End of work under the Finnish Presidency of the EU Council on the Cybersecurity Competence Centre: Member States' experts left on 16 December without any solution being found on this issue, which has been under discussion for more than a year. The focus is now on France and Germany, which have divergent positions on this issue.
As a reminder, the proposed regulation provides for the creation of a Centre for the pooling of investments in cybersecurity research, technology and industrial development, as well as financial support related to cybersecurity under the Horizon Europe and the Digital Europe programmes (see EUROPE 12095/18). It also suggests a network of centres at Member State level and a community of expertise at stakeholder level. However, despite two trilogues organised with Parliament, the text foundered at the EU Council regarding the degree of ambition of the European Centre and its role in the management of the funds.
“Alternatives” demanded by fifteen States
It is difficult to know exactly what is happening, since all expert meetings are held behind closed doors. However, at the Telecommunications Council on 3 November, the Finnish Presidency of the EU Council indicated that it faced a number of obstacles. “During expert level discussions, it became apparent that while Member States share the aims of the proposal, namely the creation of a paneuropean cybersecurity ecosystem and more comprehensive combination of funding on cybersecurity, research, innovation and capacity building, some Member States questioned the basis proposal over the most appropriate way ahead”, said Finnish Deputy Ambassador, Minna Kivimäki. According to our information, 2 weeks earlier, at a meeting of ambassadors, 15 Member States had indeed called to consider alternatives to the model proposed by the Commission (see EUROPE 12363/5, 12367/18).
Two opposing visions
Following the blockages, it is our understanding that Germany, France and Poland have circulated working documents to present their approach. Thus, Germany, supported by a majority of Member States, including Poland, would propose to separate the tasks of the Centre: on the one hand, strategic tasks would be the responsibility of the Agency for Cybersecurity (ENISA) and on the other hand, executive tasks would be delegated to joint Commission entities, such as the Innovation and Networks Agency (INEA) or the Research Executive Agency (REA). But France, for its part, would oppose a separation of the two tasks. According to one observer, the solution could therefore result from a compromise between these two opposing visions. So a Franco-German compromise.
At the Telecommunications Council, the Finnish Presidency underlined that “the most important aim now is to ensure that by the beginning of the next Multiannual Financial Framework, we have the right solution in place to meet our needs on cybersecurity”.
The next meeting of the Cybersecurity Expert Group at the EU Council is scheduled for 8 January. (Original version in French by Sophie Petitjean)