure communication technologies based on open source software and hardware, as currently under the Next Generation Internet initiative. 1.8 A Cyber-skilled EU workforce The EU’s efforts to upskill the workforce, to develop, attract and retain the best cybersecurity talent and to invest in world class research and innovation, form an important component of protecting against cyber threats generally. This field offers great potential. Hence specific attention must be paid to developing, attracting and retaining more diverse talent. The Revised Digital Education Action Plan will raise cybersecurity awareness among individuals, especially children and young people, and organisations, especially SMEs. It will also encourage women’s participation in science, technology, engineering, and mathematics (‘STEM’) education and ICT jobs upskilling and reskilling in digital skills. In addition, the Commission will, together with the EU Intellectual Property Office at Europol, ENISA, Member States and the private sector, develop awareness tools and guidance to increase the resilience of EU businesses against cyber-enabled intellectual property theft. Education – including Vocational Education and Training (VET), awareness and exercises - should also further increase cybersecurity and cyber defence skills at EU level. To this end, the relevant EU actors such as the ENISA, the European Defence Agency (EDA), the European Security and Defence College (ESDC) should seek synergies between their respective activities. Strategic initiatives The EU should ensure: ·Adoption of revised NIS Directive; ·Regulatory measures for an Internet of Secure Things ·Through the CCCN investment in cybersecurity (notably through the Digital Europe Programme, Horizon Europe and recovery facility) to reach up to €4.5 billion in public and private investments over 2021-2027; ·An EU network of AI-enabled Security Operation Centres and an ultra-secure communication infrastructure harnessing quantum technologies; ·Widespread adoption of cybersecurity technologies through dedicated support to SMEs under the Digital Innovation Hubs; ·Development of an EU DNS resolver service as a safe and open alternative for EU citizens, businesses and public administration to access the Internet; and ·Completion of the implementation of the 5G Toolbox by the second quarter of 2021(see Annex). 2. BUILDING OPERATIONAL CAPACITY TO PREVENT, DETER AND RESPOND Cyber incidents, whether accidental or the deliberate action of criminals, state and other non-state actors, can cause enormous damage. Their scale and complexity, often involving the exploitation of third-party services, hardware, and software to compromise a final target, make the EU’s collective threat environment hard to counter without systematic and comprehensive information sharing and cooperation on a common response. The EU aims, through the full implementation of regulatory tools, mobilisation and cooperation, to support Member States in defending their citizens, as well as their economic and national security interests, in full respect of fundamental rights and freedoms and the rule of law. Several communities, composed of networks, EU institutions, bodies and agencies, as well as Member State authorities, are responsible for preventing, discouraging, deterring and responding to cyber threat, using their respective instruments and initiatives. These communities include: (i) NIS authorities, such as CSIRTs, and disaster response; (ii) law enforcement and judicial authorities; (iii) cyber diplomacy; and (iv) cyber defence. 2.1 A Joint Cyber Unit

A Joint Cyber Unit would serve as a virtual and physical platform for cooperation for the different cybersecurity communities in the EU, with a focus on operational and technical coordination against major cross border cyber incidents and threats. The Joint Cyber Unit would be an important step forward towards completing the European cybersecurity crisis management framework. As outlined in the Commission President’s Political Guidelines, the Unit should enable Member States and EU institutions, bodies and agencies to make full use of existing structures, resources and capabilities and promote a ‘need-to-share’ mind-set. It would provide the means to consolidate the progress made so far in the implementation of the 2017 Recommendation on a coordinated response to large-scale cybersecurity incidents and crises (‘Blueprint’). It would also provide the opportunity to further reinforce the cooperation around the Blueprint architecture and harness the progress achieved notably within the NIS Cooperation Group and the CyCLONe Network. This could address two main gaps that currently increase vulnerabilities and create inefficiencies in the response to cross-border threats and incidents affecting the Union. Firstly, civilian, diplomatic, law enforcement and defence cybersecurity communities do not yet have a common space to nurture structured cooperation and facilitate operational and technical cooperation. Secondly, relevant cybersecurity stakeholders have not yet been able to tap into the full potential of operational cooperation and mutual assistance within existing networks and communities. This includes the absence of a platform allowing for operational cooperation with the private sector. The Unit should improve and accelerate coordination and allow the EU to face up and respond to large-scale cyber incidents and crises. The Joint Cyber Unit would not be an additional, standalone body, nor would it affect the competences and powers of national cybersecurity authorities or EU participants. Rather, the Unit would act as a backstop where the participants can draw on one another’s support and expertise, especially in the event that various cyber communities are required to work closely together. At the same time, recent events show the necessity for the EU to step up its level of ambition and readiness to face the cyber threats landscape and realities. As part of their contribution to the JCU, the EU actors (Commission and EU agencies and bodies) will therefore be ready to increase significantly their resources and capabilities, so as to level up their preparedness and resilience. The Joint Cyber Unit would fulfil three main objectives. Firstly, it would ensure preparedness across cybersecurity communities; secondly, through information sharing it would provide continuous shared situational awareness; thirdly, it would reinforce coordinated response and recovery. To achieve these objectives, the Unit should build on well-defined blocks and goals, such as guaranteeing secure and rapid information sharing, improving cooperation among participants, including interaction between Member States and relevant EU entities, establishing structured partnerships with a trusted industry base and facilitating a coordinated approach to cooperation with external partners. In order to do so, based on a mapping of available capabilities at national and EU level, the Unit could facilitate the development of a cooperation framework. For the Joint Cyber Unit to become the heart of EU cybersecurity operational cooperation, the Commission will work with Member States and relevant EU institutions, bodies and agencies, including ENISA, CERT-EU and Europol, to promote an incremental and inclusive approach, in full respect of competences and mandates of all those involved. In line with this approach, the Unit could contribute to further cooperation between constituents of a specific cyber community, where those constituents deem it necessary. Four main steps are proposed to deliver the Joint Cyber Unit: ·Define, by mapping available capabilities at national and EU level; ·Prepare, by establishing a framework for structured cooperation and assistance; ·Deploy, by implementing the framework drawing on resources provided by participants so that the Joint Cyber Unit becomes operational; ·Expand, by strengthening coordinated response capacity with input from industry and partners. Building on the outcome of the consultation with Member States, EU institutions, bodies and agencies, the Commission, with the involvement of the High Representative, in line with his competences, will by February 2021 present the process, milestones and timeline for defining, preparing, deploying and expanding the Joint Cyber Unit. 2.2 Tackling cybercrime Our dependence on online tools has exponentially increased the attack surface for cyber criminals, and led to a situation where the investigation of nearly all types of crime has a digital component. Furthermore, core parts of our society are threatened by cyber actors and by those using cyber tools to plan and execute their illegal actions. There are therefore close links to the EU’s overall security policy, as reflected in the cyber elements in its 2020 Security Union Strategy and in the EU’s Counter-Terrorism Agenda. Tackling cybercrime effectively is a key factor in ensuring cybersecurity: deterrence cannot be achieved through resilience alone but also requires identification and prosecution of offenders. It is therefore essential to foster the cooperation and exchange between cybersecurity actors and law enforcement. At EU level, therefore, Europol and ENISA have already built strong cooperation where they have organised joint conferences and workshops and provided joint reports to the Commission, Member States and other stakeholders on cybersecurity threats and technological challenges. The Commission will continue to support this integrated approach to ensure a coherent and effective response, based on a comprehensive information picture. As one important element of that response, EU and national authorities need to expand and improve the capacity of law enforcement to investigate cybercrime, fully respecting fundamental rights and pursuing the required balance between various rights and interests. The EU should be able to tackle cybercrime through fully implemented legislation that is fit-for-purpose, with a particular focus on combating child sexual abuse online, and on digital investigations, including criminality on the ‘darknet’. Law enforcement must be fully equipped for digital investigations. The Commission will therefore put forward an action plan to improve digital capacity for law enforcement agencies, by providing them with the necessary skills and tools. In addition, Europol will further develop its role as a centre of expertise to support national law enforcement authorities combatting cyber-enabled and cyber-dependent crime, contributing to the definition of common forensic standards (through Europol’s Innovation Lab and Hub).All these activities require appropriate take-up by Member States, which are encouraged to make use of the Internal Security Fund’s national programmes and to propose projects in response to calls for proposals as part of the Thematic Facility. The Commission will use all appropriate means, including infringement proceedings, to ensure that the 2013 Directive on attacks against information systems is fully transposed and implemented, including the provision of statistics by Member States. It will better prevent the abuse of domain names, including where appropriate for the distribution of illegal content, and pursue the availability of accurate registration data by continuing to engage with the Internet Corporation for Assigned Names and Numbers (ICANN) and other stakeholders in the internet governance system, notably through the Public Safety Working Group of ICANN’s Governmental Advisory Committee. The proposal in the revised NIS Directive accordingly envisages the maintaining of accurate and complete databases of domain names and registration data, or ‘WHOIS data’, and providing lawful access to such data as essential to ensuring the security, stability and resilience of the DNS. The Commission will also continue to work to provide appropriate channels and clarify rules to obtain cross-border access to electronic evidence for criminal investigations (needed in 85% of investigations, with 65% of the total requests going to providers based in another jurisdiction), by facilitating the adoption and subsequent implementation of the ‘e-evidence package’ and practical measures. The swift adoption by the European Parliament and Council of the e-evidence proposals is key to provide practitioners with an efficient tool. Electronic evidence must be readable, thus the Commission will further work on the support to law enforcement capacity in the area of digital investigations, including dealing with encryption when encountered in criminal investigations while fully preserving its function to protect fundamental rights and cybersecurity. 2.3 EU cyber diplomacy toolbox The EU has been using its cyber diplomacy toolbox to prevent, discourage, deter and respond to malicious cyber activities. After introducing the legal framework for targeted restrictive measures against cyber-attacks in May 2019, the EU listed six individuals and three entities responsible for, or involved in, cyber-attacks affecting the EU and its Member States under the regime in July 2020. Another two individuals and one body were listed in October 2020. Malicious cyber activities, including those of a slow-burning nature, should be tackled by an effective and comprehensive joint EU diplomatic response, using the full range of measures available at EU level.

A swift and effective joint EU diplomatic response requires solid shared situational awareness and the ability to prepare rapidly a joint EU position. The High Representative of the Union for Foreign Affairs and Security Policy will encourage and facilitate the establishment of a Member States’ EU cyber intelligence working group residing within the EU Intelligence and Situation Centre (INTCEN) to advance strategic intelligence cooperation on cyber threats and activities. This work will further support EU situational awareness and decision-making on a joint diplomatic response. The working group is to engage with existing structures, including, where necessary, those covering the wider threat of hybrid and foreign interference, to collect and assess situational awareness. To strengthen its ability to prevent, discourage, deter and respond to malicious behaviour in cyberspace, the High Representative, with the involvement of the Commission in line with its competences, will present a proposal for the EU to further define its cyber deterrence posture. Building on the work under the cyber diplomacy toolbox to date, the posture should contribute to responsible state behaviour and cooperation in cyberspace, and should give particular direction on countering those cyber-attacks that have the most significant effect, notably those affecting our critical infrastructure, democratic institutions and processes, as well as supply chain-attacks and cyber-enabled theft of intellectual property. The posture should outline how the EU and Member States could leverage their political, economic, diplomatic, legal and strategic communication tools against malicious cyber activities, as well as should address how the EU and Member States could advance their ability to attribute malicious cyber activities. In addition, together with the Council and the Commission, the High Representative aims to look into additional measures under the cyber diplomacy toolbox, including the possibility for further options for restrictive measures as well as by exploring qualified majority voting (QMV) for listings under the horizontal sanctions regime against cyber-attacks. In addition, the EU should undertake further efforts to strengthen the cooperation with international partners, including NATO, to advance the shared understanding of the threat landscape, develop cooperation mechanisms and identify cooperative diplomatic responses. The High Representative, with the involvement of the Commission, will as well propose an update of the implementing guidelines of the cyber diplomacy toolbox, including in view of increasing the efficiency of the decision-making process, and continues to organise exercises as well as assessments on the cyber diplomacy toolbox on a regular basis. In addition, the EU should further integrate the cyber diplomacy toolbox in EU crisis mechanisms, seek synergies with efforts to counter hybrid threats, disinformation and foreign interference under the Joint Framework on countering hybrid threats and European Democracy Action Plan. In this context, the EU should reflect upon the interaction between the cyber diplomacy toolbox and the possible use of Article 42.7 TEU and Article 222 TFEU. 2.4 Boosting cyber defence capabilities The EU and Member States need to increase their ability to prevent and respond to cyber threats in line with the EU Level of Ambition derived from the 2016 EU Global Strategy. To this end, the High Representative, in cooperation with the Commission, will present a review of the Cyber Defence Policy Framework (CDPF) to enhance further coordination and cooperation between EU actors, as well as with and between Member States, including as regards the Common Security and Defence Policy (CSDP) missions and operations. The CDPF should inform the upcoming Strategic Compass, ensuring that cybersecurity and cyber defence are further integrated into the wider security and defence agenda. In 2018, the EU identified cyberspace as a domain of operations. An upcoming ‘Military Vision and Strategy on Cyberspace as a Domain of Operations’ by the EU Military Committee should further define how cyberspace as a domain of operations enables EU CSDP military missions and operations. The Military CERT-Network, being set up by the European Defence Agency (EDA), will further contribute to significantly increase cooperation among Member States. In addition, to ensure cybersecurity of critical space infrastructures under the responsibility of the Space Programme, the European Agency for the Space Programme and in particular the Galileo Security Monitoring Centre will be reinforced and its mandate extended to other critical assets of the Space Programme. The EU and Member States should provide further impetus for the development of state-of-the-art cyber defence capabilities through different EU policies and instruments, notably the CDPF, and where appropriate, building on the work of the EDA. This requires a strong emphasis on the development and use of key technologies such as AI, encryption and quantum computing. In line with the 2018 EU Capability Development Priorities and based on the findings of the first full Coordinated Annual Review on Defence (CARD) report, the EU should further foster cooperation among Member States on cyber defence research, innovation and capability development, encouraging Member States to make use of the full potential of the Permanent Structured Cooperation (PESCO) and EDF. The forthcoming Commission Action Plan on synergies between the civil, defence, and space industries to be presented in the first quarter of 2021,will include actions to further support synergies at the level programmes, technologies, innovation and start-ups, in line with the governance of the respective programmes. In addition, relevant synergies and interfaces should be developed between cyber defence initiatives taken forward in other frameworks, including the cyber-related collaborative projects by Member States under PESCO, as well as with the EU cybersecurity structures, to support information sharing and mutual support. Strategic initiatives The EU should: ·Complete the European cybersecurity crisis management framework and determine the process, milestones and timeline for establishing the Joint Cyber Unit; ·Continue implementation of cybercrime agenda under the Security Union Strategy; ·Encourage and facilitate the establishment of a Member States’ cyber intelligence working group residing within the EU INTCEN; ·Advance the EU’s cyber deterrence posture to prevent, discourage, deter and respond to malicious cyber activities; ·Review the Cyber Defence Policy Framework; ·Facilitate the development of an EU "Military Vision and Strategy on Cyberspace as a Domain of Operations" for CSDP military missions and operations; ·Support synergies between civil, defence and space industries; and ·Reinforce cybersecurity of critical space infrastructures under the Space Programme. 3. ADVANCING A GLOBAL AND OPEN CYBERSPACE The EU should continue to work with international partners to promote a political model and vision of cyberspace grounded in the rule of law, human rights, fundamental freedoms and democratic values that bring social, economic and political development globally, and contribute to a Security Union. International cooperation is essential to keeping cyberspace global, open, stable and secure. The EU should to this end continue to work with third countries, international organisations as well as the multi-stakeholder community, to develop and implement a coherent and holistic international cyber policy, mindful of the increasing interconnection between economic aspects of new technologies, internal security and foreign, security and defence policies. The EU, as a strong economic and trading bloc founded on core democratic values, respect for the rule of law and fundamental rights, is also uniquely placed to lead in defining and promoting international norms and standards. 3.1. EU leadership on standards, norms and frameworks in cyberspace Stepping up on international standardisation To promote and defend its vision of cyberspace at the international level, the EU needs to step up its engagement in, and leadership on international standardisation processes, and enhance its representation in international and European standardisation bodies as well as other standard development organisations . As digital technologies are developing at a fast pace, international standards are of increasing importance in complementing traditional regulatory efforts in areas such as AI, cloud, quantum computing and quantum communication. International standardisation is increasingly used by third countries to advance their political and ideological agenda, which often does not correspond with the values of the EU. In addition, there is a growing risk of competing frameworks for international standardisation, leading to fragmentation. Shaping international standards in the areas of emerging technologies and the core internet architecture in line with EU values is essential to ensure that the Internet remains global and open, that technologies are human-centric, privacy-focused, and that their use is lawful, safe and ethical. As part of its upcoming Standardisation Strategy, the EU should define its objectives for international standardisation, and conduct proactive and coordinated outreach to promote these at international level. Stronger cooperation and burden sharing should be sought with like-minded partners and European stakeholders. Advance Responsible State Behaviour in Cyberspace The EU continues to work with international partners to advance and promote a global, open, stable and secure cyberspace where international law, in particular the United Nations (UN) Charter , is respected, and the voluntary non-binding norms, rules and principles of responsible state behaviour are adhered to. With the deterioration of an effective multilateral debate on international security in cyberspace, there is a clear need for the EU and Member States to take a more proactive stance in the discussions in the UN and other relevant international fora. The EU is best placed to advance, coordinate and consolidate Member States’ positions in international fora, and should develop an EU position on the application of international law in cyberspace. The High Representative, together with the Member States, also aims to take forward their inclusive and consensus-based proposal for a political commitment on a Programme of Action to Advance Responsible State Behaviour in Cyberspace (PoA) in the UN. Building on the existing acquis as endorsed by the UN General Assembly, the PoA offers a platform for cooperation and exchange of best practices within the UN, and proposes to establish a mechanism to put in practice the norms of responsible state behaviour and promote capacity building. In addition, the High Representative aims to strengthen and encourage the implementation of confidence-building measures between states, including sharing best practices at regional and multilateral levels and contributing to cross-regional cooperation. Increased global connectivity should not lead to censorship, mass surveillance, data privacy breaches and repression against civil society, academia and citizens. The EU should continue to lead on the protection and promotion of human rights and fundamental freedoms online. To this end, the EU should promote further compliance with international human rights law and standards, and operationalise its Action Plan on Human Rights and Democracy 2020-2024, and advance its Human Rights Guidelines on Freedom of Expression Online and Offline, offering a new impetus on the practical application of EU instruments. The EU should make sustained efforts to protect human rights defenders, civil society and academia working on issues such as cybersecurity, data privacy, surveillance and online censorship. To this end, the EU should provide further practical guidance, promote best practices and step-up its efforts to prevent the misuse of emerging technologies, notably through the use of diplomatic measures where necessary, as well as the export control of such technologies. The EU should also continue to fight for the protection of the most vulnerable members of society online, by putting forward legislation to better protect children against child sexual abuse and exploitation and a Strategy on the Rights of the Child. The Budapest Convention on Cybercrime

The EU continues to support third countries that wish to accede to the Council of Europe Budapest Convention on Cybercrime, and work to finalise the Second Additional Protocol to the Budapest Convention that includes measures and safeguards to improve international cooperation between law enforcement and judicial authorities, as well as between authorities and service providers in other countries, and for which the Commission participates in the negotiations on behalf of the EU . The current initiative for a new legal instrument on cybercrime at UN level risks to amplify divisions and slow down much needed national reforms and related capacity building efforts, potentially hindering effective international cooperation against cybercrime: the EU does not see a need for any new legal instrument on cybercrime at UN level. The EU continues to engage in the multilateral exchanges on cybercrime to ensure the respect of human rights and fundamental freedoms, through inclusiveness, transparency, and taking into account available expertise, with the goal of delivering added value for all. 3.2 Cooperation with partners and the multi-stakeholder community The EU should strengthen and expand its cyber dialogues with third countries to promote its values and vision for cyberspace, sharing best practices, and seeking to cooperate more effectively. The EU should also establish structured exchanges with regional organisations such as the African Union, the ASEAN Regional Forum, the Organisation of American States, and the Organization for Security Cooperation in Europe. At the same time, the EU should endeavour to find common ground, where possible and opportune, with other partners based on issues of common interest. Working with the EU Delegations, as well as where relevant Member States’ embassies around the world, the EU should form an informal EU Cyber Diplomacy Network to promote the EU vision of cyberspace, exchange information and regularly coordinate on developments in cyberspace . Building on the Joint Declarations of 8 July 2016 and 10 July 2018, the EU should continue to advance EU-NATO cooperation, notably on cyber defence interoperability requirements. In this context, the EU should further pursue the affiliation of relevant CSDP structures to NATO’s Federated Mission Networking, allowing network interoperability with NATO and partners when necessary. In addition, cooperation between the EU and NATO on education, training and exercises should be further explored, including by seeking synergies between the European Security and Defence College and the NATO Cooperative Cyber Defence Centre of Excellence. In line with its values, the EU strongly supports and promotes the multi-stakeholder model for Internet governance. No single entity, government, or international organisation should seek to control the Internet. The EU should continue to engage in fora to enhance cooperation and ensure the protection of fundamental rights and freedoms, notably the right to dignity, privacy and freedom of expression and information. To advance multi-stakeholder cooperation on cybersecurity issues, the Commission and High Representative, in line with their respective competences, aim to reinforce regular and structured exchanges with stakeholders, including the private sector, academia and civil society, underlining that the interconnected nature of cyberspace requires all stakeholders to exchange upon, and take their specific responsibilities to maintain a global, open, stable and secure cyberspace. These efforts will provide valuable input for potential key actions at EU level. 3.3. Strengthening global capacities to increase global resilience To ensure that all countries are able to reap the social, economic and political benefits of the Internet and the use of technologies, the EU continues to support its partners to increase their cyber resilience and capacities to investigate and prosecute cybercrime and address cyber threats. In order to ensure overall coherence, the EU should develop an EU External Cyber Capacity Building Agenda to steer these efforts in line with its External Cyber Capacity Building Guidelines and the Agenda 2030 for Sustainable Development. The Agenda should leverage the expertise of Member States and relevant EU institutions, bodies and agencies and initiatives, including the EU's Cyber Capacity Building Network , in line with their respective mandates. An EU Cyber Capacity Building Board, shall be created to encompass relevant EU institutional stakeholders, and to monitor progress, as well as the identification of further synergies and potential gaps. It can furthermore support enhanced cooperation with Member States, as well as with public and private sector partners and other relevant international bodies to ensure coordination of efforts and avoid duplications. EU cyber capacity building should continue to focus on the Western Balkans and in the EU’s neighbourhood, as well as on partner countries experiencing a rapid digital development. The EU efforts should support the development of legislation and policies of partner countries in line with relevant EU cyber diplomacy policies and standards. In this context, EU capacity building efforts in the field of digitalisation should include cybersecurity as a standard feature. To this end, the EU should develop a training programme dedicated to EU staff in charge of the implementation of EU digital and cyber external capacity building efforts. The EU should also assist these countries in tackling the growing challenge of malicious cyber activities that harm the development of their societies and the integrity and security of democratic systems, in line with the efforts under the European Democracy Action Plan. Peer-to-peer learning between EU Member States as well as relevant EU agencies and third countries could be particularly useful in this respect. Finally, within the context of the 2018 Civilian CSDP Compact, civilian CSDP missions can also contribute to the EU’s wider response to tackle cyber security challenges, notably by strengthening the rule of law within, as well as law-enforcement and civilian administrations’ capabilities of, partner countries. Strategic initiatives The EU should: ·Define a set of objectives in international standardisation processes, and promote these at international level; ·Advance international security and stability in cyberspace, notably through the proposal by the EU and its Member States for a Programme of Action to Advance Responsible State Behaviour in Cyberspace (PoA) in the United Nations; ·Offer practical guidance on the application of human rights and fundamental freedoms in cyberspace; ·Better protect children against child sexual abuse and exploitation, as well as a Strategy on the Rights of the Child; ·Strengthen and promote the Budapest Convention on Cybercrime, including through the work on the Second Additional Protocol to the Budapest Convention; ·Expand EU cyber dialogue with third countries, regional and international organisations, including through an informal EU Cyber Diplomacy Network; ·Reinforce the exchanges with the multi-stakeholder community, notably by regular and structured exchanges with the private sector, academia and civil society; and ·Propose an EU External Cyber Capacity Building Agenda and an EU Cyber Capacity Building Board. III.CYBERSECURITY IN THE EU INSTITUTIONS, BODIES AND AGENCIES Given their high political profile, their critical missions to coordinate highly sensitive issues, and their role in managing large sums of public money, the EU institutions, bodies and agencies are regular targets of cyberattacks, particularly cyber-espionage. However, the level of cyber resilience and ability to detect and respond to malicious cyber activities varies significantly across these entities in terms of maturity. It is thus necessary to improve the overall level of cybersecurity through consistent and homogeneous rules. In the area of information security, progress has been made towards more consistency of the rules for the protection of EU classified information as well as sensitive non-classified information. However, the interoperability of classified information systems remains limited, preventing a seamless transfer of information between the different entities. Further progress should be made to enable an inter-institutional approach to the handling of EU classified information and sensitive non-classified information, which could also serve as a model for interoperability across Member States. A baseline should also be established to simplify procedures with Member States. The EU should also further develop its ability to communicate in a secure manner with relevant partners, building to the extent possible on existing arrangements and procedures. As announced in the Security Union Strategy, the Commission will therefore make proposals for common binding rules on information security and for common binding rules on cybersecurity for all EU institutions, bodies and agencies in 2021, based on ongoing EU inter-institutional discussions on cybersecurity. Current and future trends of teleworking will also necessitate further investments in secure equipment, infrastructures and tools that allow to work remotely on sensitive and classified files. In addition, the increasingly hostile cyber threat landscape and the increased incidence of more sophisticated cyberattacks affecting the EU institutions, bodies and agencies drives the need for increased investments to reach a high level of cyber maturity. A Cyber Awareness Programme is being set up for all EU institutions, bodies and agencies to raise staff’s awareness, cyber hygiene and support a common cyber security culture. The reinforcement of CERT-EU with an improved funding mechanism is necessary to increase its ability to help EU institutions, bodies and agencies to apply the new cybersecurity rules, improve their cyber resilience. The mandate of CERT-EU must also be strengthened to provide it with a stable means to meet these objectives. Strategic initiatives 1.Regulation on Information Security in the EU institutions bodies and agencies 2.Regulation on Common Cybersecurity Rules for EU institutions, bodies and agencies 3.A new legal base for CERT-EU to reinforce its mandate and funding. IV.CONCLUSIONS The concerted implementation of this strategy will contribute to a cybersecure digital decade for the EU, to the achievement of a Security Union, and to the strengthening of the EU’s position globally.