Monday

29th Aug 2016

Companies must report cyber attacks, EU says

  • "There is no true freedom without security," said EU digital agenda commissioner Neelie Kroes. (Photo: European Commission)

Large EU-based companies will have to disclose major cyber-attacks to designated national authorities, under new legislative rules proposed by the European Commission on Thursday (7 February).

“Under our proposal, sectors using telecoms networks in ways vital to our economy and society would have to manage risks and report significant incidents,” EU digital agenda commissioner Neelie Kroes told reporters in Brussels.

Dear EUobserver reader

Subscribe now for unrestricted access to EUobserver.

Sign up for 30 days' free trial, no obligation. Full subscription only 15 € / month or 150 € / year.

  1. Unlimited access on desktop and mobile
  2. All premium articles, analysis, commentary and investigations
  3. EUobserver archives

EUobserver is the only independent news media covering EU affairs in Brussels and all 28 member states.

♡ We value your support.

If you already have an account click here to login.

Speaking alongside EU commissioner for home affairs Cecilia Malmstrom and EU foreign policy chief Catherine Ashton, Kroes said companies dealing with energy, transport, banking, healthcare and Internet fall under the directive.

The scope reaches just over 40,000 firms in the EU. Hardware manufacturers and software developers are exempt.

Member states will need to come up with plans to better manage risks. They will also need to create a so-called cooperation network to pool and share knowledge with other member states and the commission.

The directive also calls for Computer Emergency Response Teams (Certs) to handle incidents.

A chief authority will need to be appointed to prevent, handle and respond to risks and incidents. He or she would be the go-to-point for companies required to report serious breaches and can decide to make it public or keep it secret.

The ideas have already attracted critics.

For one, German Green euro-deputy Jan-Philip Albrecht told this website in an email that making IT firms report only major incidents means they would not have to reveal known other vulnerabilities and risks.

“This leads to action only after the damage has already been done ... it also falls back behind the ‘responsible disclosure’ practices about vulnerabilities that are already established in the IT security industry today,” he said.

But the commission hopes the directive will help reverse a growing reluctance, in its view, among people to make purchases off the Internet or use online services like banking.

Few companies publicly report cyber attacks in fear of damaging their reputation and losing clients. Each attack costs anywhere between several thousand to several million euros of damage.

Over 90 percent of large corporations had their systems hacked in 2012 though the figure drops to 76 percent for small businesses, says the commission.

In one case, Dutch certificate authority DigiNotar went bust in 2011 after failing to disclose that hackers had stolen valuable data. The cyber invaders took digital certificates and circulated them online for widespread fraudulent use.

Larger companies like Amazon are also victims.

Last year, one of the online giant’s retailers had its database breached with hackers accessing the personal details of some 24 million customers. More recently, on 31 January 2013, Amazon’s homepage was briefly taken offline.

The origins of the attacks are rarely made public, though former Google CEO Eric Schmidt points the finger squarely east at China in a book that comes out in April.

A preview from the Wall Street Journal published on 1 February quotes the book as saying China is “the most sophisticated and prolific” hacker of foreign-based companies.

Ashton, who presented a EU cyber security strategy alongside the commission’s draft proposals, refused to respond to a reporter’s question if China was indeed a major culprit.

“I’m not going to comment on what intelligence operations across the European Union are discovering about the origin of cyber attacks...suffice it to say, in my discussions across the world, cyber security is increasingly becoming part of the dialogue of our discussion,” she said.

News in Brief

  1. Hungary plans to reinforce border fence against migrants
  2. France's highest court suspends burkini ban
  3. Greeks paid €1bn more in taxes in June
  4. Greek minister denounces EU letter on former statistics chief
  5. Turks seeking asylum in Greece may cause diplomatic row
  6. Merkel becomes digital resident of Estonia
  7. Report: VW will compensate US dealers with €1bln
  8. EU mulls making Google pay news media for content

Stakeholders' Highlights

  1. GoogleBrussels - home of beer, fries, chocolate and Google’s Public Policy Team - follow @GoogleBrussels
  2. HuaweiSeeds for the Future Programme to Bring Students from 50 countries to China for Much-Needed ICT Training
  3. EFASpain is not a democratic state. EFA expresses its solidarity to Arnaldo Otegi and EH Bildu
  4. UNICEFBoko Haram Violence in Lake Chad Region Leaves Children Displaced and Trapped
  5. HuaweiMaking Cities Smarter and Safer
  6. GoogleHow Google Makes Connections More Secure For Users
  7. EGBAThe EU Court of Justice Confirms the Application of Proportionality in Assessing Gambling Laws
  8. World VisionThe EU and Member States Must Not Use Overseas Aid for Promoting EU Interests
  9. Dialogue PlatformInterview: "There is a witch hunt against the Gulen Movement in Turkey"
  10. ACCAACCA Calls for ‘Future Looking’ Integrated Reporting Culture With IIRC and IAAER
  11. EURidNominate Your Favourite .eu or .ею Website for the .EU Web Awards 2016 Today!
  12. Dialogue PlatformAn Interview on Gulen Movement & Recent Coup Attempt in Turkey