Debate: EU preparedness against cyber-attacks following Russia invasion on Ukraine
Date: TUESDAY, 3 MAY 2022
Speaker: Margaritis Schinas
Language: EN

As we speak, cyber—warfare is going on in our neighbourhood. It has started weeks before the Russian invasion and it continues. It is striking Ukraine’s most critical infrastructure and networks with a double aim to further destabilise the country and demoralise its people.  Ukrainian websites have experienced a tenfold increase in attacks since the Russian invasion and on the day of the invasion itself, a cyberattack against the Viasat and KSAT satellite network used by the Ukrainian military and police caused disruption to thousands of customers that use these connectivity services. While, in the meantime, Ukraine is being targeted by Russian-aligned criminal ransomware gangs, which can only add to the volatility of the situation.  We are doing our utmost, together with my colleagues, to support Ukraine’s cyber—resilience. The Commission and the European Action External Service have been coordinating with Member States and the private sector with the provision of technical assistance, equipment, software and relevant services, as per the needs of the Ukrainian Government.  Let me tell you that the case of Ukraine is not an isolated one. Over the last months and the year, our Member States have also been hit by waves of largescale cyberattacks targeting their most critical sectors from healthcare to telecom operators, to public administrations, to wind energy companies and health.  This is, unfortunately, the new reality of today’s world. This is what we must face, ad I’m really pleased to have the opportunity to set out our work to rise to this challenge.  Shielding our critical infrastructure against both physical and digital threats is our top priority. And let me put something very clearly up front in front of this House. It is more urgent than ever to adopt the revised Network Information Systems Directive, the so—called NIS2, together with our proposal for the renewed and modified Critical Entities Resilience Directive. These two proposals are two sides of the same coin. What is the point of putting all our efforts in protecting the networks of a nuclear power plant, if you can disrupt it by simply attacking its structures? I know that the negotiations on these two texts are progressing well, and I count on you to have them adopted as quickly as possible. They are needed now more than ever before.  I also take today’s opportunity to make a very solemn plea for the scope of these proposals, to stay at the level of ambition that we envisaged with our original proposal of the Commission. It would be greatly inconsistent if we take public administration out of the scope of these pieces of legislation, because public administration would need to have it to maintain high security standards. Shielding our Union against cyber—threats also requires shielding our Single Market. We need to make sure that the digital products in our Single Market are sufficiently resilient against cyber—threats. This is why President von der Leyen announced in this House a few months ago a new Cyber Resilience Act, which will be presented by the end of this year.  We have put a lot of efforts into building EU preparedness. This has even inspired our like—minded partners on the other side of the Atlantic to step up their own approach. But clearly the key question is will we, the European Union, be able to react in the event of a large—scale cyberattack? Let me share with you my conviction that, yes, we can.  In the past years, we have set up a number of tools and mechanisms to ensure effective coordination, both at technical and operational levels. The so—called cybersecurity ‘Blueprint’ sets out how to make the full use of existing cybersecurity entities to facilitate cooperation between Member States and the EU institutions in responding to such incidents and crisis.  We also have set up at technical level an EU network of National Computer Emergency Response Teams, the CSIRT network, which, together with our own institutional CERT—EU network, perform a central role in ensuring the sharing of technical information on network incidents in line with a blueprint. Early this year, this network was put in partial activation mode.  We also have the Cyber Crisis Liaison Organisation Network (CyCLONe), which brings together national cyber—agencies where the Commission participates as an observer. As I was telling you a few minutes ago, the proposals aiming and revising the NIS Directive and the Critical Entities Resilience Directive could be also essential to present the Commission as a full member of CyCLONe, in order to represent the overall EU interest.  What we now need is to continue building precisely on this culture of sharing information and expertise between Member States and across the cybersecurity constituencies, to bring together our best cybersecurity experts and response teams to work together and coordinate our action at operational level and, where necessary, help those that need it the most. And this is precisely the purpose that should serve the Joint Cyber Unit which, together with my colleague, Thierry Breton, we have announced should be operationalised as soon as possible. Any operation at EU level will also benefit from the additional firepower and brainpower that the expertise of our agencies bring. We are working closely with ENISA, which now has years of experience in threat identification, and with Europol’s EC3, which is also working closely to counter malicious activities on the ground.  This is a true example of breaking the silos between the different strands of security to capitalise on all the knowledge and expertise available across the services and across Europe. This is precisely what our concept of an EU security union means – one single roof for all security—related policy action to be aligned far beyond and across vertical fiefdoms and vertical constituencies.  Another element that is of relevance to this debate is, of course, the heightened hybrid threat that is linked to disinformation. We have been urging, together with our External Action Service colleagues, the main platform signatories of the Code of Practice, to implement swiftly the Ukrainian—related sanctions and take further action to address the spread of war propaganda, lies and harmful disinformation related to the war.  All online platforms swiftly moved to suspend the transmission of Russia Today and Sputnik in the EU and to delist them from search engines. There are encouraging signs that the platforms have strengthened their monitoring and intervention tools to deprioritise disinformation content, remove the accounts of known disinformation purveyors, increase cooperation with fact checkers, and cut disinformation websites from advertising revenues. We shall keep monitoring progress in all these areas, and we will continue to push for more actions in our regular meetings with all major platforms.  Honourable Members, let me conclude by saying that the invasion of Ukraine has shown us a new side of war. From now on, war takes place not only on the battlefield but also in our information space, whether disinformation or cyberattack. These incidents have real life consequences for individual businesses, critical infrastructure, our society at large, and our democracy. Malicious cyber—activities, whether driven by political or criminal motives, not only threaten our economies, but also our model of society – what we stand for, our way of life, our freedoms and our values.  So now is the moment for a genuine step change in our collective response to these common threats. I am sure that you share with us the sense of urgency for greater efficiency and responsiveness of our mechanisms.