Cybersecurity and cyberdefence: EU Solidarity and Mutual Defence Clauses

Faced with an increasing number of complex crises with a trans-border dimension, the European Union has invested significant energy and resources in strengthening its crisis- and disaster-management capabilities. To that effect, the Treaty of Lisbon equipped the Union with two provisions aimed at improving the EU’s response to natural or man-made disasters (the Solidarity Clause) and military aggression against an EU Member State (the Mutual Defence Clause). For some time, both clauses remained purely theoretical concepts, without clear rules regarding their activation or procedures once either of the two is invoked by a Member State. In 2014, after many months of discussion, the Member States agreed on arrangements for the implementation of the 'Solidarity Clause'. The 'Mutual Defence Clause' has yet to see similar progress. Whether backed by procedures or not, so far the Member States have been reluctant to make use of either of the two provisions. Many areas of human activity are increasingly dependent on information technology. At the same time, over the past year some major media outlets and companies – including Sony and TV5 Monde – have become victims of cyber-attacks. Consequently, policy-makers are increasingly preoccupied about the risk of cyber-attacks with disastrous consequences for critical national infrastructure. Given the interconnectedness between the Member States and their inherent limitations to tackle a complex disaster provoked by a cyber-attack alone, there is some debate about the likelihood of the Solidarity and Mutual Defence Clauses eventually being invoked. The European Parliament has addressed these issues on three different occasions but its role once any of the clauses is activated remains to be defined.