The EU's revised cybersecurity strategy: Half-hearted progress on far-reaching challenges

Abstract

In September 2017 the EU updated its 2013 Cyber Security Strategy. The new version is intended to improve the protection of Europe's critical infrastructure and boost the EU's digital self-assertiveness towards other regions of the world. But the reformed strategy leaves open a number of questions as to how its objective of an 'open, safe and secure cyberspace' will be credibly defended, both internally and externally. The EU has neither properly defined resilience or deterrence nor made sufficiently clear how it intends to overcome institutional fragmentation and lack of legal authority in cybersecurity issues. Moreover, controversial topics – such as the harmonisation of criminal law or the use of encryption - have been entirely omitted. Member states should abandon their stand-alone efforts and speed up the legal regulation of cybersecurity at the EU level.