Today (16 December) the Commission and the High Representative of the Union for Foreign Affairs and Security Policy are presenting a new EU Cybersecurity Strategy. As a key component of Shaping Europe's Digital Future, the Recovery Plan for Europe and the EU Security Union Strategy, the Strategy will bolster Europe's collective resilience against cyber threats and help to ensure that all citizens and businesses can fully benefit from trustworthy and reliable services and digital tools. Whether it is the connected devices, the electricity grid, or the banks, planes, public administrations and hospitals Europeans use or frequent, they deserve to do so with the assurance that they will be shielded from cyber threats.
The new Cybersecurity Strategy also allows the EU to step up leadership on international norms and standards in cyberspace, and to strengthen cooperation with partners around the world to promote a global, open, stable and secure cyberspace, grounded in the rule of law, human rights, fundamental freedoms and democratic values. Furthermore, the Commission is making proposals to address both cyber and physical resilience of critical entities and networks: a Directive on measures for high common level of cybersecurity across the Union (revised NIS Directive or ‘NIS 2'), and a new Directive on the resilience of critical entities.
They cover a wide range of sectors and aim to address current and future online and offline risks, from cyberattacks to crime or natural disasters, in a coherent and complementary way. Trust and security at the heart of the EU Digital Decade The new Cybersecurity Strategy aims to safeguard a global and open Internet, while at the same time offering safeguards, not only to ensure security but also to protect European values and the fundamental rights of everyone.
Building upon the achievements of the past months and years, it contains concrete proposals for regulatory, investment and policy initiatives, in three areas of EU action: 1. Resilience, technological sovereignty and leadership
Under this strand of action the Commission proposes to reform the rules on the security of network and information systems, under a Directive on measures for high common level of cybersecurity across the Union (revised NIS Directive or ‘NIS 2'), in order to increase the level of cyber resilience of critical public and private sectors: hospitals, energy grids, railways, but also data centres, public administrations, research labs and manufacturing of critical medical devices and medicines, as well as other critical infrastructure and services, must remain impermeable, in an increasingly fastmoving and complex threat environment. The Commission also proposes to launch a network of Security Operations Centres across the EU, powered by artificial intelligence (AI), which will constitute a real ‘cybersecurity shield' for the EU, able to detect signs of a cyberattack early enough and to enable proactive action, before damage occurs. Additional measures will include dedicated support to small and medium-sized businesses (SMEs), under the Digital Innovation Hubs, as well as increased efforts to upskill the workforce, attract and retain the best cybersecurity talent and invest in research and innovation that is open, competitive and based on excellence.
2. Building operational capacity to prevent, deter and respond
The Commission is preparing, through a progressive and inclusive process with the member states, a new Joint Cyber Unit, to strengthen cooperation between EU bodies and member state authorities responsible for preventing, deterring and responding to cyber-attacks, including civilian, law enforcement, diplomatic and cyber defence communities. The High Representative puts forward proposals to strengthen the EU Cyber Diplomacy Toolbox to prevent, discourage, deter and respond effectively against malicious cyber activities, notably those affecting our critical infrastructure, supply chains, democratic institutions and processes. The EU will also aim to further enhance cyber defence cooperation and develop state-of-the-art cyber defence capabilities, building on the work of the European Defence Agency and encouraging Mmmber states to make full use of the Permanent Structured Cooperation and the European Defence Fund.
3. Advancing a global and open cyberspace through increased co-operation
The EU will step up work with international partners to strengthen the rules-based global order, promote international security and stability in cyberspace, and protect human rights and fundamental freedoms online. It will advance international norms and standards that reflect these EU core values, by working with its international partners in the United Nations and other relevant fora. The EU will further strengthen its EU Cyber Diplomacy Toolbox, and increase cyber capacity-building efforts to third countries by developing an EU External Cyber Capacity Building Agenda. Cyber dialogues with third countries, regional and international organizations as well as the multistakeholder community will be intensified.
The EU will also form an EU Cyber Diplomacy Network around the world to promote its vision of cyberspace. The EU is committed to supporting the new Cybersecurity Strategy with an unprecedented level of investment in the EU's digital transition over the next seven years, through the next long-term EU budget, notably the Digital Europe Programme and Horizon Europe, as well as the Recovery Plan for Europe. Member States are thus encouraged to make full use of the EU Recovery and Resilience Facility to boost cybersecurity and match EU-level investment.
The objective is to reach up to €4.5 billion of combined investment from the EU, the member states and the industry, notably under the Cybersecurity Competence Centre and Network of Coordination Centres, and to ensure that a major portion gets to SMEs. The Commission also aims at reinforcing the EU's industrial and technological capacities in cybersecurity, including through projects supported jointly by EU and national budgets. The EU has the unique opportunity to pool its assets to enhance its strategic autonomy and propel its leadership in cybersecurity across the digital supply chain (including data and cloud, next generation processor technologies, ultra-secure connectivity and 6G networks), in line with its values and priorities.
Cyber and physical resilience of network, information systems and critical entities Existing EU-level measures aimed at protecting key services and infrastructures from both cyber and physical risks need to be updated. Cybersecurity risks continue to evolve with growing digitalisation and interconnectedness. Physical risks have also become more complex since the adoption of the 2008 EU rules on critical infrastructure, which currently only cover the energy and transport sectors. The revisions aim at updating the rules following the logic of the EU's Security Union strategy, overcoming the false dichotomy between online and offline and breaking down the silo approach.
To respond to the growing threats due to digitalisation and interconnectedness, the proposed Directive on measures for high common level of cybersecurity across the Union (revised NIS Directive or ‘NIS 2') will cover medium and large entities from more sectors based on their criticality for the economy and society. NIS 2 strengthens security requirements imposed on the companies, addresses security of supply chains and supplier relationships, streamlines reporting obligations, introduces more stringent supervisory measures for national authorities, stricter enforcement requirements and aims at harmonising sanctions regimes across Member States. The NIS 2 proposal will help increase information sharing and cooperation on cyber crisis management at national and EU level. The proposed Critical Entities Resilience (CER) Directive expands both the scope and depth of the 2008 European Critical Infrastructure directive. Ten sectors are now covered: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, public administration and space. Under the proposed directive, member states would each adopt a national strategy for ensuring the resilience of critical entities and carry out regular risk assessments. These assessments would also help identify a smaller subset of critical entities that would be subject to obligations intended to enhance their resilience in the face of non-cyber risks, including entitylevel risk assessments, taking technical and organisational measures, and incident notification.
The Commission, in turn, would provide complementary support to member states and critical entities, for instance by developing a Union-level overview of cross-border and cross-sectoral risks, best practice, methodologies, cross-border training activities and exercises to test the resilience of critical entities. Securing the next generation of networks: 5G and beyond Under the new Cybersecurity Strategy, member states, with the support of the Commission and ENISA - the European Cybersecurity Agency, are encouraged to complete the implementation of the EU 5G Toolbox, a comprehensive and objective risk-based approach for the security of 5G and future generations of networks.
According to a report published today, on the impact of the Commission Recommendation on the Cybersecurity of 5G networks and the progress in implementing the EU toolbox of mitigating measures, since the progress report of July 2020, most Member States are already well on track of implementing the recommended measures. They should now aim to complete their implementation by the second quarter of 2021 and ensure that identified risks are adequately mitigated, in a coordinated way, particularly with a view to minimising the exposure to high-risk suppliers and avoiding dependency on these suppliers. The Commission also sets out today key objectives and actions aimed at continuing the coordinated work at EU-level.
A Europe Fit for the Digital Age Executive Vice President Margrethe Vestager said: "Europe is committed to the digital transformation of our society and economy. So we need to support it with unprecedented levels of investment. The digital transformation is accelerating, but can only succeed if people and businesses can trust that the connected products and services - on which they rely – are secure."
High Representative Josep Borrell said: "International security and stability depends more than ever on a global, open, stable and secure cyberspace where the rule of law, human rights, freedoms and democracy are respected. With today's strategy the EU is stepping up to protect its governments, citizens and businesses from global cyber threats, and to provide leadership in cyberspace, making sure everybody can reap the benefits of the Internet and the use of technologies."
Promoting our European Way of Life Vice President Margaritis Schinas said: "Cybersecurity is a central part of the Security Union. There is no longer a distinction between online and offline threats. Digital and physical are now inextricably intertwined. Today's set of measures show that the EU is ready to use all of its resources and expertise to prepare for and respond to physical and cyber threats with the same level of determination."
Internal Market Commissioner Thierry Breton said: "Cyber threats evolve fast, they are increasingly complex and adaptable. To make sure our citizens and infrastructures are protected, we need to think several steps ahead, Europe's resilient and autonomous Cybersecurity Shield will mean we can utilise our expertise and knowledge to detect and react faster, limit potential damages and increase our resilience. Investing in cybersecurity means investing in the healthy future of our online environments and in our strategic autonomy."
Home Affairs Commissioner Ylva Johansson said: "Our hospitals, waste water systems or transport infrastructure are only as strong as their weakest links; disruptions in one part of the Union risk affecting the provision of essential services elsewhere. To ensure the smooth functioning of the internal market and the livelihoods of those living in Europe, our key infrastructure must be resilient against risks such as natural disasters, terrorist attacks, accidents and pandemics like the one we are experiencing today. My proposal on critical infrastructure does just that."
The European Commission and the High Representative are committed to implementing the new Cybersecurity Strategy in the coming months. They will regularly report on the progress made and keep the European Parliament, the Council of the European Union, and stakeholders fully informed and engaged in all relevant actions. It is now for the European Parliament and the Council to examine and adopt the proposed NIS 2 Directive and the Critical Entities Resilience Directive. Once the proposals are agreed and consequently adopted, member states would then have to transpose them within 18 months of their entry into force.
The Commission will periodically review the NIS 2 Directive and the Critical Entities Resilience Directive and report on their functioning. Background Cybersecurity is one of the Commission's top priorities and a cornerstone of the digital and connected Europe. An increase of cyber-attacks during the coronavirus crisis have shown how important it is to protect hospitals, research centres and other infrastructure. Strong action in the area is needed to future-proof the EU's economy and society. The new Cybersecurity Strategy proposes to integrate cybersecurity into every element of the supply chain and bring further together EU's activities and resources across the four communities of cybersecurity – internal market, law enforcement, diplomacy and defence.
It builds on the EU' Shaping Europe's Digital Future and the EU Security Union Strategy, and leans on a number of legislative acts, actions and initiatives the EU has implemented to strengthen cybersecurity capacities and ensure a more cyber-resilient Europe. This includes the Cybersecurity strategy of 2013, reviewed in 2017, and the Commission's European Agenda on Security 2015-2020. It also recognises the increasing inter-connection between internal and external security, in particular through the Common Foreign and Security Policy. The first EU-wide law on cybersecurity, the NIS Directive, that came into force in 2016 helped to achieve a common high level of security of network and information systems across the EU. As part of its key policy objective to make Europe fit for the digital age, the Commission announced the revision of the NIS Directive in February this year.
The EU Cybersecurity Act that is in force since 2019 equipped Europe with a framework of cybersecurity certification of products, services and processes and reinforced the mandate of the EU Agency for Cybersecurity (ENISA). As regards Cybersecurity of 5G networks, Member States, with the support of the Commission and ENISA have established, with the EU 5G Toolbox adopted in January 2020, a comprehensive and objective risk-based approach. The Commission review of its Recommendation of March 2019 on the cybersecurity of 5G networks found that most member states have made progress in implementing the Toolbox. Starting from the 2013 EU Cybersecurity strategy, the EU has developed a coherent and holistic international cyber policy.
Working with its partners at bilateral, regional and international level, the EU has promoted a global, open, stable and secure cyberspace guided by EU's core values and grounded in the rule of law. The EU has supported third countries in increasing their cyber resilience and ability to tackle cybercrime, and has used its 2017 EU cyber diplomacy toolbox to further contribute to international security and stability in cyberspace, including by applying for the first time its 2019 cyber sanctions regime and listing 8 individuals and 4 entities and bodies. The EU has made significant progress also on cyber defence cooperation, including as regards cyber defence capabilities, notably in the framework of its Cyber Defence Policy Framework (CDPF), as well as in the context of the Permanent Structured Cooperation (PESCO) and the work of the European Defence Agency. Cybersecurity is a priority also reflected in the EU's next long-term budget (2021-2027).
Under the Digital Europe Programme the EU will support cybersecurity research, innovation and infrastructure, cyber defence, and the EU's cybersecurity industry. In addition, in its response to the Coronavirus crisis, which saw increased cyberattacks during the lockdown, additional investments in cybersecurity are ensured under the Recovery Plan for Europe. The EU has long recognized the need to ensure the resilience of critical infrastructures providing services which are essential for the smooth running of the internal market and the lives and livelihoods of European citizens. For this reason, the EU established the European Programme for Critical Infrastructure Protection (EPCIP) in 2006 and adopted the European Critical Infrastructure (ECI) Directive in 2008, which applies to the energy and transport sectors. These measures were complemented in later years by various sectoral and cross-sectoral measures on specific aspects such as climate proofing, civil protection, or foreign direct investment.
EU to step up digital push with digital identity wallet
The European Commission will today (3 June) announce plans for a digital identity wallet to allow Europeans to access public and private services, prompted in part by the COVID-19 pandemic which has seen a massive surge in online services, writes Foo Yun Chee.
The move also seeks to counter the growing popularity of digital wallets offered by Apple (AAPL.O), Alphabet (GOOGL.O) unit Google, Thales (TCFP.PA) and financial institutions which critics say could pose privacy and data protection concerns.
The digital identity wallet "can be used anywhere in the EU to identify and authenticate for access to services in the public and private sectors, allowing citizens to control what data is communicated and how it is used", according to a Commission document reviewed by Reuters.
The wallet will also enable qualified electronic signatures that can facilitate political participation, the 73-page document said.
The adoption of an electronic wallet could generate as much as 9.6 billion euros ($11.7 billion) in benefits for the EU and create as many as 27,000 jobs over a five-year period, the document said.
By reducing emissions related to public services, the e-wallet could also have a positive environmental impact, the document said.
Currently 14 EU countries have their own digital identity schemes, of which only seven are mobile apps.
($1 = €0.8189)
Digital Assembly 2021: Leading Europe's Digital Decade
On 1 and 2 June 2021, the European Commission and the Portuguese Presidency of the Council of the European Union will host the Digital Assembly, which this year will be dedicated to Europe's Digital Decade. This high-level event will focus on the EU targets for 2030 for the Digital Decade and on the Digital Europe Programme, a new €7.5 billion funding programme for the deployment of European digital projects. The event will bring together ministers from several member states, representatives of the European Parliament and the Commission, as well as representatives of the private sector and the civil society. They will discuss ways to promote European leadership across the areas and the 2030 targets outlined in the Commission's Digital Decade Communication, including on digital skills, digital transformation of businesses, high-speed connectivity and secure and sustainable digital infrastructure, as well as digitisation of public services.
The discussions will also focus on how European values and rights can best be promoted and protected in the digital world. On the first day of the Digital Assembly, the President of the European Commission, Ursula von der Leyen, will present the preparations for a joint inter-institutional Declaration of digital rights and principles for the Digital Decade. The Prime Minister of Portugal, António Costa, will present the Lisbon Declaration, which will contribute to these preparations. The upcoming Declaration of digital rights and principles for the Digital Decade will include commitments such as ensuring access to high-quality connectivity across Europe, promoting digital skills to all citizens, and building a fair online world without discriminations. More information is available in this joint press release by the European Commission and the Portuguese Presidency of the Council of the European Union.
Digital transformation could turbocharge CEE economies
With some of the fastest average internet speeds in the EU, there are several nations in Central Eastern Europe (CEE) who stand to benefit from expansion of their connectivity infrastructures and enhanced digitalization of their business sectors. In Romania, for example, a recent survey in which PwC polled a number of executives revealed that Romanian companies have sharply ratcheted up their digitalization over the past year. More than 40% of the executives polled estimated that they were two or three years ahead of schedule in terms of digitalization—a trend which would only be accelerated further by removing regulatory barriers to digitalization and offering targeted support to SMEs, writes Colin Stevens.
In Hungary, meanwhile, average broadband connections are in the top 10 worldwide – but availability in more remote areas is less developed. Given that small- to medium-sized enterprises (SMEs) comprise 99% of all business across Europe, and that SMEs often operate outside of large urban metropoles, addressing connectivity deficits is a key step in driving CEE economies forward as they seek to extricate themselves from the lengthy and deleterious downturn engendered by the Covid-19 pandemic.
Bucharest looking to boost digital performance
Romania accelerated its push towards a deep-seated digital transformation last year with the creation of the Authority for Digitalization of Romania (ADR), with the goal to set up digital tools for public and private institutions in order to drive digitalization forward. Regulatory obstacles are apparently the second biggest barrier to the digitalization of Romanian SMEs, so it’s hoped that the ADR will be able to help address such issues effectively.
The other main difficulty for SMEs in Romania to overcome is a lack of financial resources. Given that studies have shown that digitalization produces an average increase in revenue of 25% and reduces costs by 22% in SMEs, getting over the first hurdle appears to the biggest challenge facing the sector. With EU member states able to access 13% of the funds allocated to them in the Next Generation recovery instrument this year, Bucharest would do well to use that money to support SMEs in the country, since the long-term benefits of doing so could be huge. Indeed, a recent report from Deloitte found that digitalization of European services and supply chains could boost Romanian productivity by 16.7% and GDP by 16.5%.
Hungarian potential hampered by practicalities
As for Romania’s neighbor to the west, Hungary’s average internet speed of 99Mbps is the fastest in the CEE region, outstripping all of the Big 5 economies in Europe by some distance. However, the country’s overall digital performance could be improved; it is ranked 21 out of 28 EU member states in the Digital Economy and Society Index (DESI) for 2020, with connectivity the only metric in which it outperforms the European average. That deficit is costing the country a potential €9 billion per year, according to a study by McKinsey.
Commerce is one of the key areas which must be addressed by the Hungarian government if it is to access those untapped resources. The fact that 62% of Hungarian SMEs (and 82.3% of all businesses) regard Industry 4.0 as a priority in the years ahead is encouraging, but that positivity is immediately offset by the pitifully low percentage of them (8.5% of SMEs and 18.6% of all businesses) which actually have a viable plan in place. Managing this transition and providing the resources and expertise which business owners need to upgrade their operational models will be key to unlocking that lucrative potential and the raft of other benefits that digitalization brings.
UK offers educational case study
Regional CEE governments on the lookout for inspiration could do worse than to examine the Broadband Connection Voucher Scheme that was implemented in the UK between 2014 and 2016. Covering 50 cities across the country, the initiative allowed 42,500 SMEs to improve their connectivity speeds by an average of 18 times their previous velocity. That resulted in an average profit of £1,300 each year per company, with an overall return on the government’s investment of £8 for every £1 spent. The fact that only 17% of the funding went to the three biggest providers was also instrumental in encouraging competition and consumer choice in the sector.
For its part, the EU is introducing a similar €200 million scheme in Italy, though at the moment it is reserved exclusively for use by low-income families and students. While the initiative could play a vital role in allowing the bloc to achieve its goal of connecting 50% or more of European households to broadband networks with a speed of 100Mbps or higher, the latent potential of the policy is far greater. Were the EU to open it up to businesses as well, that would signify a true leveraging of the digital single market and a statement that member state economies and businesses are amply supported by Brussels.
CEE countries must act now to leverage EU aid
The rewards of doing so could be incredible for all involved. In fiscal terms, one report found that new digital technologies could deliver cumulative GDP benefits of €2.2 trillion across the bloc by 2030. The environment could also benefit, with improved fuel consumption (facilitated by the Internet of Things technology) saving up to 4.8 tonnes of carbon emissions annually, while public health would prosper thanks to the 165,000 deaths that could be prevented each year by a full rollout of eHealth services.
Therefore, it makes prudent sense for the EU and individual CEE governments to put their heads together and settle upon a course for utilizing the former’s funds and the latter’s policies to equip their business communities with the tools they need to excel. The internet speeds in Hungary, Romania and other CEE countries are already brisk enough to facilitate their success; all that’s required now is a similarly clipped pace in accelerating the digital transformation across the board.
Bulgaria3 days ago
The caretaker government in Bulgaria attacks public service television in an attempt to silence the opposition
UK3 days ago
Biden has a Brexit warning for Britain: Don't imperil Northern Irish peace
Human Rights3 days ago
New Decree on Human Rights in Kazakhstan.
COVID-194 days ago
Mainstream media risks becoming a threat to public health
EU4 days ago
Parliament votes to take Commission to court over inaction on breaches of the rule of law
coronavirus4 days ago
EU Digital COVID Certificate: It’s now up to EU countries
Corporate tax rules4 days ago
Big countries' tax deal to reveal rift in Europe
China3 days ago
Video killed the PLA Star: Cartoons and popstars last resort to attract “Baby” soldiers