New EU Cyber Direct research paper: Defining ‘active defence’ in cyberspace
The EU’s 2022 Communication calls on member states to invest in “active defence capabilities”, but the term is never defined. So what do member states actually mean by it?
In this study, Dr Andrea Calderaro and Marius Houwen (EU Cyber Direct, European Union Institute for Security Studies, EUISS) map all 27 EU member states to understand whether and how they approach active cyber defence, which authority is responsible for it, under which legal framework it operates, and what states have said about the international law that governs it. The analysis draws on their published strategies, doctrines and statutes.
Key findings:
- We do not lack a definition of active cyber defence, but we have many, each authoritative in its own setting. The result is the absence of a commonly shared and consistent approach.
- Member states approach active cyber defence on their own terms, both in how they define it and in where they place it institutionally.
- Member states agree on more than their differences over definitions and institutional placement suggest. Every published position accepts that international law applies, and what differs is legal architecture rather than vocabulary.
The paper argues that the EU does not need harmonised capability postures. It needs a small set of shared reference points: a minimum disclosure set, a shared vocabulary annex, and standing declarations by each member state of the legal basis and permissible targets of any operations beyond its own networks.
Read the executive summary here.
Read the full paper here.
