A Sting Exclusive: “Europe needs decisive progress for stronger cybersecurity”, EU Commissioner Gabriel highlights from Brussels

This cutting-edge article on Cybersecurity was exclusively written for The Sting by the European Commissioner for Digital Economy and Society, Ms Mariya Gabriel. The opinions expressed hereby belong to our distinguished writer.

Cybersecurity remains one of the biggest policy challenges in the digital area. It has become a cross-cutting issue that not only concerns the IT sector but virtually any part of our economy and society, including critical areas like energy, transport or financial services.

Cyber-attacks are constantly on the rise. In some EU Member States, it has been estimated that half of all criminal activity are cybercrimes. Some of these attacks have aimed at high-profile targets, including power grids, important webmail services, central banks, telecommunications companies and electoral commissions. The May 2017 “WannaCry” ransomware attack affected more than 230,000 computers in over 150 countries, impacting the operations of railways, health systems, telecoms operators and businesses across Europe.

So the need for action at the European level is there but how do we effectively respond to it? And what are the areas in which we need to take action?

First of all, we are not starting from scratch: with the Directive on Security of Network and Information Systems of 2016 we are building on the first EU-wide legislation for improved cybersecurity. Thanks to this new cybersecurity law, EU countries are already strengthening their cooperation in cybersecurity policy and are coordinating their efforts to build better response capacities. As the directive is an important step forward for increased cooperation, it is crucial that those Member States that have not yet done so now fully implement it without delay.

Indeed, working together is a key factor to reach critical mass for boosting cybersecurity in Europe. A safe and open cyberspace can only be achieved through enhanced cooperation, by joining forces, sharing expertise and experience. No country or organisation can successfully face the challenge of cyber threats alone. Only by working closely together can we ensure the necessary coordinated response to the increasing threats from state-sponsored and independent actors. To illustrate the scale of the risk: it has been estimated that a serious cyber-attack could cost the global economy more than $120bn – as much as catastrophic natural disasters such as the Hurricanes Katrina or Sandy.

To further strengthen the Union’s cybersecurity, the Commission has proposed a Cybersecurity Act. This proposal gives a strong and permanent mandate to the European Union Agency for Network and Information Security (ENISA). ENISA, located in Greece, is a centre of expertise for cybersecurity in Europe. The agency works closely with Member States and the private sector to deliver advice and solutions, thereby contributing to a high level of network and information security within the Union.

In addition to capacity building, we also need to improve our responsiveness in the case of EU-wide cyberattacks. The Commission has therefore recommended a blueprint for co-operation and coordinated response in the event of large-scale, cross-border cybersecurity incidents and to mainstream cyber concerns with existing crisis management mechanisms.

Furthermore, we need to exploit the growth potential of the cybersecurity market in the EU in terms of products, services and processes. This is currently held back in a number of ways, and in particular due to a lack of meaningful cybersecurity certification schemes recognised across the EU. Therefore a proposal to set up just such a certification framework is also on the table.

Finally, there is also a need for increased cooperation on cyber defence, including encouraging cooperation between civilian and military incident response communities. The EU has started cooperation with NATO and carried out joint and parallel exercises in September and October 2017 with a focus on cyber and hybrid threats to the EU and NATO. Similar exercises are already planned for November 2018.

Last but not least, we need to make appropriate investments in cybersecurity at the European level, in particular as regards research and innovation. That is why the next multi-annual budget of the European Union should contain a bigger role for cybersecurity and defence, with € 2 billion earmarked for this area in the Commission’s proposal for a Digital Europe Programme. We will also propose the creation of a network of cybersecurity centres of excellence with a European Cybersecurity Competence Centre at its heart to pool EU and Member State as well as private sector resources for coordinated investments in research, innovation and deployment actions in the area of cybersecurity.

There is now some crucial political progress on cybersecurity at EU level. Both the Council and the European Parliament recognise the basic principles of our Cybersecurity Act, especially the need to enhance the current role and tasks of ENISA, and to prevent fragmentation of the internal market by ensuring a common European approach to cybersecurity certification.

Negotiations between the European Parliament and the Council are expected to conclude under the Austrian EU presidency.

This swift political progress demonstrates how much we all prioritise cybersecurity at the European level. Given the growing cybersecurity risks that the European Union is facing, it is clear that we need the new framework in place as soon as possible.

With some of the vital components described above on the way, I am confident that we can make the progress that is essential to strengthen cybersecurity in Europe. However, as the digital world moves on, the challenge does not stop, and we need to make sure that cybersecurity remains firmly on the digital policy-making agenda.