Debate: Recent cyberattacks on EU institutions and on sensitive national public and private institutions – The EU’s cybersecurity strategy for the Digital Decade
Date: WEDNESDAY, 9 JUNE 2021
Speaker: Johannes Hahn
Language: EN

As announced in the cybersecurity strategy of last December, the Commission will consider a comprehensive approach to address the growing importance of the internet of secure things, in coherence with Union law such as product safety. It could include new horizontal rules for all connected products and associated services placed on the internal market. In addition, the Network Code and the Initiative on the Protection of Critical Energy Infrastructure could address the residual physical and cyber risks affecting energy systems. The Commission, with the European Union Agency for Cybersecurity (ENISA), is working on such cybersecurity certification schemes, which could become mandatory for essential and important entities under the recent proposal for a network and information system, the so-called NIS 2. This certification scheme could also be instrumental in enhancing the strategic autonomy of our cybersecurity supply chain. Being a directive, NIS 2 only applies to Member States, but the EU institutions are also an important target and attacks are growing dramatically in both number and in sophistication. The COVID—19 pandemic and the shift to teleworking has only exacerbated the situation. The cyber maturity varies a lot amongst institutions, bodies and agencies, but since our systems are all interlinked, the weakest link poses a large risk to all of us.  We are therefore preparing a proposal for a regulation on cybersecurity for the EU institutions, bodies and agencies, which is expected for October this year. Here we will set out a common framework for cyber standards, a joint governance structure, and we will reinforce the mandate and financing of CERT-EU, the computer emergency response team of the Union institutions, bodies and agencies.  The strategic importance of the internet is yet another issue highlighted by the COVID—19 crisis. The Commission is fully committed to increasing the security and resilience of the open internet. It’s a task that cannot be handled by a single organisation alone. Our cybersecurity strategy sets out several key actions in this regard. We aim at reinforcing the security of internet critical infrastructure, in particular the global domain name system, the root server system. We will also be collaborating with ENISA, Member States, EU DNS root server operators and the multi—stakeholder community in preparing contingency plans for extreme scenarios that could affect the integrity and availability of the internet, without forgetting that the developed internet standards and good practices will be promoted in partner countries as well. We will consider the need for a mechanism for more systematic monitoring and gathering of aggregated data on internet traffic and for advising on potential disruptions, and join international partners to improve coordination to address and respond to intentional disrupting attempts. Furthermore, the secure connectivity flagship announced in the action plan on synergies between civil defence and space industries aims to provide a space—based backbone. This will ensure resilient and autonomous access for EU users in case something happens to ground—based connectivity infrastructures.  Finally, let me renew the Commission’s strong support for the multi—stakeholder model for internet governance. We will be promoting this model and we will oppose any attempt to establish top-down control of the global internet.