1. Cyber War

Cyber war, or hybrid forms of it, is usually a state-sponsored form of action against another state carried out via electronic networks. It includes warfare against another state‘s military, public, and private sectors, as well as the civilian population. Until now below the threshold of formally declared warfare, cyber aggressions are likely to be used with greater intensity and accuracy in the future, opening the door for “think the unthinkable” types of scenarios in the years to come. Due to the anonymity of the internet, the attribution of cyber-attacks is complicated, and perpetrators often remain unidentified. Typical tools of cyber war include botnets and worms such as Stuxnet, a computer worm first discovered in July 2010, and deemed a joint Israeli/US effort to disrupt Iran‘s nuclear program.^{Footnote 13} A less intrusive, but just as dangerously efficient, way of harming other states and players is electronic disinformation and propaganda. Yet, what is new is the increasingly systematic use of cyberspace by states to pursue national foreign and security policy objectives. Cyber-attacks are getting more sophisticated and more aggressive, targeting critical infrastructures to potentially disrupt states.

2. Cyber Espionage

Cyber espionage concerns breaches in the databases of public authorities and state or non-state enterprises by foreign governments to gather information such as trade secrets and strategically important corporate knowledge. In December 2018, the US and the UK accused hackers linked to the Chinese Ministry of State Security of obtaining unauthorized access to the computers of at least forty-five entities, including commercial and defense technology companies and US government agencies such as NASA and the US Navy.^{Footnote 14}

3. Cyber Terrorism and Cyber Vandalism

Cyberterrorism is the use of cyberspace to commit terrorist acts such as hacking into a system to cause a nuclear plant to melt.^{Footnote 15} Below the threshold of cyber terrorism, cyber vandalism has no specific objective or target. It is carried out “more for the thrill than anything else.”^{Footnote 16}

4. Cybercrime

Cybercrime, such as phishing,^{Footnote 17} online fraud, and online forgery, involves offenses against property rights, including intellectual property, launched by non-state actors. It is a threat to everybody. “Cybercrime as a service” is becoming a widely used practice. Facilitated by the dark net, hacking can be ordered and purchased as easily as a taxi. Cybercrime is growing very fast and has dramatic economic costs. As a percentage of global GDP, cybercrime cost the global economy 0.8 percent of GDP in 2016, up from 0.62 percent in 2014.^{Footnote 18} Globally, it will cost businesses over five trillion US dollars per year by 2024.^{Footnote 19} Cyber-attacks can massively affect the business community. The most affected sectors are banking and utilities—with 18.37 and 17.84 million US dollars on average annual cost of cybercrime for each organization in the industry in 2018.^{Footnote 20} Cyber-attacks can also ruin the reputation of companies building their business model on private data or, like financial institutions, on confidence and trust.

The financial sector is of particular attractiveness for cyber criminals seeking illicit financial gains.^{Footnote 21} In 2016, customers of financial services suffered sixty-five percent more cyber-attacks than customers of any other industry.^{Footnote 22} In July 2014, JP Morgan Chase was the victim of a hack that comprised the accounts of seventy-six million households and seven million small businesses.^{Footnote 23} In February 2016, eighty-one million dollars were stolen from an account of the central bank of Bangladesh via the SWIFT network.^{Footnote 24} In November 2016, around 2.5 million pounds were stolen from around 9000 customers of Tesco Bank.^{Footnote 25} In May 2019, hackers stole more than 7,000 bitcoin from crypto exchange Binance, the world‘s largest by volume.^{Footnote 26}

1. Manifold Forms of Cybersecurity

Cybersecurity comes in very different forms. Strengthening cyber resilience across different sectors, therefore, requires a variety of measures that must cover many different content elements. At the level of individual businesses, an effective cybersecurity framework addresses the prevention and detection of, the response to, and the recovery from a cyber-attack. It contains provisions on governance, such as risk assessment and management, regular system testing—for example, via simulated cyber-attacks—internal control mechanisms, and continuity planning, as well as provisions on independent review, incident reporting, and third party risks—altogether, essential elements of an effective cybersecurity framework.

2. Importance of the Human Element

Cybersecurity is not only about technology. Often, businesses and institutions are overly focused on technological security and software, but they neglect company culture, people, and processes. The human element, however, is still the weakest link when it comes to cybersecurity.^{Footnote 35} Vulnerabilities are introduced both in terms of what we regularly do, for example, opening e-mails or clicking on links, as well as what we fail to do, for example, updating systems or maintaining backups.^{Footnote 36} Effective cybersecurity regulation recognizes the importance of education and places emphasis on management and staff training, continuous learning, and risk-awareness-raising.^{Footnote 37}

3. Rapidly Changing Risk Landscape

Cyber risk is dynamic and evolves quickly. Technological advances enable cyber criminals to continuously develop and apply new methods to attack and compromise information and communication technology (ICT) systems.^{Footnote 38} Defense mechanisms must keep up with these developments. Effective cybersecurity regulation, therefore, obliges organizations to continuously update their cybersecurity arrangements. At the same time, it does not impose too many or too detailed requirements but leaves space for flexible and individual solutions, thereby promoting agility and adaptability.^{Footnote 39} In the absence of a one-size-fits-all solution to the challenges ahead, organizations must be able to put in place and maintain technologies, mechanisms, and procedures that are specifically tailored to their individual needs, systems, employees, and risk profiles.^{Footnote 40} Flexibility also enables institutions to balance proportionality and costs as key drivers of any cybersecurity arrangements to be adopted. Considering the rapidly changing nature of cyber risks, overly specific technical requirements also risk being obsolete faster than they can be repealed and replaced by the regulator. Eventually, a certain degree of regulatory flexibility would facilitate the development of innovative cybersecurity solutions, enabling organizations to always stay one step ahead of cyber-criminals.

4. Importance of Cooperation and Information Sharing

In order to best anticipate and respond in a consistent manner to cyber-attacks, a multidisciplinary approach and information sharing are required.^{Footnote 41} There is a need to shift from building static capabilities to more proactive detection of threats. The challenge will be to detect cyber threats in advance and to isolate them in the system to best understand their functioning and potential impact before reacting. This requires the full collaboration of the different sectors of society, including the private sector, particularly with regard to critical infrastructures.^{Footnote 42} Cooperation and information sharing within the private sector, between the private and the public sector, and at the public level are of particular importance. At best, such mechanisms are established on a cross-sectoral and cross-border basis to avoid a “siloed approach.” Types of information to be shared include, but are not limited to, cyber-incidents, new cyber threats, vulnerabilities in software, hardware or processes, mitigation methods, best practices, and strategic analysis.^{Footnote 43}

1. Interconnections and Interdependencies in the Financial Sector

More than many other industries, the financial sector and its systems are highly interconnected and interdependent.^{Footnote 44} As a result, a cyber-attack can spread very quickly among financial system participants. What is more, the financial sector is only as cybersecure as its weakest link. The failure of one participant, a “single point of failure,” can easily affect and impede the services provided by other participants. Due to the interconnectedness of the sector, a small-volume participant or a business providing non-critical financial services may be as risky as a major participant or a critical financial services provider.^{Footnote 45} Effective cybersecurity regulation, therefore, covers all actors of a particular sector, and it is not limited to the largest or most relevant financial institutions or sub-sectors.^{Footnote 46} It also covers more general services that are relevant to the financial sector, such as electricity provision.

2. Broad Range of Entry Points and Third Party Participants

The financial system is a complex network of participants from different environments and shared technologies. It is not only comprised of financial institutions, but also third-party service providers—for example, cloud-service providers—with whom financial institutions work. With regard to these cloud-service providers, only a limited number of big players dominate the market. This leads to concentration risks.^{Footnote 47} Moreover, financial institutions increasingly rely on information systems in the provision of financial services and their day-to-day operations.^{Footnote 48} Services are increasingly instant and globally available. Due to progress made in cloud computing, the Internet of Things, and 5G-technologies, the number of devices, networks, and interfaces used in the daily business of a financial institution has increased significantly. This results in a broad range of entry points for possible cyber-attacks, both at the technological level and at the level of participants.

Against this background, effective cybersecurity regulation needs to cover new technologies as well as third-party cyber risks. In the context of the latter, it must set out the conditions according to which financial institutions may enter into outsourcing agreements with third-party service providers and the requirements concerning the management and monitoring of the according risks. It must also provide for the possibility of supervisory access to a financial institution‘s third-party service providers. This onsite access can be obtained either directly in the applicable law or by requiring the financial institution to include this right in outsourcing contracts. Direct supervision of third-parties must also be considered.

3. Importance of the Precautionary Principle

Due to the rapidly changing nature of cyber risks and the uncertainties about future technical developments and threat scenarios, cybersecurity regulation must put particular emphasis on risk prevention. In this context, the precautionary principle is of particular importance. The European Commission and the European Court of Justice consider the precautionary principle to be a general legal principle of EU law.^{Footnote 49} In the context of financial stability and cybersecurity, the precautionary principle requires government action already when there is a risk to the stability of the financial system. The mere possibility of damage is enough; a concrete probability is not required. In this situation, and considering the principle of proportionality, governments must adopt procedural instruments, such as notification requirements about cyber-incidents, in order to generate information. Should these instruments be insufficient to mitigate the risk, measures that are more intrusive must be considered.^{Footnote 50}

1. Comprehensive State Responsibility

The first level is defined by a comprehensive state responsibility (Erfüllungsverantwortung) that ensures the public good by public administration and state authorities acting based on the classical command and control legislation.

2. Collaborative Approach

The second level is defined by a collaborative approach between the public sector and private actors based on a public responsibility with regard to objectives and results. For this kind of cooperation between the public and the private sector, German administrative law theory coined the terms of “Gewährleistungsverantwortung” and “Gewährleistungsverwaltungsrecht” defining an essential element of regulatory law.^{Footnote 56} Their function is to safeguard the public good by framing the “procedure” of decision-making that is primarily based on private expertise, collaborative action, and organization. In this context, the dynamic adaptation of legal demands on technical developments and the need for opportunities to review and/or revise decisions made under conditions of uncertainty are key elements of the legal framing that has to ensure that the state finally delivers on the public good.

3. Umbrella Responsibility

The third level of public responsibility is a kind of umbrella, and it entitles state authorities to intervene as soon as the collaborative approach leads to shortcomings in delivering on the public good (Auffangverantwortung).

The three levels of public responsibility do not define a hierarchical order but rather different ways and tools through which the legislator can deliver on a public good, such as the stability of the financial system, by avoiding the shortcomings and disadvantages of command and control legislation in complex policy fields. With regard to the protection against cyber threats, the responsibility for the stability of the financial system is assumed in close cooperation between the Member States and the EU (Daseinsvorsorgeverbund), and in collaboration with the private sector.^{Footnote 57}

1. General Overview

Provisions on cybersecurity in the financial sector take very different forms and differ considerably in legal nature and effect. While some instruments impose mandatory requirements, others provide voluntary guidance or combine both.

At the national level, provisions of both legally binding and non-binding nature exist. According to the 2017 FSB survey, all FSB member jurisdictions have publicly released regulations or guidance that address cybersecurity for at least parts of the financial sector.^{Footnote 67} In jurisdictions where no specific cybersecurity regulation for the financial sector is in place, supervisors encourage financial institutions to implement international standards and guidance.^{Footnote 68}

At the international level, private self-regulatory entities, networks of specialized administrative bodies, and international organizations have developed cybersecurity standards of various forms and legal quality to help improve cybersecurity in the financial sector. Contributing to the risk management of financial institutions, they establish common security requirements and capabilities needed for secure solutions.^{Footnote 69} These standards play a predominant role with regard to the different types of provisions constituting the legal framework for cybersecurity in the financial sector.

2. Standards

The phenomenon of private self-regulatory entities, informal networks of specialized administrative bodies, and international organizations creating standards is widespread in areas where highly technical and rapidly evolving matters are involved—such as the regulation of financial markets^{Footnote 70}—especially with regard to cybersecurity. Far from being a new phenomenon, stemming from the beginnings of globalization and, therefore, much older than European integration, it is one of the most popular examples for new international and European governance structures.

1. EU Cybersecurity Regulation and the Principle of Conferral, Article 5(2) TEU

Under the principle of conferral, the Union shall only act within the limits of the competences conferred upon it by the Member States in the Treaties, and in order to attain the objectives set out therein.

European cybersecurity legislation has already been based on several legal bases in the Treaties.^{Footnote 104} These include the internal market (Article 114 TFEU); the right of establishment and the freedom of services (Articles 62, 53(1) TFEU); the smooth operation of payment systems (fourth ident of Articles 127(2), 132(1) TFEU); and the area of freedom, security, and justice (Article 83(1) TFEU). With regard to coordination at the EU level, a more general legal basis is provided for in Article 74 TFEU.^{Footnote 105}

Cyber policy, especially in the context of the protection of critical infrastructures and the guarantee of financial stability, has a security dimension. The Member States, however, are traditionally reluctant to share competences in this regard.^{Footnote 106} Indeed, Article 4(2) TEU points out that the EU shall respect the “essential State functions, including … maintaining law and order and safeguarding national security. In particular, national security remains the sole responsibility of each Member State.” Does this preclude any EU action in the field of cybersecurity?

There are strong arguments that this is not the case. Article 4(2) TEU refers only to “national security,” meaning that it does not preclude measures referring to “Schengen security,” defined by cross-border effects of internal security.^{Footnote 107} With cyberspace and cyber aggressions being borderless, there is good reason to assume that cybersecurity is not to be regarded as a purely internal security matter but must rather be assigned to “Schengen security.” This applies a fortiori in the context of guaranteeing financial stability, which itself has a cross-border dimension. Moreover, cybersecurity can be attributed to the area of freedom, security, and justice (Article 67 TFEU), which Art 4(2)(j) TFEU lists as a “shared competence between the Union and the Member States.”^{Footnote 108}

What is more, the creation of a Digital Single Market for (financial) services (Art. 114 TFEU), including the establishment of a robust and resilient Banking and Capital Markets Union, is a core task of the EU, which can only be realized in a cybersecure digital environment. Cybersecurity is a conditio sine qua non for the future development of the Digital Single Market. EU competences in these areas, therefore, go hand in hand with EU competences in the field of cybersecurity in its European dimension.

2. EU Cybersecurity Regulation and the Principle of Subsidiarity, Article 5(3) TEU

In areas that do not fall within the exclusive competence of the Union, the principle of subsidiarity must be observed. This also applies to the area of cybersecurity. Union action in this field must, therefore, pass the subsidiary test. In order to pass this test, it is first necessary that the objectives of the proposed action cannot be sufficiently achieved by the Member States (“necessity” criterion), and second, that the action can more successfully be undertaken at the Union level (“added value” criterion). Although compliance must be assessed on a case-by-case basis, some general observations can be made.

Due to the transnational nature of cyber threats and the cross-border interdependencies between network and information systems, unilateral approaches to cybersecurity at Member State level are often inefficient. Diverging national regulatory requirements on cybersecurity in the financial sector also prevent the establishment of a level playing field among financial institutions in the EU and risk leaving legislative loopholes. Finally, in the absence of harmonization, financial institutions with cross-border operations risk having to comply with different regulatory standards in different Member States concerning the same aspect of cybersecurity (together: “necessity” criterion). An EU-wide approach establishing minimum requirements on cybersecurity could, at least to some extent, answer these problems (“added value” criterion). There is thus still sufficient leeway for future European legislation from a principle of subsidiarity point of view.

1. Regulation of Systemically Important Payment Systems (SIPS)

Payment systems facilitate the clearing, settlement, and recording of payments, thereby contributing to maintaining and promoting financial stability and economic growth.^{Footnote 109} As financial markets infrastructures, however, they also concentrate risk.^{Footnote 110} If not properly managed, they can become a source of financial shocks or a major channel through which these shocks are transmitted across domestic and international financial markets.^{Footnote 111}

The oversight of payment systems is an essential function of central banks. In the euro area, it is carried out by Eurosystem (Article 127(2) TFEU and Article 3.1 of the Statute of the ESCB and of the ECB). The Eurosystem has set out its oversight objectives in specific oversight schemes.

2. Regulation of Credit Institutions

The current regulatory landscape for credit institutions is more complicated. While the NIS Directive, the cyber-incident reporting framework of the ECB, and certain provisions of PSD2 and MiFID II make explicit reference to cybersecurity, other instruments only address cybersecurity on the edge or concern the management of the overall operational risk of a credit institution.

1. Network and Information Security

2. Cybercrime: European Cybercrime Centre (EC3)

The European Cybercrime Centre (EC3) at Europol provides important operational support and training to the Member States and has become the first hub for expertise on cybercrime operations. In this regard, the EC3 is a victim of its own success. Given the importance and recognition it has gained since its creation in 2013, it is already understaffed and needs to see significant enforcement of resources.^{Footnote 173}

3. Cyber Defense: European Defence Agency (EDA) and EU Military Staff

The role of the EU in cyber defense is largely limited to an advisory function, leaving the operational and strategic realities of defense to the Member States.^{Footnote 174} The European Defence Agency (EDA) supports the capability development in cyber defense in the Member States and encourages greater cooperation in this field. The EU Military Staff brings cyber expertise to military strategic planning in the Common Security and Defence Policy (CSDP) military operations and missions.^{Footnote 175}

4. Assessment of the Governance Structures

The EU‘s current approach to cybersecurity is siloed within various institutions, actors, and initiatives, and it is characterized by a lack of clearly delineated areas of responsibility.^{Footnote 176} There are coordination problems between and within these silos. Certain capabilities and mandates are duplicates. Interaction between the different cyber-communities proves difficult for technical, legal, and cultural reasons. This puts major limitations to the fight against cyber-attacks because it cannot be solved by looking only at the contaminated devices, as the CERT community would, but can only be fully understood by observing the big picture, as only police and law enforcement can.

At the Member State level, CERT structures diverge significantly in form and function.^{Footnote 177} The NIS Directive has changed little in this regard because it only provides for minimum harmonization and has a limited scope of application. Different levels of cyber maturity and preparedness are another hurdle to the fight against cyber-attacks. Not only is it difficult to achieve smooth cooperation between the different cyber-communities, but even at the level of a specific community, like the CERT community, it proves delicate to enforce cross-border exchange and cooperation among different national structures.

Until the establishment of the CSIRTs network and the Cooperation Group, cooperation among governmental CERTs took place only in the European Government CERTs group (EGC group), an informal association of governmental CERTs in Europe composed only of the authorities of the most capable states,^{Footnote 178} and the Central European Cyber Security Platform (CECSP).^{Footnote 179} In the past, both groups were reluctant when it came to widening their circle. The very functioning of everyday life and business is at stake here, and cyber threats do not know a geographical dimension. States, therefore, trusted and wanted to open up to systems that are only as safe as their own; at the same time, however, it is also the reason why cross-border cooperation is indispensable.

It is at least questionable whether the CSIRTs network and the Cooperation Group will change things up in this regard because the underlying problems—notably, heterogeneity in the level of maturity—remain largely the same, and cooperation within the new structures is still voluntary to a large extent.

1. Substantive Provisions

2. Supervisory Structure

At the supervisory level, current structures would remain largely unchanged. In particular, all European and national supervisors currently responsible for the financial supervision of a certain subsector or parts of it would continue to supervise that subsector, including oversight of cybersecurity requirements. They would, however, apply the new Cybersecurity Rulebook. As opposed to a conceivable “single cybersecurity supervisor” for the entire financial sector, sector supervisors have specific knowledge of the particularities of their area and the entities they supervise. But they might not all be cybersecurity experts. In their daily supervision, they would, therefore, be advised and supported by both European and national cybersecurity competence centers to be composed of experts and staff with a dedicated IT background and an in-depth knowledge of cybersecurity. Regarding their institutional structure, the competence centers could be set-up within existing organizations with a similar focus, like ENISA or EU and governmental CERTs, or as an independent organization.

1. Within the Private Sector

Within the private sector, cooperation and information sharing is currently voluntary. There are limited incentives to reveal cyber-incidents or related information to other firms. Apart from competition concerns, many firms do not have the trust of all other players and will be reluctant to share sensitive information.^{Footnote 198} Legal constraints, such as confidentiality, banking secrecy, and data protection, further inhibit information sharing. In order to encourage cooperation and information sharing—and having recourse to the concept of “Auffangverantwortung”^{Footnote 199}—regulators could provide a legal framework that guarantees the confidentiality of firm-specific information, for example, through the anonymization or aggregation of information shared. Such measures would also reduce concerns of increasing insurance premiums or adverse effects on an institution‘s reputation or competitive position. Exemptions from contractual, tort, and regulatory liability regimes, such as the one stemming from the GDPR, could be discussed as well. Finally, a European Cybersecurity Platform with different sub-platforms could be set up to allow smaller groups of firms to share information based on mutual trust freely. This will need to be a gradual process. State intervention and mandatory information sharing within the private sector should be considered only if the voluntary collaborative approach led to obvious shortcomings.

2. Between the Private Sector and Public Authorities

Private institutions and public authorities exchange information through several mandatory incident notification schemes and cooperate on a voluntary basis in public-private partnerships and networks such as the ECRB and the European FI-ISAC. While private firms typically know more than outsiders about the architecture of their systems and its potential weaknesses, the government, via their intelligence services, typically knows more than private firms about cyber threats stemming from foreign governments.^{Footnote 200} Looking ahead, there needs to be a mind-shift to move beyond incident reporting towards also sharing ex ante operational, tactical, and strategical threat intelligence.^{Footnote 201} Such a mind-shift could be realized through the creation of a European Cybersecurity Platform.

3. At the Public Level

At the public level, organizations like ENISA, the EGC group, the CECSP, or the CSIRTs network and the Cooperation Group have a mandate to facilitate cross-border and cross-sectoral cooperation and information sharing among national and European authorities. Information to be shared should include cyber-incidents and operational, tactical, and strategical threat intelligence. One major obstacle to information sharing at the public level is, however, that the Member States often consider these kinds of information confidential and do not want to share it for national security reasons. In order to enhance Europe‘s position as a world leader in the digital economy and to create a Digital Single Market for financial services and goods, they must open up in this regard eventually.

Finally, the reporting of cyber-incidents affecting civil society and individuals must be facilitated in order to have sufficient awareness of the cybersecurity landscape in Europe and of the emergence of new vulnerabilities and threats. Member States should be encouraged to establish national helpdesks, for example, a national cybersecurity officer.

1. Rationale

As a starting point, an efficient response to cyber-attacks requires the development of strategic capabilities at the EU level, such as expertise, information checking and analysis, and scenario and threat assessment. At the operational level, this would allow to close information gaps of national law enforcement authorities, providing them with the necessary information to tackle threats and prevent attacks. On this basis, a wide range of operational responsibilities, from incident response and investigation support to coordination and frontline operations, could be developed at Member States level by public authorities and in close cooperation with private actors.

The idea is thus to task a body, which is not intended to replace but to support the relevant actors in the Member States and at the European level. For instance, support would mean providing a hub to share information and expertise between national cybersecurity services across all Member States, and compiling “overall assessments” on cyber threats and changing modus operandi of cyber-attacks from a European perspective. The National Cyber Security Centre in the United Kingdom (NCSC UK) or the Nationaal Cyber Security Centrum in the Netherlands (NCSC NL) could serve as an example in this regard.

At the European level, this task could be implemented by a European Cybersecurity Platform. Such a platform could merge information deriving from the relevant actors active in all three areas of cybersecurity in order to depict a “European picture of cybersecurity.” On this basis, it could provide a platform to jointly elaborate holistic responses to all kind of cyber-attacks within the EU. Such an independent strategic analysis and assessment of collectively shared information may contribute to creating a joint European perception of threats and challenges in the field of cybersecurity and provide common situational awareness among national authorities and the private sector.

Member States and private actors are far more likely to seek bilateral cooperation with like-minded actors. For this reason, it is highly important to establish a constant platform where different ideas on how to counter cyber-attacks can be discussed with the aim of defining common approaches to cybersecurity. In this context, the European Cybersecurity Platform‘s analysis and strategic reports may deliver the necessary evidence for a constructive discussion. Functioning as a type of intermediary between the relevant actors, the Platform would rapidly gain experience in synchronizing preventive and repressive policies and guaranteeing that authorities complement each other instead of operating in parallel.

2. Operational Tasks

At the operational level, the European Cybersecurity Platform could make sure that national law enforcement authorities are provided with joint operational expertise. Based on the information provided, national authorities could adapt their investigative strategies as well as their preventive measures and could increase the effectiveness of their work. In this regard, Joint Investigation Teams could provide a ready-made framework for cooperation between national law enforcement authorities to implement operational measures.

The task of “connecting the dots” could be fulfilled gradually. As a first step and absolute precondition, the European Cybersecurity Platform would have to receive information held by EU actors as well as public and private actors at the national level. Such information would have then to be evaluated by the Platform in order to issue preventive “overall assessments” of cyber threats within the EU and to provide national authorities with realistic appraisals of situational developments and strategic recommendations. Additionally, the Platform would have to provide a framework for pooling this information among national authorities and EU bodies and could potentially accompany the implementation of the information it generated on the ground.

Privacy and competition-related concerns in the context of information exchange could be alleviated, at least to some extent, through the distribution of summary or aggregated data. Article 83(1) EMIR,^{Footnote 203} according to which “no confidential information … shall be divulged to any person or authority, except in summary or aggregate form,” could serve as an example in this regard.^{Footnote 204}

3. Organizational Structure

The Platform would be composed of the head of ENISA, the head of the EU Intelligence and Situation Centre (INTCEN), a high representative from the Commission—for example a European Cybersecurity Coordinator working under the authority of its President or the Commissioner for the Security Union—^{Footnote 205} a representative of the CSIRTs network and the Cooperation Group and the representatives of different communities—like the financial sector—organized in specific sub-platforms.

It would be assisted by a small secretariat, composed of staff seconded from the relevant services of the Member States, from the Commission, and from the participating agencies. The Platform would meet once a month and issue monthly reports on connecting the dots that would bring together intelligence and operational expertise and knowledge.

At a certain point, however, the Platform could become too limited in its capacity and could make judicial and parliamentary review more difficult, which is of relevance particularly in a context where fundamental rights are at stake. Therefore, it is of utmost importance to guarantee efficient forms of accountability and judicial review. For that reason, in due course, the Platform could evolve into an independent body, such as an agency.