National

The European Council announced last week a new framework to punish perpetrators of cyber crimes, in response to a growing number of politically motivated attacks against EU member states and institutions, non–EU countries and international organizations.

Why it matters: The EU has condemned malicious behavior in cyberspace before, but this is the first time it has instituted a policy to respond to malign behavior, an important milestone given the threats posed by hackers from Russia, China and elsewhere.

Background: Recent cyberattacks linked to Russian state actors have targeted the campaign emails of French President Emmanuel Macron, Germany’s parliament and government agencies, the Netherlands-based Organization for the Prevention of Chemical Weapons (which was investigating the attack on Sergei Skripal), and Estonia’s government, businesses and media outlets.

Chinese hackers recently attacked the EU’s communication network, while North Korean and Iranian hackers have targeted businesses and governments across Europe.

Between the lines: The policy would impose visa bans and asset freezes on state and non-state actors who use cyber tools to cripple information networks. It would likely allow the EU to match U.S. sanctions on cyberattack perpetrators in cases of shared foreign policy and security interests.

Yes, but: While the new framework is robust, some EU member states, notably France, have often been reluctant to publicly attribute cyberattacks to a specific actor, preferring instead to communicate with alleged offenders through diplomatic channels. In their view, perpetrators often cover their trails, making it difficult to gather evidence tying an attack to a particular attacker.

 For the new framework to prove effective, EU policymakers will need to act decisively to publicly expose offending actors.

The bottom line: This more muscular stance by Brussels sends a stronger deterrence signal to authoritarian regimes targeting democratic institutions.

David Salvo is deputy director of the Alliance for Securing Democracy at the German Marshall Fund.

EU aims to deter cyberattacks with stricter penalties

New policies would impose visa bans, asset freezes and other measures.

European Council building with European flags displayed

The European Council in Brussels, Belgium. Photo: Emmanuel Dunand/AFP/Getty Images

World

Cyber crime

Expert Voices

Technology

The European Council announced last week a <a class="gtmContentClick" data-vars-link-text="new framework" data-vars-click-url="https://www.reuters.com/article/us-eu-cyber/days-before-elections-eu-approves-new-cyber-sanctions-regime-idUSKCN1SN1FQ" data-vars-content-id="17032d2b-8599-4edc-9f96-4c6a488e425a" data-vars-headline="EU aims to deter cyberattacks with stricter penalties" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://www.reuters.com/article/us-eu-cyber/days-before-elections-eu-approves-new-cyber-sanctions-regime-idUSKCN1SN1FQ" target="_blank">new framework</a> to punish perpetrators of cyber crimes, in response to a growing number of politically motivated attacks against EU member states and institutions, non–EU countries and international organizations.Why it matters: The EU has condemned malicious behavior in cyberspace before, but this is the first time it has instituted a policy to respond to malign behavior, an important milestone given the threats posed by hackers from Russia, China and elsewhere.

China is becoming the most formidable rival America has faced, and the risk of confrontation with Russia, North Korea or Iran still looms. Authoritarians are rising, the chaotic Afghanistan exit revealed the limits of U.S. power, and the pandemic, climate change and other critical challenges continue to pose grave threats.

David Salvo

Stories

EU aims to deter cyberattacks with stricter penalties