Europe’s Third Way in Cyberspace

Conflict of values

Since Edward Snowden’s revelations and the use of digital technologies for state sur­veillance, the aspiration that the Internet will promote freedom and human rights everywhere is no longer completely plau­sible. It is evident that today’s Internet is a space in which conflicts of values and distributional conflicts occur and future modalities of individual and social self-determination are negotiated. The tech­nology of the network infrastructure and its associated applications are not value-neutral instruments, instead they are im­pacting on decisions and actions. They are instruments of value-related policies, as the dispute over Chinese technology company, Huawei, shows. The US administration views Huawei not only as a market par­tici­pant but, at the same time, as a Trojan horse from an unfriendly government. Bei­jing refutes these allegations and con­siders the exclusion of Huawei from the US mar­ket as a measure directed against China’s position in the global market as a whole.

The conflict over Huawei marks a break with the purely market-based logic of global trade relations and expedites a growing digital mercantilism. Many see converging markets as no longer simply an opportunity to improve prosperity, but also as a danger to self-determination and public safety. They argue that digital products are suit­able for undermining value systems and subverting governmental control through technical backdoors. Terms such as “tech­nological sovereignty” and “economic vul­nerability” or “weaponized interdepend­ence” are an indication and legitimation of the growing willingness to restrict innovation and competition when it comes to digital products and services. However, new confrontations in the digital world are not limited to the relationship between the West and China. Conflicting values that are difficult to reconcile exist even today in trans­atlantic relations. The much vaunted transatlantic community of shared values reaches its limits where the idea of a free (digital) single market clashes with the re­quirement to protect personal data and informational self-determination, and with European competition law. The long-ignor­ed dominance of US Internet companies has forced Europe to embark on a course of digital self-assertiveness – from data pro­tection and competition law to taxation.

Cybersecurity conflict

Cyber attacks and defence are seriously challenging state sovereignty. While the complexity and interdependence of digital systems are rapidly increasing, the safety quality of the hardware and software used for these systems remains underdeveloped and lacks the necessary human resources to secure them. Cyberspace is constantly cre­ating new attack vectors and targets. The criminal exploitation of vulnerabilities, such as the use of ransomware to blackmail companies, and state cyber attacks aimed at eliciting information or causing destabili­sation, or as part of hybrid warfare, are mutually reinforcing. The most extreme example is North Korea which generates global revenue from global cyber opera­tions for the procurement of missile tech­nology. In five rounds of negotiations at UN level, a Group of Governmental Experts (GGEs) has been debating the international condemnation of and/or the placing of restric­tions on cyber attacks and setting up a cyber defence organisation under inter­national law – but without success. No short-term progress can be expected from the current sixth round of the GGE, nor from parallel negotiations initiated by Russia being conducted in an Open Ended Working Group (OEWG).

Trade conflict

The trade dispute between the US and China is essentially entangled with the development of markets in goods and services towards a greater emphasis on digital products and services. The digital transformation of global markets is not only accompanied by a growing economic interdependence, it has also increasingly reduced the ability of individual countries to control them. When US President Trump announces trade restrictions, he intends to regain control over the innovation-driven global competition the US is confronted with. At the same time, the products and services offered by US tech companies are an essential tool of state control and in­fluence for Washington. However, complex digital systems such as 5G network tech­nology could prove to be an almost un­controllable technology that has been built into a state’s infrastructure for decades and is ultimately under the control of an authori­tarian state. Network products are currently evolving the software-based tech­nology. The regular updates required for software bring functional improvements that the operator using it hardly notices. At the same time, the digital transformation is affecting all market segments, from agri­cul­tural products to medical technology and mechanical engineering. Trade issues mat­ter for digital sovereignty and vice versa.

Data protection and data security as an EU interest

The specifically European approach to digitisation can be found in the EU’s legis­lative acts on data protection and data security. The General Data Protection Regu­lation, which has been in force for all com­panies since May 2018, sets new standards in the task of finding a balance between protecting personal data and ensuring the free movement of data in the Single Market. Data protection and cybersecurity have so far been considered separately. However, the two topics are increasingly merging into one. This can be seen, for instance, in digi­tal energy meters (SmartMeter). Not only are they subject to the highest levels of safety and security standards, they also have the highest data protection requirements in order to ensure that third parties do not gain illegal access to data about users’ do­mes­tic habits. By establishing a comprehensive system of defining and certifying tech­nical cyber security, the EU is taking a major step towards further consolidating its role as a regulatory power, which it played so successfully with the GDPR.

The Cybersecurity Act

On 10 December 2018, the European Parlia­ment, the European Council and the Euro­pean Commission agreed on the policy terms of a Cybersecurity Act. The Regula­tion on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification (Cybersecurity Act) entered into force in June 2019. The Act contained two major reforms: The EU cybersecurity agency (European Union Agency for Network and Information Security, ENISA) will have a mandate beyond 2020 to assist Member States in dealing with cyber attacks. It intro­duces a cybersecurity certification framework for ICT products, services and pro­cesses (European certification framework). Certification is based on the idea that stand­ards and norms can create a balance between the need for consumer protection and the industry’s legitimate claim to com­petitiveness. Both are high European prin­ciples that need reconciling with one another. Consumer protection means pro­tecting consumers from negative consequences, such as unauthorised disclosure or use of their data, and generally providing them with reliable and high-quality prod­ucts. However, these objectives may conflict with the competitiveness of some providers. For example, companies often view high standards of privacy and data security as barriers to competition.

The Cybersecurity Act provides for a vol­untary “conformity assessment” of informa­tion and communication technology (ICT) products, i.e. an EU-wide European certifi­cation framework for the cybersecurity of products, services and processes. The pro­cedure for setting minimum standards and reviewing them has already been estab­lished in the regulations on general product safety. In this respect, the Regulation focuses on harmonising safety standards. The relevant national body should be able to verify that they comply with the estab­lished cybersecurity features of ICT prod­ucts, services and processes. In order for a product category to be deemed compliant it must meet a series of review criteria, referred to in the Regulation as a “European cybersecurity certification scheme”. The Euro­pean Commission, representatives of the Member States and stakeholders shall jointly determine the products for which such schemes are to be drawn up. ENISA shall prepare drafts for the schemes. As soon as European schemes for the product groups have been adopted, they will replace any national schemes.

ENISA will also specify assurance levels for ICT products and services. A European cybersecurity certification scheme may specify one or more assurance levels for ICT products and ICT services. In future, there will be three assurance levels: “basic”, “sub­stantial” or “high”, depending on how re­silient the products and services are against cyber attacks and the degree of trust that can be guaranteed to them. Manufacturers are free to decide whether or not to certify a product according to an existing scheme. Depending on the desired assurance level, cer­tification can be implemented by an inde­pendent assessment body or take the form of a manufacturer’s declaration. The aim is to boost confidence in company ICT prod­ucts through the implementation of various measures that are part of the certifi­cation process. Consequently, manufacturers must:

• select secure default settings for their products;

• provide end users with the tools to use their products in a safe and secure manner;

• disclose security vulnerabilities;

• inform end customers when support for an individually issued security guarantee ends.

Finally, ENISA will maintain and make publicly available checklists to pre-assess the cyber risk of each ICT product and service. It will also keep and continuously update a list of ICT products and services for which it considers cybersecurity certifi­cation to be a necessity (priority list).

The European cybersecurity certificate scheme will acquire global relevance due to the sheer size of the European market. In addition, two complementary mechanisms ensure that adoption of the certification schemes will occur more swiftly under the Cybersecurity Regulation. In its IT security legislation on critical infrastructures and digital services (NIS Directive), the EU re­quires operators of such services to take “state-of-the-art” IT security measures. The operators themselves are responsible for meeting this undefined legal requirement. The use of certified products will make it easier for them to prove they have aligned themselves with the state of the art. In addi­tion, the Regulation limits the voluntary nature of certification by explicitly stating that EU law will require certification from another body, for example one in the rele­vant sector. It is likely that the Commission and Parliament will make use of this invita­tion to ensure that new technical applications comply with cybersecurity requirements.

The effectiveness of the new European cybersecurity certification will largely depend on the EU’s approach to developing these schemes. Some of the Commission’s statements suggest that it regards Internet of Things (IoT) products in the consumer market as a priority. Elsewhere, it advocates applying certification schemes in the field of industrial applications. Current certifica­tion schemes in the high security sector, which are mainly used for government applications, are to be transferred to the European system.

Germany is also expected to bring in national legislation to broaden certification. For example, the draft IT Security Act 2.0 includes a new system category for “Critical Infrastructure Core Components”. It refers to IT systems that are of particular impor­tance for the functioning of critical infra­structure. Certification should certainly become obligatory for such systems. The Federal Network Agency (Bundesnetzagentur), together with the Federal Office for Infor­mation Security (Bundesamt für Sicherheit in der Informationstechnik, BSI), intends to make initial use of the new provisions – in ac­cord­ance with the recently introduced safety catalogue – to mandate the certifi­cation of the core components of telecommunications networks. This move is a direct consequence of the debate over the lack of trust in Huawei products for 5G networks.

How might the strategy for a third way be designed?

As digital markets start to merge, different types of regulatory models have evolved globally. The Western model for liberal and open societies is increasingly interoperable with the Chinese model, which is similar to ones used in Russia, Iran and some Arab states, representing an authoritarian regi­mentation of the digital space with an equal claim to legitimacy on a global scale. Some EU Member States are already trying to pursue illiberal development paths. Given the conflicts described above, the burning questions are: what is the most appropriate stance to take in dealing with the digital space in other regions of the world? Should Europe stick to a consistent policy of digital sovereignty on this issue? Should it subsequently develop its own 6G mobile data networks with the aid of nation­al funding programmes, its own Google, its own WhatsApp and so on? As convincing as this idea may initially sound, the long-term consequences of a desire for digital strategic autonomy may be fraught with risk – both in terms of innovation policy and security policy.