EU countries agree to collectively punish attacker when a member is hacked

The European Union’s 28-nation bloc is in agreement concerning how to punish hackers. On Monday, the European Council announced a joint framework, dubbed the “cyber diplomacy toolbox,” to guide how member countries should uniformly respond to malicious cyber activity, which includes steps to cooperatively impose economic sanctions, travel bans, asset freezes and blanket bans against responsible parties.

The European Union’s 28-nation bloc is in agreement on how to punish hackers.

On Monday, the European Council announced a joint framework, dubbed the “cyber diplomacy toolbox,” to guide how member countries should uniformly respond to malicious cyber-activity, which includes steps to cooperatively impose economic sanctions, travel bans, asset freezes and blanket bans against responsible parties.

“The key principle here is proportionality,” an EU official told CyberScoop. “It is EU member states who would decide what measure should be used depending on the case they would face … This work aims to promote enhanced shared situational awareness, information sharing and efficient decision-making, and should see the development of a procedure for the attribution of cyberattacks in the context of the cyber diplomacy toolbox.”

Use of the “toolbox” is voluntary in nature and any collective response would require unanimous EU member support.

In short, the framework represents an ambitious effort by alliance partners to essentially standardize future response plans, which could be leveraged to isolate a group, country or specific criminal.

“The potential impact is the important factor, both for allies and adversaries. Allies want more security, adversaries will fear isolation and action, whether diplomatic, economic, or military,” explained Comodo Senior Research Scientist Kenneth Geers. “Cybersecurity is fundamentally an international problem, so it requires an international solution. Unanimity is good and bad: hard to achieve, but worth the wait.”

Current international law stipulates that attribution of cyberattacks against EU countries — including those which could be applicable for a response under the aforementioned framework — would be separately pursued by victim countries and other relevant partners. In these cases, however, attribution is especially important because a unanimous assessment would be necessary before collective action can occur.

“A State is free to make its own determination with respect to attribution of a cyber-activity to an actor as long as the attribution is performed in accordance with international law,” an EU official told CyberScoop.

The move comes as Germany prepares for a national election later this year amid reports that Russian intelligence services remain actively involved in influencing domestic affairs.

The recent French election also reportedly included some Russian hacking attempts aimed at relevant political organizations, based on a testimony by National Security Agency Director Adm. Michael Rogers.

The U.S. intelligence community concluded last year that hackers backed by the Russian state broke into and leaked Democratic Party emails as part of an effort to undermine Hillary Clinton’s presidential bid. Russian government officials, including Vladimir Putin, have denied the report’s finding.

Europe is trading security for digital sovereignty

A proposed EU cybersecurity regulation would isolate Europe from the global cybersecurity industry with unpredictable consequences.

Research questions potentially dangerous implications of Ukraine’s IT Army

UK, EU, US formally blame Russia for Viasat satellite hack before Ukraine invasion

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure