Search

Begin New Search Topic Cybersecurity Political Geography Europe Content Type Policy Brief Publication Year within 10 Years

1. Building Resilience? The Cybersecurity, Economic & Trade Impacts of Cloud Immunity Requirements

Author:
Matthias Bauer
Publication Date:
03-2023
Content Type:
Policy Brief
Institution:
European Centre for International Political Economy (ECIPE)
Abstract:
EU Member States should call on the EU’s Cybersecurity Agency (ENISA) and the European Commission to abandon immunity requirements in the proposed EU Cloud Certification Scheme (EUCS). With immunity requirements in the EUCS, the EU risks opening a Pandora’s box, paving the way for data localisation, foreign ownership restrictions, and local establishment requirements in digital industries globally leading to rising trade tensions. ENISA’s current proposal could increase policymakers’ appetite for data localisation in the EU. It would empower the European Commission and Member State authorities to exclude foreign businesses from domestic cloud services markets and set a dangerous precedent for any data-intensive sector. The list of “sectors of high criticality” could be logically extended to both existing services (e.g., financial services) and to new technologies and business models, such as IoT in the energy and healthcare sectors, and autonomous driving in the transport sector. Non-EU jurisdictions would be pressured to respond in kind. EUCS immunity requirements would increase cloud adopters’ exposure to cybersecurity risks. Data localisation often creates obstacles to an integrated management approach towards cybersecurity risks. Country of headquarter and foreign ownership restrictions in the proposed EUCS risk removing global frontier cybersecurity technologies from Member State markets. Excluding these and other EU and non-EU companies from EU Member States could result in a long-lasting security deficit of EU cloud adopters vis-à-vis organisations that are still able to use reliable and often best-practice cloud services offered by providers from outside EU Member States. Immunity requirements in the EUCS are discriminatory by design. They could provoke retaliatory measures by EU trading partners, either unilaterally or through WTO or bilateral FTA (e.g., UK-EU) Dispute Settlement. Local establishment requirements and foreign ownership restrictions would by design discriminate against foreign cloud providers. US-headquartered companies, which currently serve more than 75% of the EU market, would be most affected by EU immunity requirements.[1] Depending on US preferences and the scope of the proposed EUCS, the EU could be subject to retaliatory tariffs of up to USD 12 billion worth of EU goods exports or equivalent restrictions for EU services exports to the US. Other governments could lodge complaints via the WTO as well (e.g., Singapore, Japan, Canada and others, where cloud development is advancing rapidly). EU suppliers are currently in no position to manage a broad-based transition to cloud, and thus such requirements would delay significant efficiency and security gains that current foreign suppliers could offer. A blanket exclusion of non-EU cloud vendors would also likely undermine Europe’s objective to achieve a 75% cloud adoption rate for EU enterprises. Sensitive European businesses and public sector organisations would have to delay migration and make do with legacy systems for a very long time. Contrary to large countries, these negative impacts would be much more pronounced for smaller EU Member States, which lack the presence of large domestic incumbents and generally rely much more on an open international trading regime for digital services. ENISA’s cloud certification scheme should be limited to technical and transparency requirements. Immunity requirements for non-personal data should be addressed in bilateral initiatives such as the EU-US Trade and Technology Council (TTC) or agreements requiring a company that sought to offer services of the highest level of sensitivity to be headquartered in a country granted adequacy with EU data protection rules, or a country that is an adherent to the OECD’s Trusted Government Access principles, or (concerning the US) a participant in the upcoming Trans-Atlantic Data Privacy Framework. Excluding foreign companies from operating in the EU would have far-reaching consequences. If that is the intent, it should require a sound legal analysis and the decision should be taken through a formal legislative procedure at the EU level.
Topic:
Economics, Markets, European Union, Cybersecurity, Digital Economy, Trade, and Resilience
Political Geography:
Europe

2. Why Belgium Needs a Cyber Command

Author:
Alexander Mattelaer
Publication Date:
11-2022
Content Type:
Policy Brief
Institution:
EGMONT - The Royal Institute for International Relations
Abstract:
On 19 October 2022, the Belgian Ministry of Defence declared the Initial Operating Capability of its new Cyber Command. Responding to the trend of states seeking competitive advantages in a new operational domain – as illustrated by several high-profile cyber-attacks on Belgian State institutions – the choice for developing a new instrument of statecraft has been made. This Egmont Policy Brief outlines the growing importance of developing cyber defence capabilities, discusses the organisational set-up for this Cyber Command, and finally zooms in on the challenges ahead.
Topic:
Security, Defense Policy, Cybersecurity, and Leadership
Political Geography:
Europe and Belgium

3. NATO’s Role in Global Cyber Security

Author:
Merle Maigre
Publication Date:
04-2022
Content Type:
Policy Brief
Institution:
German Marshall Fund of the United States (GMFUS)
Abstract:
Malicious cyber activity has increased substantially over the past years, ranging from ransomware and espionage to politically motivated cyberattacks and sophisticated malware used in the war in Ukraine. NATO allies must remain on high alert. The changed nature of military conflict changes the defensive mission of NATO, which faces capable opponents in cyberspace and raises the question of how to create accountability when a hostile state fails to observe globally agreed norms. The set of action for NATO for the next five years evolves around how to impose costs and how to deny benefits against malicious actors in cyberspace.
Topic:
NATO, Cybersecurity, Geopolitics, and Russia-Ukraine War
Political Geography:
Russia, Europe, Ukraine, and Global Focus

4. Hackers, Hoodies, and Helmets: Technology and the changing face of Russian private military contractors

Author:
Emma Schroeder, Gavin Wilde, Justin Sherman, and Trey Herr
Publication Date:
07-2022
Content Type:
Policy Brief
Institution:
Atlantic Council
Abstract:
The first time Russia invaded Ukraine in the twenty-first century, the Wagner Group was born. The now widely profiled private military company (PMC) played an important role in exercising Russian national power over the Crimea and portions of the Donbas—while giving Moscow a semblance of plausible deniability. In the near decade since, the Russian PMC sector has grown considerably, and is active in more than a dozen countries around the world. PMCs are paramilitary organizations established and run as private companies—though they often operate in contract with one or more states. They are profit-motivated, expeditionary groups that make a business of the conduct of war.1 PMCs are in no way a uniquely Russian phenomenon, yet the expanding footprint of Russian PMCs and their links to state interests call for a particularly Russian-focused analysis of the industry. The growth of these firms and their direct links to the Kremlin’s oligarch network as well as Moscow’s foreign media, industrial, and cyber activities present a challenge to the United States and its allies as they seek to counter Russian malicious activities abroad. As signals intelligence and offensive cyber capabilities, drones and counter-drone systems, and encrypted communications become more accessible, these technologies will prove ever more decisive to both battlefield outcomes and statecraft. More exhaustive research on these issues is necessary. The ongoing conflict resulting from Russia’s second invasion of Ukraine in this young century seems likely to shape the conduct of Russian foreign policy and security behavior for years to come—and these firms will play a part. The activities of these PMCs include high-intensity combat operations, as evidenced in Syria in 2018 and Ukraine in 2022, and a mix of population control, escort and close protection, and local direct-action activities, as seen in Libya, Mali, and elsewhere.2 Given the sourcing and dependence of Russian PMCs on Russian military service personnel and no small influence of Russian doctrine, the questions to reasonably ask include: How do changes in the Russian conduct of war and adoption of new technologies influence these PMCs? Moreover, how might these technological changes influence the role these PMCs play in Russian strategic goals and activity abroad?
Topic:
Security, Defense Policy, Science and Technology, Cybersecurity, Innovation, Wagner Group, Russia-Ukraine War, and Private Military Companies (PMCs)
Political Geography:
Russia, Europe, Eurasia, Ukraine, Middle East, and Africa

5. Trusted connectivity: A framework for a free, open, and connected world

Author:
Kaush Arha
Publication Date:
08-2021
Content Type:
Policy Brief
Institution:
Atlantic Council
Abstract:
Global affairs are increasingly shaped by three important and overlapping trends: 1) the unprecedented and growing demand for trillions of dollars’ worth of global digital and physical infrastructure; 2) the ideological battle between democracy and autocracy for the best path forward to achieve peace and prosperity; and 3) the world’s response to changing climate. As democracies address the global demand for a free, open, and connected world while ensuring that local and global emissions targets are met, they need an organizing framework: the concept of “trusted connectivity.” Democratic governments and institutions function with intricate checks and balances to ensure public trust. Unchallenged aggregation of power is antithetical to democracies and instinctively distrusted by their citizens. While holding unimaginable promise, today’s advancements in digital and physical infrastructure also embody new opportunities for malign actors in general, and authoritarian governments in particular, to accumulate and wield this power. Malign influence or control over data, communications, trade routes, energy, and transportation, all of which becomes possible when countries accept infrastructure investments from authoritarian states, could open potential vectors for coercion, disruption, or attack in times of crisis or conflict. In order to deny malign actors this influence over other countries’ infrastructure, democracies need to work together to ensure that the benefits and terms for the host country in building a bridge, port, rail, road, or telecommunications network are equitable and transparent, thereby leading to greater trust and security in addition to economic prosperity. US President Joseph R. Biden, Jr., rallied the world’s leading democracies behind this cause at the Group of Seven (G7) summit in June 2021 in Cornwall, England. The G7 nations, comprising the world’s leading free economies and free societies, proclaimed that, as they aim to meet global infrastructure demand, among other goals, their efforts will be guided by shared democratic values. For China, the standard-bearer of an alternate, illiberal model, infrastructure investment serves a different purpose: to increase China’s global economic leverage for its political gain. To prevail in this competition, advance their values, and develop much-needed digital and physical infrastructure, the world’s leading democracies should adopt the principle of trusted connectivity.
Topic:
National Security, Infrastructure, Cybersecurity, and Connectivity
Political Geography:
China, Europe, Asia, and United States of America

6. The post-Brexit EU-UK relationship: an opportunity or challenge for cyber security?

Author:
Ellie Templeton and Robert Dewar
Publication Date:
09-2021
Content Type:
Policy Brief
Institution:
The Geneva Centre for Security Policy
Abstract:
With multiple post-Brexit pathways that could still be pursued following the recent adoption of the new security agreements, the EU-UK cyber security relationship is still evolving. Value must be placed on collaboration to tackle shared cyber threats, the role EU institutions play in bringing cyber security actors together, and Britain’s former contribution to European security. These factors strongly indicate that, although new opportunities may present themselves, there will likely be irreversible losses for collective cyber resilience due to Brexit. In order to work towards a new, valuable relationship model, it is recommended that both the EU and UK uphold professional, transparent and non- political security cooperation going forward, whilst remaining open to flexible operational support in the unpredictable and ever-changing cyber threat landscape. Ultimately, within an international system affected by “instability, insecurity and uncertainty”,61 it remains to be seen what opportunities and challenges arise, and if the resulting relationship, whether based on one specific pathway or a combination of all three, could constitute an effective EU relationship model for non-EU entities in the cyber security field.
Topic:
Security, Regional Cooperation, European Union, Cybersecurity, and Brexit
Political Geography:
United Kingdom and Europe

7. Cyber Conflict Uncoded: The EU and conflict prevention in cyberspace

Author:
Patryk Pawlak, Eneken Tikk, and Mika Kerttunen
Publication Date:
04-2020
Content Type:
Policy Brief
Institution:
European Union Institute for Security Studies
Abstract:
When the Supreme Leader of Iran promised revenge in response to the killing of General Suleimani in January 2020, the possibility of offensive cyber operations against US targets was suggested. Eventually, Iran resorted to a more conventional response, launching missiles against US military bases in Iraq. However, this episode points to a shift in our understanding of what conflict means. In January 2019, the French Minister of Armed Forces, Florence Parly, stated that “cyber warfare has begun and France must be ready to fight it” as she announced the new French Military Cyber Strategy. In a similar vein, the UK Chief of the Defence Staff, General Sir Nick Carter, announced in September 2019 that Britain is “at war every day” due to constant cyber-attacks from Russia and elsewhere and warned that with the evolving character of warfare, the distinction between peace and war no longer exists in the modern world. The proliferation of Information and Communication Technologies (ICTs), both the expansion of usage and the increased availability of harmful means, has brought about new ways of power projection. Political and economic contestation between states now involves targeted cyber-attacks against other countries’ utilities, financial networks, election infrastructure and governance systems. Cyber-attacks – a deliberate use of malicious software for exploiting or altering computer code, data or logic to cause harm – offer new methods to target internet infrastructure, telecommunications networks, information systems, as well as computers and computer systems. Such activities might have the objective of destroying or affecting the proper functioning of these systems with adverse effects for their users – whether states, companies, public service providers or individuals. As a result, power projection does not have to involve tanks or missiles; nor does it have to result in direct death and destruction comparable to armed conflict. Confrontation is, however, a constant in states’ ambitions, attitudes and capabilities, blurring the line between war and peace. This Conflict Series Brief examines the current practices and future possibilities of preventive action in relation to conflict in cyberspace. When categorising state uses of ICTs as a form of conflict, attention should be paid to three considerations. First, hostile uses of ICTs rarely occur outside of a pre-existing or broader politico-military dispute. Second, a malicious state use of ICTs can lead to an escalation in pre-existing adversarial relations. Third, the use of cyber capabilities in a conflict situation often includes the targeting of civilian infrastructure and therefore has wide-ranging implications for the proper functioning of societies. Against this background, this Brief argues that the use of malicious cyber tools for power projection can and must be prevented.
Topic:
European Union, Cybersecurity, Conflict, Transnational Actors, and Information Technology
Political Geography:
Europe

8. NATO’s needed offensive cyber capabilities

Author:
Ion A. Iftimie
Publication Date:
05-2020
Content Type:
Policy Brief
Institution:
NATO Defense College
Abstract:
At the 2016 NATO Summit in Warsaw, cyberspace was recognized as an operational domain in which NATO military forces must be able to maneuver as effectively as they do on land, at sea and in the air. Since then, Allies have conducted several successful offensive cyber operations against non-state adversaries, such as Daesh. Due to technological transformations in recent years, cyber is no longer viewed by NATO and its member states only as a hybrid threat, but also as a weapon in its own right and as a force multiplier in current military operations. Over the next two decades, NATO will look for new ways to integrate cyber weapons (or offensive cyber capabilities) into its operations and missions.
Topic:
Defense Policy, NATO, Non State Actors, and Cybersecurity
Political Geography:
Europe, North America, and Global Focus

9. Denmark's China Challenge

Author:
Luke Patey
Publication Date:
10-2019
Content Type:
Policy Brief
Institution:
Danish Institute for International Studies (DIIS)
Abstract:
A common refrain in Denmark is that China is too far away to be a threat to Danish economic, foreign and security policy interests. This is no longer the case. Danish policy-makers acknowledge that China’s rise as a global superpower presents Denmark with new challenges. However, transforming this strategic thinking into practice is no simple task. Recommendations Intensify cooperation between the Ministries of Defense and Foreign Affairs to ensure Denmark’s initiatives in foreign policy, security and economic relations with China are more closely integrated. Beware of the bilateral. Beijing’s new assertive foreign policy and US-China strategic competition require that Denmark leverage its interests increasingly through the EU, NATO and other multilateral bodies. Assess the economic vulnerabilities of Danish industries in China and diversify trade and investment across Asia’s emerging markets and developed economies in the G7/EU.
Topic:
Security, Foreign Policy, Defense Policy, Power Politics, Bilateral Relations, Cybersecurity, and Global Political Economy
Political Geography:
China, Europe, Asia, and Denmark

10. EU cyber partnerships: Assessing the EU strategic partnerships with third countries in the cyber domain

Author:
Thomas Renard
Publication Date:
02-2018
Content Type:
Policy Brief
Institution:
EGMONT - The Royal Institute for International Relations
Abstract:
The European Union is increasingly active on cyber issues internationally, guided by its various foreign policy documents and strategies, including its 2013 Cybersecurity Strategy and the 2015 Council conclusions on cyber-diplomacy. In line with these documents, the EU has deepened its bilateral ties with a number of key countries, resulting in a network of cyber partnerships. This article explores these partnerships in depth. It seeks to explain the different types of purposes that they fulfil, and the various mechanisms that underpin them, based on an ambitious mapping exercise. In essence, it is argued that the EU’s cyber partnerships aim not only for bilateral cooperation, but also for ‘reflexive’ results (whereby the EU aim to develop its cyber and diplomatic agency) and ‘structural’ results (whereby bilateral partnerships aim to strengthen the multilateral fabric and global internet governance). Once assessed against these multiple and intertwined purposes, these cyber partnerships appear more useful than meets the eye.
Topic:
International Security and Cybersecurity
Political Geography:
Europe

11. Why Americans Should Care About Russian Hacking

Author:
Michael Fuchs, Carolyn Kenney, Anna Perina, and Francesca Van Doorn
Publication Date:
02-2017
Content Type:
Policy Brief
Institution:
Center for American Progress - CAP
Abstract:
Russia’s interference in the 2016 presidential election was an attack on the American people, threatening the integrity and legitimacy of the democratic process, as well as the outcome of the election. And yet, the Intelligence Community Assessment on Russian activity in the election found that this was but the most recent and aggressive expression to date of a longstanding Russian desire to sow chaos and instability in the United States. Russia’s meddling in the 2016 election should be a wake-up call to every American about the diverse ways in which Russian malicious cyberactivity could affect every aspect of their lives.1 The so-called information warfare campaign ordered by Russian President Vladimir Putin during the election is part-and-parcel of a longstanding and multi-faceted Russian intelligence strategy that “blends covert intelligence operations—such as cyberactivity—with overt efforts by Russian Government agencies, state-funded media, third-party intermediaries, and paid social media users or ‘trolls’” in order to cripple its adversaries.2 The election is not the first time Russian cyberactors have been successful. Over the past decade, Russian hacking groups—many of which are backed by the government—have successfully deployed a technology-based strategy to infiltrate, tamper with, and steal sensitive information across government, military, banking, and communications systems in the United States and Europe.
Topic:
Security, Elections, Cybersecurity, Social Media, and Election Interference
Political Geography:
Russia, Europe, North America, and United States of America