Feed aggregator

The first major cyberattack on a nation state occurred ten years ago, in Estonia in 2007. The attack uncovered a grey area in the field of international law, and policy-makers and security experts were caught off guard.

In the years to follow, malicious activity exploiting the virtual space’s endless possibilities and vulnerabilities rapidly evolved and attacks on critical infrastructure increased significantly (e.g. in Georgia in 2008, the Stuxnet worm in Iran in 2010), creating a whole new domain of war – the online borderless world of cyberspace. But international law followed suit and scholars, decision-makers and even the UN agreed that existing international law applies to cyberspace and any comparison with the ‘Wild West’ was deemed as groundless.

Regardless, many questions remained unanswered. For instance, what actually constitutes a harmful cyber operation and who can perform such a powerful attack? The term ‘harmful cyber operation’ means any malicious activity that targets critical infrastructure sectors (e.g. electric grids, nuclear power plants, air traffic control, hospitals, etc.) of another state that can cause major damage, death or destruction in the physical world.

This can be conducted by a group sponsored by a state, or a non-state actor, acting independently. While these attacks might not always cross the threshold of use of force (prohibited by Article 2(4) of the UN Charter), they can still cause major consequences for the victim state and violate its sovereignty or the principle of non-intervention.

The European Union has not been immune from these developments. In the EU, cyberattacks (both harmful and non-harmful) against government institutions and critical infrastructure have significantly increased in recent years (e.g. in Italy in 2014, in Germany in 2016, and most recently, in a number of EU countries with the WannaCry ransomware).

Legislation on the malicious use of the virtual space at national level is different in all Member States. However, due to the interconnected information and network systems, an attack against one Member State will likely have a spill-over effect that could lead to breaching the security of the whole EU. Therefore, the need for a supranational legislation on cyberspace is clear.

As a result, after years of negotiations on promoting closer cooperation on issues such as data protection laws and the internal security of the Union, the Network and Information Security (NIS) Directive, the first comprehensive EU cybersecurity legislative instrument, entered into force in August 2016. It aims at harmonising and stabilising the level of cybersecurity across the Union through public-private cooperation.

The urgent need for such cooperation reflects the awareness that critical infrastructure sectors are mainly managed by private businesses (or ‘operators of essential services’, as per the NIS Directive) with their own rules and regulations. If states want to achieve a certain level of cybersecurity, public and private actors need to start cooperating more.

Case study: The UK

The UK represents an interesting case for analysis, mainly because of its approach to cyber issues: cyber has been considered a Tier One threat to national security since 2010. In light of Brexit, many will wonder whether or not the implementation of the NIS Directive into national law will happen. The answer is yes. The transposition has to be completed by May 2018, which means that the UK will have to do it regardless of Brexit.

Whether a new law will be introduced or present legislation will be adapted is still unclear. And while in many states the NIS Directive will fill in a void, this is not entirely the case with the UK. Although there is currently no Cybersecurity Act, the UK is one of the states with some cyber-related legislation regulating the security and intelligence agencies’ work, specifically the Government Communications Headquarters (GCHQ), which deals with cyber issues.

The law currently in force is the Investigatory Powers Act (IPA) 2016, which legalised bulk equipment interference powers, previously known as computer network exploitation and today known as hacking. In other words, the IPA legalised what has already been stated in the National Cyber Security Strategy 2016 – that the UK is developing offensive cyber capabilities.

The recent WannaCry global ransomware attack and its impact on the UK’s National Health Service (NHS) provides a clear rationale for the timely adoption of the NIS Directive. The issue with hacking medical records is far from new. It was already the subject of discussion in the UK back in 1991 when the ‘unpleasant aspects of these new systems of technology’ were acknowledged in relation to hacking into hospital computers.

Yet 26 years later, the WannaCry attack caused major disturbances and a halt to the work of the NHS. The virus hit devices using Windows XP – an outdated and unsupported version of Microsoft software, highly vulnerable to attacks, a fact the NHS was aware of. However, even though the NHS is a critical infrastructure sector, there is currently no law in the UK that enforces security measures for network and information systems, which, if present, would have technically prevented the attack.

This gap was also acknowledged in written evidence provided by Google, Yahoo, Microsoft, Apple, Twitter and Facebook on the Investigatory Powers Bill, which argued that the draft bill failed to provide statutory provisions on ‘the importance of network integrity and cyber security’. In cases like this, the great importance of the NIS Directive becomes obvious.

Even though the NIS Directive is an excellent initial step towards better coordination and safer cyberspace across the Union, it will be years before its effectiveness can be demonstrated. The problem is that the process of adopting law is time-consuming and cannot keep pace with technology. Laws cannot be amended immediately after a new network, device or software update has occurred. There are always going to be zero-day vulnerabilities to be exploited by security agencies and/or criminals. What the NIS Directive can do, however, is minimise the risk of further Wannacry incidents.

Please note that this article represents the views of the author(s) and not those of the UACES Student Forum or UACES.

Comments and Site Policy

Shortlink for this article: bit.ly/2whkVqg

Eva Saeva
Newcastle University

Eva Saeva is PhD Candidate in Law at Newcastle University. Her research concentrates on the EU’s legal approach to cybersecurity.
.
.

The post Harmful Cyber Operations in the EU: Implementing the NIS Directive into the UK Legal System appeared first on Ideas on Europe.

Brexit means that the European Union loses one of only two Member States with strategic ambition, a capable military, a nuclear deterrent and a permanent seat on the United Nations Security Council. It also loses a driver of key foreign policies such as enlargement, trade liberalisation and the global fight against climate change. At the same time, Brexit rids the EU of a member which regularly obstructed attempts to create or strengthen common institutions and to speak with one voice on the global stage.

Despite Britain having played both these fundamental and contradictory roles, it seems unlikely that Brexit will have a major impact on the EU’s presence in international affairs. British contributions might seem important for the EU’s Common Security and Defence Policy (CSDP). However, both France and the UK, which kick-started EU defence with their Saint-Malo Declaration in 1998, lost interest in the CSDP long before Brexit.

Most ongoing missions are rather unambitious and limited in scope, and British contributions in terms of personnel and equipment have been marginal in recent years. Rather than using the Permanent Structured Cooperation mechanism established by the Lisbon Treaty, the 2011 Franco-British Lancaster House Treaties established substantial bilateral military cooperation without any formal links to the EU.

Brexit might not affect the EU’s foreign policy preferences either. Enlargement, arguably the EU’s strongest source of influence beyond its own borders, is on hold for the foreseeable future. With Britain having moved from an enthusiastic supporter to enlargement sceptic in recent years, its views have largely converged with those of the remaining Member States. A victory for Remain in last year’s referendum would not have made much of a difference.

Meanwhile trade liberalisation and climate action have become second nature to the Union. Therefore, the loss of British influence is unlikely to have a major impact in these sectors either. Whether ambitious free trade agreements such as the Transatlantic Trade and Investment Partnership (TTIP) are eventually concluded would have depended more on public discontent in continental Europe than on the British government’s stance anyway.

While Brexit will probably not affect the EU’s modest role on the global stage, it is also unlikely to enable a rapid progression towards a more integrated and substantial common EU foreign policy.

It is true that the UK has often spearheaded efforts to undermine the creation of a more ambitious EU foreign policy. Having failed to prevent the creation of the European External Action Service (EEAS) in its current form, the UK engaged in political guerrilla warfare against what it saw as ‘competence creep’. On various occasions, British ambassadors blocked EEAS officials from speaking at international organisations and from issuing joint statements on behalf of the EU. The UK government even challenged the Commission’s exclusive authority over trade negotiations, in spite of this being completely in line with its own approach to international trade.

However, while Brexit removes a key obstacle to further and more substantial common external action, the view that foreign policy should remain the prerogative of the Member States is by no means limited to London. Along with the currently rather Eurosceptic climate in continental Europe, this makes major leaps towards a more integrated EU foreign policy appear rather unlikely in the short term.

Recent initiatives such as the establishment of a Military Planning and Conduct Capability (MPCC) facility or the €5.5 billion European Defence Fund have raised hopes among federalists. The timing of their announcement was indeed quite symbolic. But these initiatives had been in the pipeline for quite a while and are limited in scope and ambition. Rather than a first step towards an integrated EU army, they represent a continuation of the pragmatic but modest efforts that have been made in recent years.

Although no major short-term changes should be expected with regards to institutions and policy preferences, the British decision to leave the Union is likely to affect the EU’s standing on the global stage. The Union’s international credibility has already suffered due to its inadequate reaction to the Eurozone sovereign debt crisis and the refugee situation in the Mediterranean. Brexit is likely to further undermine its reputation in the international arena. This is not only due to the Union losing a key member state with major strategic, economic and diplomatic capacities. It also relates to the fact that the EU is loses a member at all.

The reality that the EU has ceased to be sufficiently attractive even for one of its own members undermines its ability to promote its model as well as its norms and values towards third states. Hence, Brexit further reduces the EU’s soft power, which is arguably one of its greatest sources of international influence.

Whether this trend can be reversed depends on how the EU deals with the challenges that lie ahead. Recent political developments warrant cautious optimism. While Britain is plunging into chaos, the EU looks stronger and more stable than it has in quite a while. The Union’s economic situation is improving, its Member States have shown unprecedented unity on the Brexit talks and there is increasing support for structural reforms. And most crucially, European citizens’ support for further European integration is finally on the rise once again.

Please note that this article represents the views of the author(s) and not those of the UACES Student Forum or UACES.

Comments and Site Policy

Shortlink for this article: bit.ly/2fLY13Z

Ragnar Weilandt | @ragnarweilandt
Université libre de Bruxelles and University of Warwick

Ragnar Weilandt is PhD Candidate in Politics at the University of Warwick and the Université libre de Bruxelles. His research focuses on EU foreign policy and Euro-Mediterranean relations.
.

The post Why Brexit’s Impact on EU Foreign Policy Might Remain Limited appeared first on Ideas on Europe.