24.3.2022
EN
Official Journal of the European Union
C 132/105 Thursday 7 October 2021
O. whereas the Pegasus spyware scandal showed that large numbers of journalists, human rights activists, elected representatives and other EU citizens have been spied on; whereas various state actors like Russia, China and North Korea have been involved in malicious cyber activities in pursuit of political, economic and security objectives that include attacks on critical infrastructure, cyber espionage on and mass surveillance of EU citizens, aiding disinformation campaigns, distributing malware, and limiting access to the internet and the functioning of IT systems; whereas such activities disregard and violate international law, human rights and EU fundamental rights while jeopardising democracy, security, public order and the strategic autonomy of the EU, and therefore warrant a joint EU response, such as through the framework for a joint EU diplomatic response, including the use of restrictive measures envisaged for the EU cyber diplomacy toolbox;
P. whereas the Council decided for the first time on 30 July 2020 to impose restrictive measures against individuals, entities and bodies responsible for or involved in various cyberattacks in order to better prevent, discourage, deter and respond to malicious behaviour in cyberspace; whereas the legal framework for the EU cyber sanctions regime was adopted in May 2019;
Q. whereas attribution forms are a central component in cyber diplomacy and deterrence strategies;
R. whereas in recent years, EU-NATO cooperation has increased across multiple fields, including cyber security and defence, in line with the 2016 EU-NATO Joint Declaration;
S. whereas the 2010, 2013 and 2015 consensus reports of the UN Group of Governmental Experts (UN GGE), endorsed by the UN General Assembly, constitute a universal normative framework for cyber stability, consisting of the acknowledgment that existing international law, including the UN Charter in its entirety, applies in cyberspace, as do the 11 voluntary, non-binding norms of responsible state behaviour, as well as confidence-building measures and capacity building;
State of EU cyber defence capabilities
1.
Underlines that a common cyber defence policy and substantial EU level cooperation on generating common, and also better, cyber defence capabilities are core elements for the development of a deepened and enhanced European Defence Union and require a complex mix of technical, strategic and operational abilities; states that cyber defence refers to actions, instruments and processes which are proportionate and in line with international law, which include both military and civilian elements, and which aim to protect, inter alia, CSDP communication and information networks, and CSDP missions and operations, and to assist Member States; stresses the urgent need to develop and strengthen both common and Member State military cyber defence capabilities;
2.
Recalls that the borderless nature of cyber space, as well as the substantial number and increasing complexity of cyberattacks, require a coordinated Union-level response, including common Member State support capabilities and Member State support for measures in the EU’s cyber diplomacy toolbox, as well as intensified EU-NATO cooperation based on information sharing between cyber crisis response teams, the exchange of best practices, enhanced training, research and exercises;
3.
Welcomes the CDPF as a tool to support the development of Member States’ cyber defence capabilities; stresses that the review of the CDPF should first of all highlight the existing gaps and vulnerabilities as regards EU and national military structures; stresses the need to enhance coordination between EU institutions, agencies and bodies, between and with Member States, and with the European Parliament, in order to ensure the updated CDPF achieves the EU’s cyber defence objectives;
4.
Calls on the EEAS and the Commission to further develop, in cooperation with the Member States, a comprehensive set of measures and a coherent IT security policy to strengthen resilience, but also military cyber defence coordination; urges the strengthening of cooperation with the EU’s civilian Computer Emergency Response Team (CERT-EU) to protect networks used by all EU institutions, bodies and agencies, in close cooperation with CIOs in the respective entities, and of EU institutions’, bodies’ and agencies’ communication with Member States; calls for Parliament to ensure its participation in CERT-EU results to ensure a level of IT security that will allow it to receive all the necessary classified and non-classified