Debate: Recent cyberattacks on EU institutions and on sensitive national public and private institutions – The EU’s cybersecurity strategy for the Digital Decade
Date: WEDNESDAY, 9 JUNE 2021
Speaker: Cristian-Silviu Buşoi
Country: Poland
Language: EN

Technological progress, new technologies and the internet of things potentially mean hundreds more devices going online and being interconnected in the near future, with cyber threats then having the ability to endanger on a greater scale and with a greater impact. Moreover, the COVID-19 crisis has again exposed the cyber vulnerabilities of some critical sectors, particularly healthcare. The associated measures of teleworking and social distancing have increased our dependency on digital technologies and connectivity, while cyberattacks and cybercrime – including espionage and sabotage, as well as malicious and unlawful ways of entering and manipulating ICT systems, structures and networks – are increasing in number and sophistication across Europe. To address these challenges we need resilience. We need to become less vulnerable to attack and, in the case of a threat or even an attack, we need a quick response mechanism. The EU looks more determined to fight these challenges. Securing network and information systems in the European Union is essential to keeping the online economy running, safeguarding the competitiveness of our industry, and ensuring privacy and prosperity for our citizens, securing their data privacy as well.  The European Union is working on a number of fronts to promote cyber resilience. We welcome the initiatives announced in the EU’s cybersecurity strategy for the digital decade, but also note the evolution in the nature and sophistication of cyber threats, the risk of fragmented regulation and opportunity to strengthen our industry. We would therefore call on the Commission to promote the development of secure and reliable network and information systems, infrastructure and connectivity across the Union with a framework laying down horizontal cybersecurity requirements that would also aim to harmonise national measures and avoid fragmentation of the single market.  Therefore, it is essential to further assess the need to propose measures at Union level introducing cybersecurity requirements for applications, software, embedded software and operating systems by 2023, building upon the EU acquis on risk management requirements.  Digitalisation should happen with cybersecurity embedded, and for this, we need to further invest in innovation as well. The new European Cybersecurity, Industrial Technology and Research Competence Centre, based in Bucharest, will aim to retain and develop the cybersecurity, technological and industrial capacities necessary to secure the Union digital single market and will be of paramount importance for creating an interconnected Europe-wide cybersecurity, industrial and research ecosystem. Therefore, the Centre needs to start its activity as soon as possible.  We would welcome on behalf of the Committee on Industry, Research and Energy (ITRE Committee) concrete answers from the Commission to the following questions: How and when does it intend to draw up a regulatory framework for ensuring that connected products and associated services, including supply chains, are secure by design, resilient to cyber incidents, and can be quickly patched up when vulnerabilities are discovered? Does the Commission plan to tackle the need to introduce cybersecurity requirements for applications, software, embedded software and operating systems? What concrete steps will the Commission take to strengthen the EU’s strategic autonomy in cybersecurity, namely by reducing its technological dependence and skills gap?  How is the Commission planning to ensure that EU funds are spent in a synergetic way to achieve these goals?  And finally, what actions will the Commission take in order to improve the cybersecurity of the core of the Internet while keeping it free, open and neutral?