Understanding the EU's approach to cyber diplomacy and cyber defence

Briefing 28-05-2020

Despite its expertise in cyber public awareness campaigns, research and development, and educational programmes, the EU is still subject to constant cyber attacks. The EU's response to a sophisticated cyber threat spectrum is comprehensive, but perhaps the most European aspect of its toolbox is cyber diplomacy. Cyber diplomacy aims to secure multilateral agreements on cyber norms, responsible state and non-state behaviour in cyberspace, and effective global digital governance. The goal is to create an open, free, stable and secure cyberspace anchored in international law through alliances between like-minded countries, organisations, the private sector, civil society and experts. Cyber diplomacy coexists with its sister strands of cyber defence, cyber deterrence and cybersecurity. Offensive cyber actors are growing in diversity, sophistication and number. Disruptive technologies powered by machine-learning and artificial intelligence pose both risks and opportunities for cyber defences: while attacks are likely to increase in complexity and make attribution ever more problematic, responses and defences will equally become more robust. Burning issues demanding the international community's attention include an emerging digital arms race and the need to regulate dual-use export control regimes and clarify the rules of engagement in cyber warfare. Multilateral cyber initiatives are abundant, but they are developing simultaneously with a growing push for sovereignty in the digital realm. The race for cyber superiority, if left unchecked, could develop into a greater security paradox. The EU's cyber diplomacy toolbox and its bi- and multilateral engagements are already contributing to a safer and more principled cyberspace. Its effectiveness however hinges on genuine European and global cooperation for the common cyber good. Ultimately, the EU's ambition to become more capable, by becoming 'strategically autonomous' or 'technologically sovereign', also rests on credible cyber defence and diplomacy.