The new geopolitics of EU cybersecurity: security, economy and sovereignty

Abstract

Europe has, according to European Commission President Ursula von der Leyen, witnessed the ‘birth of a geopolitical Union’.1 This geopolitical turn in European Union law and policy-making is a response to the EU’s perception of the world as increasingly multipolar, combative and unstable. Security, broadly understood, has become something of a fixation for the EU, with the call for increased competences and funding for security and defence forming the basis of von der Leyen’s bid for a second term as Commission President.2 In particular, this would entail increased arms spending in the form of a defence industrial policy, with EU-made munitions at its centre.3 Where globalization and liberalized trade were once at the centre of EU international efforts,4 reducing dependencies for critical industries is now intentionally framed in terms of geopolitical and strategic autonomy. At the centre of these concerns is the dependency of Europe on externally produced or possessed technologies, which link European cybersecurity and the protection of its digital systems5 with its material security and national defence. Geopolitical instability, together with a growing sense of technological competition with the US and China, increasingly frame the EU’s actions to the extent that they have been referred to as fostering a ‘strategic turn’ in its policies.6 Concerns over state and non-state actors using cyber attacks in the broader context of military conflicts, online disinformation campaigns aimed at EU institutions and the role of ‘cyber’ within the ‘hybrid warfare’ toolbox, mean that cybersecurity is already an area of central importance to EU security policies.7 What is new, however, as this article will argue, is the EU’s intentional framing of EU cybersecurity policy in sovereignty terms, and the governance approach that emerges from this new framing: the EU depicts its technology sectors as being particularly vulnerable to external threats and as being essential to the EU’s viability as a project, through the merging of security and economic rationales. The resulting governance approach translates this merger of security and economic rationales into the need to transfer objects of regulation into the European physical space, or alternatively to exercise regulatory control over that which cannot be physically relocated.