Note from the Industry
The last five years have firmly cemented connectivity as a critical resource for citizens, societies, and economies. Large swathes of Europe’s population adopted home working during the coronavirus pandemic. This spotlighted the importance of reliable digital connectivity in everyday life, as well as for our economies to function properly.
Today, Europe’s geopolitical environment is changing rapidly. War on the continent is into its third year. Nation state threat actors and independent hacktivist groups are increasingly targeting European governments and public institutions. Narratives designed to split Europe’s populations are spread across various platforms by malign actors. Dual-use technologies are developing at pace.
In response, the European Union, NATO, and the G7 are building out their security toolboxes with the aim of making their societies and economies more resilient to external shocks. This includes investment screening in key infrastructure sectors, better coordination and preparedness against cyber-attacks, and much more. Meanwhile, political leaders are urgently discussing Europe’s security and its future as a competitive and geopolitical global actor.
With a heightened threat environment and a focus on securing critical sectors, what is the role of a telecoms sector that has not traditionally been within the scope of the defence industry?
Addressing today’s security challenges together with industry
Recent political instability has highlighted the diverse and critically important role telecoms now play across society. This ranges from enabling satellite communications to provide connectivity to those in conflict zones to securing undersea communication cables that have become targets for sabotage. Cybersecurity providers have emerged as frontline actors in hybrid warfare, and cloud services have become critical to safeguarding governance systems under threat from bombing campaigns.
Today’s security is defined by the resilience of critical infrastructure against cyber and hybrid threats, the ability to develop redundancies in communication and government systems, and robust strategies against disinformation campaigns. Unlike in earlier eras of instability, these capabilities are today largely owned and run by the private sector. Consequently, modern global dynamics have precipitated a more complex interface between the state and the private sector.
For providers of critical national infrastructure, security considerations are at the heart of operations. As such, new legislative initiatives, including the Cyber Resilience Act and NIS2, are necessary additions to both harmonise and clarify private sector responsibilities in a changing world.
Going forward, it is essential to engage the private sector early in the legislative process to harness the sector’s technical expertise to help evolve and develop policy. This will also allow the industry to plan and operate efficiently and effectively across the entire EU. New security requirements, as well as those formed in consultation with industry, must be risk-based, harmonised, and proportionate. These requirements must be coupled with incentives for investment that reflect the urgency and dynamism of the threat landscape and the shifting relationship and burden of responsibilities between the public and private sectors.
Cyber resilience needs a new cross-border approach
Cyber threats do not respect borders. Attacks are global, cutting across country boundaries. Responses need to be transnational, drawing upon a global understanding of the threat environment. That’s why many multinational companies, such as Vodafone, rely on global capability building to ensure both effectiveness and efficiency in meeting emerging threats to critical infrastructure.
But the growing trend of national reshoring, and the increasingly fragmenting security policy landscape, are undermining pan-European resilient security capabilities. To ensure compliance with security obligations, several EU Member States already require data to be localised and networks to be operated only within their countries.
When state-of-the-art facilities and skills cannot be used across borders, it leads to sub-scale solutions and reduces the ability of industry to leverage pan-EU capabilities to assist with cyber incidents or events in any single country. This is further compounded by a highly fragmented approach to cyber threat intelligence sharing despite the benefits brought by centralised platforms that enable collaboration on complex challenges across stakeholders.
Instead of erecting barriers among friends, the EU and national governments should put stock in the phrase ‘like-minded partners’ and create harmonised security frameworks. Allies should work across the bloc and with NATO and the G7, building common standards and certification methods, and taking a coordinated position on secure and resilient supply chains. There is no denying that open trade is not simple today. But in an increasingly multipolar world, European resilience will require new ways of working. Europe needs to align with trusted allies and partners, building upon shared strengths in security, innovation, and defence rather than following a path of isolationism.
Investing in Europe’s national and economic security
For the EU, the G7, and NATO, security and economic interests are increasingly intertwined. With the EU Commission’s Economic Security Strategy and accompanying proposals, for example, a security lens has been applied to trade, supply chains, and investment.
Resilience is not just about the security of critical infrastructure today. It is also about the ability to innovate, grow, and invest in the technologies and infrastructures of the future to face the challenges of tomorrow. This cannot be done without sustainable economic growth.
But Europe is facing a competitiveness challenge. Just 15 years ago, Europe’s share of global GDP topped that of the United States and was nearly five times that of China. Today, the EU’s economy is marginally smaller than China’s and 44% smaller than that of the United States.
Europe cannot exercise its desired global geopolitical role if it does not address these issues of competitiveness. The EU’s defence ambitions, for example, risk being hamstrung by limited funding. Similarly, Europe’s role as the world’s standard-setter on global trade and critical new areas such as data protection and artificial intelligence risk being undermined by the Union’s diminishing economic muscle.
To tackle current and future security challenges, new mechanisms are needed to enable private finance to drive innovation, reduce barriers to trade, and increase the ability to operate at scale.
There is an innate tension within the concept of economic security, but governments must work with industry to understand the second-order consequences of applying a security lens to new areas of policy. Economic security and broader de-risking policies do not come without obligations and resource requirements on the industry in scope. Indeed, there is a risk that poorly designed, costly security obligations and complicated compliance frameworks risk undermining industry’s ability to invest in resilience.
New fundamentals to security and resilience
Secure communications infrastructure, pan-European cyber resilience, and a comprehensive approach to economic security with like-minded partners are the essential pillars of a resilient and secure Europe today. For decades, the telecoms sector has safeguarded critical infrastructure. Today, it is at the very heart of geopolitics. As the external threat environment increases, responsibilities for security change, and the pace of technological change accelerates, it is time for a new framework of engagement between industry and governments.
