EU Council president proposes ‘European cyber force’ with ‘offensive capabilities’

Charles Michel, the president of the European Council — the EU body that sets the bloc’s political direction — proposed on Thursday the creation of “a European cyber force … equipped with offensive capabilities.”

“The sensitive issue of chain of command would need to be addressed,” he acknowledged at the annual conference for the European Defence Agency (EDA). The Council President’s spokesperson was unable to immediately provide any further details on the proposal.

In the wake of the Russian invasion of Ukraine, and citing the bloc’s efforts to respond to it by increasing its investment in defense, Michel said: “I feel that the time has come to create a real union of defence, coupled with a true defence single market.”

It is not the first time that a joint military capability has been raised by a European Union official, but the concept has never borne fruit. Experts have cautioned there are additional unique challenges around developing offensive capabilities in the cyber domain.

Although Michel told the conference that “for almost 20 years, you, the EDA, have spearheaded European defence cooperation,” defense cooperation across the continent has in truth largely been conducted through NATO, outside of the auspices of the European Union.

The EDA — an agency to promote defense integration across the European Union — reports directly to the European Council and does not preside over any armed forces itself; these remain under the sovereign control of each member state.

Since 2017 — particularly following Brexit, with the United Kingdom historically opposed to the concept of European military integration, and amid concerns regarding former President Donald Trump’s commitments to NATO — the EU’s security and defense policy has moved forward with a Permanent Structured Cooperation (PESCO) plan that aims to create structural integration among EU militaries.

Last year, the EDA received a 15% budget increase in the wake of the Russian invasion of Ukraine, bringing it to a total figure of €43.5 million (about $45 million). In comparison, NATO’s civil budget in the same period was €370 million.

In his single mention of the military alliance at the EDA conference, Michel acknowledged that NATO “remains the foundation” of “global and transatlantic security.”

At the same time as the budget increase, EU defense ministers signed off on the bloc’s new program for a military computer emergency response team operation network — but they did not agree to advance Europe-wide offensive capabilities that had been mooted by some aspects of the bloc, as raised again by Michel on Thursday.

Last year, the European Commission, in its Joint Communication with the High Representative for Foreign Affairs and Security Policy, stated: “The EU needs to take on more responsibility for its own security. This requires modern and interoperable European armed forces.

“Member States must … commit to increase investments in full-spectrum cyber defense capabilities, including active defense capabilities. Whilst remaining fully committed to international law and norms in cyberspace, the EU should signal its willingness to use these capabilities in a coordinated way in case of a cyberattack on a Member State.”

Thierry Breton, the French commissioner for the Internal Market, told journalists: “You have to be able to pre-empt, you have to be able to plan, you have to be able to defend yourself, to protect yourself, but you also have to be able to attack.”

It was an explicit interpretation of the phrase “active defense” normally favored by Brussels by the French politician, and was in-line with France’s historic support of the idea of a European Army composed of the bloc’s strongest militaries.

Germany in contrast has favored a more inclusive apparatus that brings in all EU member states, while the United Kingdom — when it was a member state — strongly opposed both ideas in favor of a greater focus on NATO for defense matters.

Clarifying his statement to journalists, Breton said: “Of course, we need to be credible … It’s not in our hands [the Commission’s]. [Member states] are the ones to act in this field, of course. But the question is that some of them want to be more coordinated.”

The nature of this coordination, both inside the European Union and in NATO, is a matter of political and practical debate. During NATO’s first annual Cyber Defence Conference held in Berlin in November, a number of allies endorsed the creation of a “NATO Cyber Centre.”

However the exact remit of such a body — whether it would exist to develop cyber competencies among allies, or to create a shared situational awareness for the security collective of what is happening in cyberspace, or even if it would be a tactical-level command for combined operations — was unclear.