Combatting Cyberwarfare Crimes In The European Union Presented by: Prof. Dr. Šepec Date: 12 June 2024 Cyberwarfare Crimes - Definition - using computer technologies to disrupt or destroy an adversary's information systems and networks, which amount to an armed attack Criminal Law of the European Union - Is there a European criminal law in the sense that the EU acts as a sovereign state, formulates criminal acts, carries out criminal prosecution and sanctions perpetrators of criminal acts? - We could speak of European criminal law, when the EU protects its financial interests through legislation that is enforced on its members. - There is no comprehensive, self-contained European criminal law or justice system on its own, but more of an umbrella-like system that connects different entities, organs and EU legislations with the goal to investigate and prosecute transnational crimes. Cyberwarfare Crimes in the EU - Treaty of Lisbon-2009, gave the European Union a legal basis for the adoption of criminal law directives in order to ensure the effective implementation of European Union policies. - Directive EU 2013/40/EU on attacks against information systems - The main objective is to approximate the criminal law of the Member States in the area of attacks against information systems by establishing minimum rules concerning the definition of criminal offences and relevant sanctions. Furthermore, the Directive aims to improve cooperation between competent authorities. - Substantive criminal measures: • Illegal access to information systems (Article 3) • Illegal system interference (Article 4) • Illegal data interference (Article 5) • Illegal interception (Article 6) • Tools used for committing offences (Article 7) Directive EU 2013/40/EU On Attacks Against Information Systems - The goal of the Directive was always combatting ordinary cyber offences committed by ordinary perpetrators or hackers, and not cyberwarfare attacks committed by a foreign military or hacker organization backed by foreign state - This is evident by the fact that in 2013 when the Directive was adopted, cyberwarfare attacks on Member States was clearly not a major concern. EU Institutions for Combatting Cyberwarfare Crimes in the EU - European Union has numerous institutions for international cooperation in criminal matters. - The most relevant are: Europol, Eurojust, The Court of Justice of the European Union (CJEU), European Anti-Fraud Office - OLAF and The European Public Prosecutor's Office (EPPO). - OLAF deals mainly with financial frauds against the interests of the EU and plays no role in combatting cyberwarfare crimes - The European Public Prosecutor's Office (EPPO) has the power to investigate, prosecute and bring to judgment crimes against the EU budget, such as fraud, corruption or serious cross-border VAT fraud, but again has practically no jurisdiction on cyberwarfare crimes. - CJEU's main tasks is to interpret the EU legislation. In this regard it can interpret the Directive EU 2013/40/EU on attacks against information systems and other directives that provide cybersecurity protection. However, the CJEU cannot conduct a criminal trial or pass judgement against perpetrators of cyberwarfare attacks and offences. European Union Agency for Law Enforcement (Europol) - European Union's most important agency for police cooperation. - Does not have executive powers; it cannot arrest people or conduct investigations on its own. Eurojust - Eurojust is the European Union Agency for Criminal Justice Cooperation. - Eurojust was established out of need for a centrally coordinating cross-border prosecution of the most serious crimes in the EU - Main tasks is the initiation of criminal investigations and prosecutions, coordinating investigations and prosecutions in the Member States, and strengthening judicial cooperation of Member States. - Eurojust lacks any real formal investigative powers, as the decision to investigate or prosecute a crime in a Member State falls to the national authorities. European Network and Information Security Agency (ENISA) - The agency is tasked with enhancing cybersecurity across Europe. - ENISA works to improve cybersecurity capability, awareness, and cooperation among EU member states, as well as with private sector organizations and international partners. - The main functions of ENISA: • Advisory role (it provides expert advice and guidance to EU institutions, member states, and private sector stakeholders on cybersecurity issues); • Capacity building role (enhancing the cybersecurity capabilities of EU member states and organizations, organizing training programs, workshops, and exercises to improve cybersecurity skills, knowledge, and best practices) • Risk assessment and management in order to mitigate cybersecurity risks at both national and EU levels (this also helps in identifying vulnerabilities and threats and developing appropriate risk management strategies) • Incident response support to cybersecurity incidents and crises; • Promoting the development and implementation of cybersecurity standards and certification schemes that helps in harmonizing cybersecurity practices and ensuring a common level of security; • Research of cybersecurity technologies, methodologies, and solutions • Awareness raising about cybersecurity threats, risks, and best practices. Conclusion - Although Europe has mechanisms in place to combat and prevent cyberwarfare crimes, the legal situation is still far from ideal. - The main problem remains the lack of clear legal definition of cyberwarfare crimes and no focused legislation in regard to criminal prosecution of such crimes. - Cyberwarfare attacks therefore remain in the domain of classical cyber attacks, which have a much smaller scope and meaning than cyberwarfare attacks. - It is therefore up to the Member States to implement stricter legislation for cyberwarfare offences, or up to the EU to present new legislation that would be more adept to legally combatting cyberwarfare attacks. - If the EU wishes to develop a system of joint military defense, a legislation that will provide further protection of Member States against cyberwarfare attacks would be a viable option in the future.