The European Union Cybersecurity Policy: Operationalization of the Resilience Concept

The unique nature of cyberspace, characterized by interdependence between material and social objects as well as the complexity of its structures, urges leading actors of world politics to seek new strategies of organizing their activities within this area. In the European Union, cybersecurity issues are debated on the basis of the resilience category. In this context the latter is understood as a system’s ability to adjust to new challenges, flexibly respond to threats, and successfully recover after blows. Using a discourse analysis approach the authors examine the genesis of the resilience discourse and the logic of its development in the EU cybersecurity policy, reveal nuances of how this category is interpreted in official documents as well as point out difficulties regarding practical application of this category.

The authors trace a gradual evolution of the EU approach towards cybersecurity from the well-established definitions of cyberspace to the ecosystem terms and concepts, which are particularly relevant to the resilience-based concept of cybersecurity. Within this approach, the Internet is considered not as a static object but as a complex heterogeneous system where a state of security is inextricably linked to a state of insecurity.

There is no single and coherent definition of resilience in the EU official documents yet. Nevertheless, it is stressed that one can see a gradual transformation of the official discourse from purely technical definitions to inclusion of a wider range of socio-political factors. However, the EU official discourse on this issue remains highly controversial. This refers, for instance, to the lack of a unified understanding of the ‘cyberresilience’ and ‘cybersecurity’ concepts. The authors highlight a tendency towards increasing securitization of the cybersphere in the EU cybersecurity discourse, which might lead to the narrowing of the concept of ‘cyberresilience’ and its transformation into a common euphemism. At the same time the authors conclude that the EU itself is not interested in oversecuritization of the cybersphere, and thus the EU cybersecurity policy will eventually evolve towards resilience-based approaches.

1. Gudalov N., Tulupov D. 2018. Semiotika stressoustoichivosti v mezhdunarodnyh otnosheniyah: mnogoobrazie akademicheskih i politicheskih smyslov [Semiotics of resilience in international relations: The diversity of academic and political meanings]. Politiya, vol. 1, no. 88, pp. 135–147. DOI: 10.30570/2078-50892018-88-1-135-147. (In Russ.)

2. Zvorykina Y.V., Zemledeltsev S.V. 2014. O podkhodakh k obespecheniyu kiberbezopasnosti v ES [EU cyber security approaches]. Protivodeystvie terrorizmu. Problemy XXI veka — Counter-terrorism, no. 1, pp. 38–42. (In Russ.)

3. Katsy D.V., Shmatkova L.P. 2018. Kiberbezopasnost i razvitie tsifrovoi ekonomiki v Evropeiskom soyuze [Cybersecurity and development of the digital economy in the European Union]. Evraziiskii yuridicheskii zhurnal, no. 3, vol. 118, pp. 343–345. (In Russ.)

4. Pantin V.I., Kardaeva N.V. 2018. Kiberbezopasnost: problemy formirovaniya edinoi politiki v Evropeiskom soyuze [Cybersecurity: Challenges for building the EU common cybersecurity policy]. Vestnik Permskogo universiteta. Politologiya, no. 3, pp. 5–18. DOI: 10.17072/2218-1067-2018-3-5-18. (In Russ.)

5. Romanova T.A. 2017. Kategoriya ‘stressoustoichivost’ v Evropeiskom soyuze [Resilience category in the European Union]. Sovremennaya Evropa, vol. 4, no. 76, pp. 17–28. (In Russ.)

6. Shafeev K.A. 2018. Pravovoe regulirovanie otvetstvennosti za kiberprestupleniya v prave Evropeiskogo soyuza [Responsibility for cybercrime in the EU law]. In Rozhkova M.A. (ed.). Pravo v sfere interneta [Internet law]. Moscow, Statut Publ., pp. 7–26. (In Russ.)

7. Aradau C. 2017. The promise of security. Resilience, surprise and epistemic politics. In Chandler D., Coaffee J. (eds.). The Routledge handbook of international resilience. London, Routledge, pp. 79–91.

8. Barrinha A., Renard T. 2017. Cyber-diplomacy: The making of an international society in the digital age. Global Affairs, vol. 3, no. 4–5, pp. 353–364.

9. Bendiek A., Bossong R., Schulze M. 2017. The EU’s revised cybersecurity strategy: Half-hearted progress on far-reaching challenges. Stiftung Wissenschaft und Politik -SWP- Deutsches Institut f ür Internationale Politik und Sicherheit, vol. 47. Available at: http://nbn-resolving.de/urn:nbn:de:0168-ssoar-55103-4 (accessed: 28.11.2018).

10. Bourbeau P. 2013. Resiliencism: Premises and promises in securitisation research. Resilience. International Policies, Practices and Discourse, vol. 1, no. 1, pp. 3–17. DOI: 10.1080/21693293.2013.765738.

11. Bourbeau P. 2015. Resilience and international politics: Premises, debates, agenda. International Studies Review, vol. 17, no. 3, pp. 374–395. DOI: 10.1111/misr.12226.

12. Bourbeau P. 2017. Resilience, security, and world politics. In Chandler D., Coaffee J. (eds.). The Routledge handbook of international resilience. London, Routledge, pp. 26–37.

13. Brassett J., Vaughan-Williams N. 2015. Security and the performative politics of resilience: Critical infrastructure protection and humanitarian emergency preparedness. Security dialogue, vol. 46, no. 1, pp. 32–50. DOI: 10.1177/0967010614555943.

14. Buzan B., Wæver O., Wilde J. 1998. Security: A new framework for analysis. London, Boulder, Lynne Rienner Publishers.

15. Carrapico H., Barrinha A. 2018. European Union cyber security as an emerging research and policy field. European Politics and Society, vol. 19, no. 3, pp. 299–303. DOI: 10.1080/23745118.2018.1430712.

16. Chandler D., Coaffee J. 2017. Introduction. Contested paradigms of international resilience. In Chandler D., Coaffee J. (eds.). The Routledge handbook of international resilience. London, Routledge, pp. 3–9.

17. Christou G. 2018. The challenges of cybercrime governance in the European Union. European Politics and Society, vol. 19, no. 3, pp. 355–375. DOI: 10.1080/23745118.2018.1430722.

18. Christou G. 2016. Cybersecurity in the European Union: Resilience and adaptability in governance policy. Houndmills, Basingstoke, Palgrave Macmillan.

19. Christou G. 2017. The EU’s approach to cybersecurity. EU-Japan security cooperation: Challenges and opportunities. University of Essex. Online paper series. Available at: https://pdfs.semanticscholar.org/24d4/4e449c490610bd3f341b28765dc8da1e2db6.pdf (accessed: 28.11.2018).

20. Coaffee J., Fussey P. 2017. The politics of security-driven resilience. In Chandler D., Coaffee J. (eds.). The Routledge handbook of international resilience. London, Routledge, pp. 293–306.

21. Dovers S.R., Handmer J.W. 1992. Uncertainty, sustainability and change. Global Environmental Change, vol. 2, no. 4, pp. 262–276. DOI: 10.1016/09593780(92)90044-8.

22. Dunn Cavelty M. 2018. Europe’s cyber-power. European Politics and Society, vol. 19, no. 3, pp. 304–320. DOI: 10.1080/23745118.2018.1430718.

23. Dunn Cavelty M. 2015. The normalization of cyber-international relations. In Thränert O., Zapfe M. (eds.). Strategic trends. Key developments in global affairs. Center for Security Studies, ETH Zurich, pp. 81–98.

24. Dunn Cavelty M. 2013. A resilient Europe for an open, safe and secure cyberspace. Occasional Papers, Swedish Institute of International Affairs, vol. 23, pp. 3–13.

25. Dunn Cavelty M., Kaufmann M., Kristensen K.S. 2015. Resilience and (in)security: Practices, subjects, temporalities. Security Dialogue, vol. 46, no. 1, pp. 3–14. DOI: 10.1177/0967010614559637.

26. Evans B., Reid J. 2013. Dangerously exposed: The life and death of the resilient subject. Resilience, vol. 1, no. 2, pp. 83–98. DOI: 10.1080/21693293.2013.770703.

27. Farrand B. 2018. Combatting physical threats posed via digital means: The European Commission’s developing approach to the sale of counterfeit goods on the Internet. European Politics and Society, vol. 19, no. 3, pp. 338–354. DOI: 10.1080/23745118.2018.1430721.

28. Herrington L., Aldrich R. 2013. The future of cyber-resilience in an age of global complexity. Politics, vol. 33, no. 4, pp. 299–310. DOI: 10.1111/14679256.12035.

29. Holling C.S. 1973. Resilience and stability of ecological systems. Annual Review of Ecology and Systematics, vol. 4, no. 1, pp. 1–23. DOI: 10.1146/annurev.es.04.110173.000245.

30. Kaufmann M. 2015. Resilience governance and ecosystemic space: A critical perspective on the EU approach to Internet security. Environment and Planning D: Society and Space, vol. 33, no. 3, pp. 512–527. DOI: 10.1177/0263775815594309.

31. Manjikian M. 2010. From global village to virtual battlespace: The colonizing of the Internet and the extension of Realpolitik. International Studies Quarterly, no. 54, pp. 381–401. DOI: 10.1111/j.1468-2478.2010.00592.

32. Milliano C., Jurriens J. 2016. Realities of resilience in practice: Lessons learnt through a pilot EU Aid Volunteer Initiative. Resilience, vol. 4, no. 3, pp. 79–94. DOI 10.1080/21693293.2015.1094171.

33. Renard T. 2018. EU cyber partnerships: Assessing the EU strategic partnerships with third countries in the cyber domain. European Politics and Society, vol. 19, no. 3, pp. 321–337. DOI: 10.1080/23745118.2018.1430720.

34. Rothe D. 2017. Climate change and security: From paradigmatic resilience to resilience multiple. In Chandler D., Coaffee J. (eds.). The Routledge handbook of international resilience. London, Routledge, pp. 171–184.

35. Zebrowski C., Sage D. 2016. Resilience and critical infrastructure: Origins, theories and critiques. In Dover R., Huw D., Goodman MS. (eds.). The Palgrave handbook of security, risk and intelligence. London, Palgrave MacMillan, pp. 117–135.