By now, the EU as well as other players have launched several cyber capacity building projects and a lot of good work on building partner countries’ cyber capacity is done around the world. Yet, as no country can be ‘cyber ready’, a new initiative funded by European Commission’s DG DEVCo was launched in September 2019 – the EU Cybernet. This article will explore what makes this new project unique and how it could support and complement the EU’s ongoing efforts in cyber capacity building.
European Cybersecurity and Capacity Building
The past dozen years have seen an unprecedented increase in the global connectivity offered by the Internet, providing for real-time interaction in all areas and in almost all societies, thus encouraging countries to pay more attention to enhancing their national cyber security capacity. Despite already celebrating its 50th anniversary last year, the Internet serves the global community with increasing vigor – and thereby increasing the need for building global cyber capacity. At the time of writing this article, end of January 2020, we have another important anniversary. It has now been 7 years since the EU adopted its first strategy for dealing with cyber- space. One of the outcomes of the January 2013 “EU Cybersecurity Strategy: An Open, Safe and Secure Cyberspace” is that it urged the European Commission to recognize the need to develop cybersecurity capacity building initiatives. At that time, their focus was on police and judicial cooperation in third countries and to advance coordination of relevant stakeholders in order to avoid the duplication of efforts. What we can observe now is that it also launched a series of developments in the cyber security of the EU as well as the development cooperation communities.
Combining the two perspectives, the 2013 EU Cybersecurity Strategy was followed by the adoption of the European Agen- da on Security in 2015 and the New European Consensus on Development in the spring of 2017. In the fall of 2017, during the Estonian EU Presidency, the Council of the EU took the strategy forward in its Conclusions on the Joint Communication “Resilience, Deterrence and Defense: Building strong cybersecurity for the EU” where it called for the EU and its Member States to promote cyber capacity building in third countries by setting up an EU Cyber Capacity Building Network. To close this circle of conceptual developments and after 5 years of conceiving the original idea, the Council concluded an agreement on the “EU External Cyber Capacity Building Guidelines” in 2018. The time was ripe for the joint practical implementation of these interlinking ideas and strategies.
The EU Cybernet
The EU Cyber Capacity Building Network, or EU CyberNet (or project number IFS/2019/405-538) started in September 2019, for a planned duration of four years. Fortunately, after six years since the idea was first described in the EU Cybersecurity Strategy, it did not enter an empty playground. Over the course of time, both the EU and the other players such as notably the GFCE, had already launched several capacity building projects. To name a few prominent ones such as GLACY, GLACY+, CyberSouth and Cyber4Development, they focus specifically on developing areas such as cybersecurity policies, institutional setups, fight against cybercrime, and public diplomacy in countries outside of the EU. Many countries and hundreds of people around the world have already benefitted from the good work by these projects by way of education, training and network- ing. A pragmatic reader may thus ask the question, what makes EU CyberNet unique or special amongst them? What is its particular benefit?
The strategic cyber challenge for both the EU as well as the individual Member States
is that with the constant development of technology and the need for new skills, no individual, country or organization can ever be ‘cyber ready’. While more than half of the world’s population is online, this ‘race’ against moving targets will forever be hard to win. There are, however, clear rewards on sight for at the minimum trying to stay in the game – for instance, the World Bank estimates that a 10% increase in access to the internet leads to a 1.3% increase in GDP. Ensuring the safety of cyberspace for em- bracing the internet should there- fore be seen by states as one of the preconditions for increasing welfare of their citizens and societies. This in turn requires investment into both technical capabilities as well as people and their capacity in cyber security.
The linkage between individual’s cyber security skills and the cyber security of a nation is undeniable. According to factsheets by the EU Cyber Direct, in the last five years there has been a 67% increase in cyber security breaches. Cyber-attacks do not favor or discriminate targets as was evident in particular in 2017, when two global malware attacks WannaCry and NotPetya infected over 300,000 computers, spread to more than 150 countries and caused more than $4bn in economic damage (and due to the legal spill overs, the final financial count is still not clear). Regardless of how uncomfortable bringing the bad news feels, the problem will only grow and is expected to be particularly far-reaching in the 2020s as the world moves from fourth-generation information networks to the fifth, introducing a significantly higher technological capacity.
Better Coordination and Cooperation
The purpose of EU CyberNet is twofold. On one hand, it will strengthen the global delivery, coordination and coherence of the EU’s external cyber capacity building projects. In other words, complement and enhance all the good work that is already ongoing. On the other hand, EU CyberNet will reinforce EU’s capacity to provide technical assistance to third countries in the areas of cybersecurity and countering cybercrime. In other words, it seeks to bring together the comprehensive cyber security competence available in the different EU Member States to participate in the EU’s external cyber capacity building efforts. Given the borderless nature of cyberspace, it should be clear that the cyber security of the EU begins out- side its borders. The bottom line is: the better the cyber security capacity of likeminded countries abroad and the better the direct contacts between the European cyber defenders with their peers, the better the cyber security will be in EU Member States.
EU CyberNet has set to deliver four objectives that are:
- Establishing a network of experts and stakeholders.
The quantitative ambition is to establish ‘Cyber Team EU’ that has at least 500 individuals from the different cyber security domains (from technology to strategy, from counter-cybercrime to international law) as well as at least 150 institutions (from the national cyber authorities to academia and think tanks) sign up to the EU database as a stakeholder community.
- A Training and Assistance Capability that entails a library of courses and/or training modules that are available
to partners from outside the Union and implemented by experts from the EU database.
- Central Processing for EU’s External Cyber Engagement – the EU CyberNet is to evolve into a coordination platform for the various cyber security initiatives that the EU is already implementing and provide up-to-date information for example for the European Commission services.
- The technical Online Platform is to become the online home and front-end of the project, featuring the capability for example information exchange relevant to the stakeholders, donors and beneficiaries.
EU CyberNet is a joint project of the European Com- mission DG DEVCO and EU Member States. Implementing the EU CyberNet builds on the cyber security strengths of the lead contractor, Estonian Information System Authority RIA and its consortium partners in Luxembourg, Germany and Finland. However, the ambition as outlined above is to reach out to all the competent authorities in the EU and cyber experts in different fields who share the understanding of how important cyber security is and will be for both their nations as well as for the entire European Union. In this vein, we look forward to cooperation with likeminded partners. This is a shared playground and by working together we can per- haps even win this game.
