While there was clear continuity of policy discourse between 1985 and the 2002 SSIS there was one significant change. Gone were the detailed, specific typologies of threats and the apportionment of specific responsibilities for addressing those threats. By removing these specifications for action the EU was codifying its new, looser, arms’-length approach to cyber security which had been developing since 2002. This new dynamic was exemplified by the Union setting itself up as a facilitative actor rather than an entity which actively secures things. In short, what differentiated the 2006 Strategy for a Secure Information
Society from its 1996 and 2001 predecessors was the manner in which the EU sought to
achieve its goals. Instead of specifying solutions and expecting interested parties to implement them, the EU advocated a softer, less prescriptive method.
The SSIS included a three-pronged approach to NIS issues (European Commission, 2006a, p. 3). The second and third prongs have their origins in the proposal of 2001; a regulatory framework sought to ensure a competitive market within the EU and combatting cyber- crime was prioritised. At first glance this approach may seem similar to previous policies. However, on closer examination it is the first prong, the “specific NIS measures”, which provides the greatest contrast between EU policy in 2001 and 2006. The 2006 approach was characterised by a shift towards greater inclusiveness on the part of all entities with a vested interest in cyber security. This can be seen in the language used to describe these measures. In 2006 stakeholders such as Member States, the private sector and the research community would be “invited” to enter into strategic partnerships (European Commission, 2006a, p. 8). The private sector was also “invited to disseminate good security practice within its community to establish baseline levels for security and business continuity (resilience)” (European Commission, 2006a, p. 9). These invitations are a stark contrast with the more definitive language of the 2001 NIS Proposal. There it was stated that operators should secure networks “as they are required to do under Directive 97/66 EC [on
balance between network protection and the advantages of open access “must be achieved” (European Commission, 2001a, p. 12). By 2006 there had been a softening of tone and language to develop an environment of encouragement and partnership.
To achieve these goals the Commission called upon ENISA, in its role as an advice broker, to provide the focal point in various efforts. These included promoting co-ordination and serving as a centre for co-operation, as well as facilitating information-sharing and the exchange of best practice (European Commission, 2006a, p. 6). One method employed by ENISA to encourage such co-operation was the organisation of the Cyber Europe and Cyber Atlantic international exercises (European Commission, 2009a, p. 9) examined in the Section 7.2.2 of this chapter.
What the actions of ENISA and the EU’s policy framework at this time demonstrate is that the wider goal in this period of cyber security policy development had altered. The goal by 2006 was not to establish, identify and publicise specific EU definitions of terms and challenges, nor was it to prescribe specific courses of action. Instead, the aim was to foster an international culture of network and information security (Robinson, 2012, p. 165; European Commission, 2006a, p. 4). In this culture all stakeholders would be involved, and NIS seen as a virtue and commercial opportunity. It is not by accident that the 2006 Strategy was subtitled “Dialogue, Partnership and Empowerment”. The tone of the SSIS is one of ensuring not only that all actors fulfil their responsibilities, but also that those actors are given support and resources – that they are empowered (European Commission, 2006a, p. 6,10). Through such measures as establishing ENISA and the HTCC at Europol, the EU had positioned itself as a facilitator of that dialogue, partnership, and empowerment, rather than a prescriptive taskmaster. Core ideas were consolidated, but the approach had shifted.
What makes the SSIS stand out as a milestone in the linear policy-making process, therefore, is not simply that it was the first formally accepted policy document in this field. It stands out because it was different from its predecessors yet maintained the continuity of a policy discourse based on five core ideas. As a policy document it established a new paradigm of EU involvement in cyber security, one where direct action is minimised and the EU’s function as a facilitative actor is emphasised. These differences are more than simple updates of policy to take into account new and emerging challenges or developments in the field since 2001. They are differences in approach resulting in a shift away from a heavy-handed, proactive approach towards a more reserved one recognising the roles of the various stakeholders involved (European Commission, 2006a, p. 6). What
is significant is that this shift in dynamic occurred without any change in the policy’s ideational foundations. Cyber security policy was still focussed on ensuring economic viability, promoting trust, protecting fundamental rights, tackling cyber-crime and promoting co-operation.
The EU’s co-operative zeal was not restricted to facilitating joint-working between Member States and external actors, however. In 2002, there was a recognition that better co-operation was needed between the three Pillars of the EU’s policy-making architecture. There was a particular focus on promoting joint-working between the Pillars of Justice and Home Affairs – which focused on criminal justice matters – and the Communities Pillar which managed the Single Market (Council of The European Union, 2002c, p. 2). In a meeting of the Council of the European Union’s Committee on Telecommunications in January 2002, it was acknowledged that better communication and co-ordination between the two Pillars was required to reduce the likelihood of duplication of efforts in cyber security. This was a particular issue given the prevalence of threats which were both criminal acts and which affected the resilience of the Single Market (Council of The European Union, 2002c, p. 3). The attempt to mitigate such a risk of duplication was one of the defining characteristics of the years between 2007 and 2013, the final phase of policy development. Even in 2002 it was recognised that more needed to be done to ensure adequate pooling of resources where issues arose that crossed Pillar boundaries, such as cyber security. This particular set of Council Conclusions is also noteworthy for including the first mention of the term “cyber security” in Union acquis (Council of The European Union, 2002c, p. 2). From this point the term begins to be used more frequently to refer to the totality of security risks to and from cyberspace, although it does not enter common policy jargon for some years.
7.4. Conclusion
Chapter 6 showed that the years up to 2001 were defined by the initiation of important path dependencies in the EU’s cyber security policy-making process. Chapter 7 has shown that years between 2002 and 2006 were characterised by institutional stasis and a bedding-in of those policy paths. These paths were a focus on economic maximisation, the protection of rights, tackling cyber-crime to build trust in the digital sphere and achieving these through facilitating co-operation. The chapter also showed that this final element developed beyond a simple policy goal to become a defining feature of the EU’s role in tackling cyber security issues.
The period between 2002 and 2006 was marked not only by policy consolidation but also by important developments. From an institutionalist perspective, the years following the publication of the Commission’s NIS Proposal, with its direct prescriptions for specific action such as firewalls and anti-virus software, would logically be a period of entrenchment of these policy ideas. Paradoxically however, the 2002-2006 phase was characterised by a stepping back of direct Union action in this field and the adoption of a more distant, arms’-length approach to the same security challenges. The acquis published between 2002 and 2006 pointed less to a desire to proactively engage in solution-building, than to position the Union as a facilitative actor. Its role in this period became that of an advice broker, ensuring information and best practice regarding national and private sector solutions were shared, rather than setting out, prescribing and promoting those solutions. Although cyber security would remain an important aspect of the functioning of the internal market, the manner in which the EU achieves this, and the role it plays in doing so, has evolved from its beginnings in 1985. That role was to promote co-operation between interested parties and during this period the EU positioned itself as a facilitator of that co- operation.
The chapter also demonstrated that to do this two dedicated agencies were established: the High-Tech Crime Centre at Europol and the European Network and Information Security Agency. The role for both of these agencies was to support Member States and international liaisons by providing fora for sharing information relating to cyber security issues. Through publishing advice on best practice and carrying out major international simulations of cyber incidents, ENISA has established itself as an important hub in European cyber security generally.
This trend of brokering advice and co-ordinating co-operation was exemplified in the
Strategy for a Secure Information Society, published in 2006. This Strategy was an
important step in the incremental process of cyber security policy-making for two reasons. Not only did it continue policy paths established between 1985 and 2001, bedding these into the policy discourse, but it also codified a new arms’-length approach to cyber security. Gone were detailed definitions of cyber security threats and solutions to those threats. The SSIS advocated empowering and supporting entities to fulfil their own responsibilities and codified the role of the EU in facilitating that co-operation.
The SSIS therefore represented a change in the manner of the EU’s approach to cyber security and formalised its facilitative role. It also represented ideational continuity. This
continuity demonstrated the inertia of paths laid down in the earliest period of policy development, 1985-2001, highlighting the linearity of the EU’s cyber security policy. That linearity and inertia would be subject to severe stresses in subsequent years. The influence of those stresses is the subject of the following chapters.