Debate: State of EU cyber defence capabilities
Date: TUESDAY, 5 OCTOBER 2021
Speaker: Urmas Paet
Country: Italy
Language: EN

But we might have bigger scares, see bigger damage and even human losses if a state or non-state actor decides to attack our critical infrastructure, like hospitals, energy or transport, or to meddle in elections. The recent Pegasus spyware scandal has shown the vulnerability of journalists, human rights activists, elected representatives and other citizens that were massively spied on.  More connectivity means more vulnerabilities. In recent years, the EU has seen a continuous growth in cyber operations conducted by state and non-state actors against the EU and its Member States, revealing vulnerabilities in networks essential to European security.  These days, every conflict has a cyber-element to it. It is important for the EU and its Member States to strengthen cyber-resilience and develop common cybersecurity and defence capabilities, in order to respond to such security challenges.  President von der Leyen said in her State of the Union address that, given that resources were scarce, we had to bundle our forces. We should not just settle for addressing the cyberthreat, but should also strive to become a leader in cybersecurity. If the EU wants to be seen at the forefront of digital ambitions, it must increase its technological sovereignty and innovation, and be ready to raise the level of its cybersecurity.  A common cyber-defence policy and increased cooperation at EU level to develop common and improved cyber-defence capabilities are essential elements in building a stronger European Defence Union. The borderless nature of cyberspace – as well as the substantial number and increasing complexity of cyberattacks – requires a coordinated Union-level response, including common Member State support capabilities and Member State support for measures in the EU cyber-diplomacy toolbox, as well as intensified EU—NATO cooperation, based on information-sharing between cyber-crisis response teams, the exchange of best practices, enhanced training, research and exercises. The European External Action Service and the Commission, in cooperation with the Member States, need to develop a comprehensive set of measures and a coherent policy on cybersecurity, in order to enhance resilience and coordination on cyber-defence. It is essential for the Member States to significantly increase classified information-sharing capacities in order to facilitate information-sharing where needed and useful, and to develop a rapid and secure European network to detect, assess and counter cyberattacks.  The EU has taken many measures to raise the level of its cybersecurity and cyber-defence capabilities. It has adopted and applied a legal framework for targeted restrictive measures against cyberattacks, and EU-NATO cooperation has increased in the cyber-defence field too. But even more coordinated Union level action is needed.  The review of the Cyber Defence Policy Framework should strive to enhance coordination between EU actors and also between and with Member States. PESCO offers excellent ways to speed up cybersecurity initiatives and should be used to that end. The strategic compass should be used to deepen the strategic culture in the cyber domain and help to overcome the current fragmentation and complexity of the overall cyber architecture within the EU and remove any duplication of capabilities and mandates.  Fragmentation carries serious issues with resources that need to be addressed. The establishment of a joint cyber unit is needed to increase cooperation and information—sharing between EU institutions and enable the full use of existing structures, resources and capabilities.  Increased funding is needed for the CERT-EU and the EU Intelligence and Situation Centre, and to support Member States in establishing and strengthening security operation centres in order to build a network of these centres across the EU. It is also important to improve citizens’ skills and raise public awareness on cyberattacks and how individuals can defend themselves against these attacks.  More operational assistance is needed between Member States. Trust also needs to be built, as this is still one of the big obstacles. Common exercises and scenario-based policy discussions on crisis management are important in this regard. We are witnessing increasingly aggressive behaviour from Russia, China and North Korea in cyberspace, and it is clear that in order to be successful in overcoming threats to Euro-Atlantic security interests, increased coordination with NATO is needed. For this, coordinated exercises and joint training are indispensable. We need to look for possible complementarities with NATO to avoid duplication and acknowledge that respective responsibilities and coordinated exercises and joint trainings are indispensable.  Functioning deterrence can be achieved when the adversaries have a better awareness of the possible countermeasures. Increased cooperation with NATO allies, like-minded countries, United Nations and the OSCE is also needed. Member States and the EU should also be at the forefront of discussions under the United Nations to help promote responsible state behaviour in cyberspace.  Finally, I would like to thank all my colleagues and staff that have helped to draft this report. I wish you all a good debate and hope that you can support this report.