Several European sources have confirmed the development of a penalty regime applicable to malicious cyber activities to EUROPE.
"The relevant working groups of the Council of the European Union are currently considering a penalty regime to respond to and deter malicious cyber activities. We are making very good progress in defining the new regime at EU level", a source from the Romanian Presidency of the Council of the European Union told EUROPE, adding that the objective was to have this regime adopted under this presidency.
"There have been several substantive discussions in cyber working groups [on February 8, Editor's note],where there is overall political agreement on the principle and general characteristics of the future regime", a diplomat told EUROPE.
This regime could cover activities involving the theft of funds through an information system, data theft or a significant breach of data protection through an information system, or cyber activities affecting the information system related to critical infrastructure, essential government services or classified information.
While the main political elements have been agreed, they must now be translated into legal acts. The European External Action Service was therefore asked to present a first draft of a legal act. This regime should initially take the form of an empty legal framework.
But the work looks complex, as the framework must be legally sound and precise. In fact, according to a European source, prejudicial attempts would also be included in the scope, not just successful cyber attacks, and this raises many questions, including how to measure the potential damage that the cyber attack could have caused.
According to the diplomat, "there will be a review of the proposal in a Relex working group within three weeks". "The discussions are expected to take several weeks", he added.
In conclusions adopted on 18 October 2018, the European Council asked ministers to "work towards the development of a regime for penalties specific to cyber attacks" (see EUROPE 12120). (Original version in French by Camille-Cerise Gessant)