2018年-CEPS欧洲政策研究中心_Strengthening_the_EUs_Cyber_Defence_Capabilities_88页_2mb

Summary of Strengthening the EU's Cyber Defence Capabilities

Core Content

This report by the CEPS Task Force outlines the need for the European Union (EU) to strengthen its cyber defence capabilities in response to an increasingly complex and threatening digital environment. It presents a comprehensive analysis of the evolving cyber threat landscape, the current state of EU cyber defence, and three potential scenarios for improvement. The report concludes that the establishment of an EU Cyber Defence Agency is the most effective solution to enhance the EU's strategic and operational cyber defence posture.

Main Views and Key Information

1. The Evolving Cyber Threat Landscape

• Threats are growing and diversifying: The digital threat landscape is expanding in scope and severity, with the EU and its member states facing both technological and strategic challenges.
• Technological trends:
  • The attack surface in cyberspace is increasing due to the proliferation of IoT devices and the complexity of interconnected systems.
  • Reported vulnerabilities are rising, especially in Industrial Control Systems (ICS), with a 29% increase in ICS-related reports in 2017.
• Strategic trends:
  • Militarisation of cyberspace is on the rise, with states using offensive cyber capabilities for geopolitical purposes.
  • Cyberattacks are increasingly targeting civilians, including through manipulation of public opinion via "deep fakes" and attacks on critical infrastructure.

2. Current EU Cyber Defence Posture

• The EU currently plays a largely advisory role, with member states responsible for strategic and operational cyber defence.
• Fragmentation and lack of coordination are significant issues, as capabilities are spread across various institutions, agencies, and initiatives.
• Limited resources in terms of funding and personnel hinder the EU's ability to respond effectively to cyber threats.
• Norms to constrain state behavior in cyberspace have not been sufficient to prevent attacks.

3. The Case for EU-wide Coordination

• Coordination is essential due to the nature of cyberspace as a globalised network.
• The EU needs a more proactive approach to address cyber threats, rather than just reactive measures.
• The report argues that a Cyber Defence Agency would be a crucial step towards overcoming the current limitations, such as fragmentation and lack of executive power.

4. Three Scenarios for Strengthening Cyber Defence

• Scenario I - The Base Case: Implementation of the 2017 Cyber Security Package and the Cyber Defence Policy Framework.
• Scenario II - Cyber Defence Coordinator: Establishing a coordinator role similar to the EU Counter-Terrorism Coordinator to improve coordination.
• Scenario III - Cyber Defence Agency: Creating a fully-fledged agency with executive competencies, which would be responsible for:
  • Detection capabilities
  • Technical attribution capabilities
  • Crisis response capabilities
  • Policy advice and coordination across EU institutions and member states

5. Recommendation

• The report recommends the creation of a Cyber Defence Agency as the most viable path forward.
• This agency would be independent and have executive authority, enabling it to develop and implement strategic and operational cyber defence capabilities.
• It would complement but not replace the role of member states, which retain primary responsibility for national cyber defence.
• The Agency would be responsible for coordinating across institutions, monitoring policy implementation, and ensuring a cohesive readiness picture for the EU in the cyber domain.

Key Operational Capabilities

• Detection capabilities: To identify and monitor cyber threats in real-time.
• Attribution capabilities: To determine the source of cyberattacks, which is essential for effective response.
• Crisis response capabilities: To manage and mitigate the impact of cyber incidents, especially those affecting critical infrastructure or EU institutions.

Phases for Implementation

1. Stage One: Implement the 2017 Cyber Security Package and Cyber Defence Policy Framework.
2. Stage Two: Create a Cyber Defence Coordinator in coordination with ENISA, the Council, and the Commission.
3. Stage Three: Develop a technical attribution forum through collaboration with industry.
4. Stage Four: Investigate and draft the mandate and governance model for a Cyber Defence Agency.
5. Stage Five: Establish the Cyber Defence Agency, integrating coordination, advisory, and executive functions.

Conclusion

• The EU must act now to strengthen its cyber defence capabilities to protect its citizens, institutions, and member states.
• A Cyber Defence Agency is the most effective solution, as it addresses both institutional fragmentation and operational limitations.
• The EU should also promote cyber norms through declaratory principles or a legal framework to foster long-term global cooperation and security in cyberspace.

Key Takeaways

• The threat landscape is evolving rapidly, with increasing vulnerabilities and the militarisation of cyberspace.
• The current EU approach is fragmented and lacks executive power.
• A Cyber Defence Agency is proposed as the most effective solution to enhance EU cyber resilience.
• The report highlights the urgency of action and the need for a balanced approach between civilian protection and the prevention of further militarisation of cyberspace.