Debate: A high common level of cybersecurity across the Union
Date: THURSDAY, 10 NOVEMBER 2022
Speaker: Bart Groothuis
Country: Portugal
Language: EN

And today, we are not just voting on that legislation that significantly enhances Europe’s cybersecurity – it makes it a safer place to work, do business and live. We are also introducing a new mindset in Europe, a new phase in our common European digital future. From pioneering to professionalisation, from cybersecurity as a niche subject to making it  Europe has suffered enormous costs of being attacked on an almost industrial scale, yet still we invest 41% less than our American businesses and the sharing of information in the cybersecurity community from which I stem, has been hampered. This legislation is reversing that. But meanwhile, because of the encouragement of the Kremlin, Russian hackers, criminal ransomware groups are trying to weaken economic wellbeing and economic structures. With the support of Beijing, many dozens of hacker groups try to steal our intellectual property and trade secrets to weaken our economies and strengthen theirs.  Many of this is not directly seen with the eye or is in the media that often. It often happens that companies do not wish to go public, but it happens every day and that’s why we ask critical infrastructure to invest. That’s why we make a sound legal basis for information-sharing between governments, businesses, experts and countries outside the EU.  And for those who think this is expensive, remember that the American credit rating agency Moody’s recently valued the NIS2 and said it’s credit-positive for doing business in Europe.  Although this is the best cybersecurity legislation this continent has yet seen, let us not congratulate ourselves too much. Here’s what still needs to be done. First, if ransomware is an instrument of, let’s say, foreign policy of the Kremlin, then technical controls like this legislation will not stop Russia. We have to indict the hackers, track them, make sure when they travel, they get incarcerated behind bars. We need diplomatic and counterintelligence offensives as well.  Secondly, yes, the NIS2 asks, demands that Member States put forward an active defence cyber posture. It means that, in practice, cybersecurity centres will have to cooperate with internet service providers to block malicious domains when people accidentally click on it, because it does happen.  Thirdly, supply chain security. Yes, within the NIS2 there is a good possibility for reviewing risky software and hardware vendors. But we need new legislation to protect us. When countries with an offensive intellectual property theft programme directed against us and their companies enter our markets, we need legislation.  Fourth, our sub-sea infrastructure. The NIS2 marks optic fibre cables below sea as vital infrastructure, but the plans to protect it are hardly sufficient yet. In the Defence and Subcommittee and Industry Committee, we will put forward new plans to do just that.  Last but not least, colleagues, let me also take this opportunity to say that the last European cybersecurity vendor – endpoint security antivirus – that we have is European, and let’s keep it that way, Commissioner. I would like to thank all the shadow rapporteurs present here for their constructive political work on this file. The staff – I will buy you a drink afterwards! But let me just mention the most important people that have to be mentioned today in this plenary room: the cybersecurity community to whom this work is dedicated. I came to Brussels to make cybersecurity legislation, to create a safe place to work and to do business. That safer place is mainly the result of the hard work of those many cybersecurity professionals out there. And to all you computer nerds out there: we hear, we see you, we are keeping you enabled to do your business. You keep us safe, we see you and we support you.  Now, let’s vote today on this important legislation and thanks for the good cooperation, everyone.