New EU Cyber Direct research paper: Defining ‘active defence’ in cyberspace
The 2022 Joint Communication on an EU Policy on Cyber Defence calls on member states to invest in ‘active defence capabilities’, but the term is never defined. So what do member states actually mean by it?
In this study, Dr Andrea Calderaro and Marius Houwen (EU Cyber Direct, European Union Institute for Security Studies) map all 27 EU member states through their published strategies, doctrines and statutes. The study asks whether and how each state approaches active cyber defence, which authority is responsible for it, under which legal framework it operates, and what the state has said about the international law that governs it.
Key findings:
- There is no shortage of definitions of active cyber defence: there are many, each authoritative in its own setting, and no commonly shared approach among them.
- States readily publish who acts and what they call it, but rarely where, when, against whom or to what effect. Any EU instrument that asks about ‘active defence capabilities’ will collect agencies and vocabularies, not concepts, unless it asks the operational questions by name.
- Member states agree on more than their definitions suggest. Every published position accepts that international law applies, and what differs is legal architecture rather than vocabulary.
The study argues that the EU does not need harmonised capability postures. It needs a small set of shared reference points: a minimum disclosure set, a shared vocabulary annex, and standing declarations by each member state of the legal basis and permissible targets of any operations beyond its own networks.
Read the executive summary here.
Read the full paper here.
