EU unveils plan to revamp cyber security rules

The European Union unveiled plans on Wednesday to revamp the 27-nation bloc's dated cyber security rules, just days after data on a new coronavirus vaccine was unlawfully accessed in a hack attack on the European Medicines Agency.

The EU recorded around 450 cyber incidents involving European infrastructure, notably in the financial and energy sectors last year, and the pandemic has highlighted Europe's deep dependence on the internet and exposed security weaknesses.

The EU's current Network Information System regulations date from 2008, and the European Commission's new proposals aim to bring them up to date and allow the EU to impose hefty fines on operators who break the rules.

"The time of innocence is over. We know that we are a target," European Commission Vice-President Margaritis Schinas told reporters. "We need to modernize, reinforce, and adapt."

The plans include an "EU-wide Cyber Shield" linking national security authorities that would use Artificial Intelligence and machine learning to detect early signs of attacks, a cyber unit to respond to incidents and threat and beefing up cooperation between member countries and organizations like NATO.

The new strategy would focus on essential infrastructure like electricity grids, heating systems, gas and hydrogen plants as well as air, rail, water and road links.

Financial market and health infrastructure would also be among the priorities.

The EU also wants to beef up its cyber-sanctions system, with a proposal for countries to agree sanctions by qualified majority voting rather than unanimity.

The Europeans imposed sanctions on people and organizations linked to Russia, China and North Korea this year.

The new plans must now be debated by member countries and the European Parliament and are likely to change substantially.

Once agreed, the 27 nations would have 18 months to adopt and start applying the rules nationally.

(Image credit: AP)