EU Ministers Assess Cyber Priorities Amid Ukraine War

Representatives from all 27 EU member states, joined by Norway and Switzerland, are in attendance. The original focus of the event pivoted in the wake of Russia’s invasion of Ukraine, organizers said.

“We’re having a meeting of the 27 EU digital ministers and every single one of us, every single one has basically said this is a paradigm change,” said Luukas Ilves, Estonia’s chief information officer, who is attending the event. “The basic logic of how things are now done is going to have to change.”

Estonia, which houses the North Atlantic Treaty Organization’s Cooperative Cyber Defence Centre of Excellence, has positioned itself as a global leader in the digitization and modernization of government infrastructure over the last two decades.

One thing Mr. Ilves said he plans to discuss in Paris is the idea that both the public and private sector in Europe should put 10% or more of their information-technology budgets into security.

“The situation in the East has changed the risk profile,” said Manfred Boudreaux-Dehmer, CIO of NATO.

Mr. Boudreaux-Dehmer became NATO’s first CIO in September 2021, responsible for handling digital transformation and cybersecurity for the 72-year-old organization. He said he has been bolstering the organization’s cyber defenses in light of an increased threat due to the situation in Ukraine.

Mr. Ilves said EU digital ministers in Paris share a similar view on what is to come. “One way or another, Ukraine is going to win this war in the strategic sense. The question is about how deep those losses will be before we get there,” he said. At that point, the conversation will then turn to what can be done in the years and months following to build the country back up.

The atmosphere at the Paris event is filled with the sense that cybersecurity is a solvable challenge, according to Mr. Ilves. “I hesitate to use the word optimism,” he said, but there is “a sense that we can do it.”

In the lead-up to its military invasion, Russia began a campaign to destabilize Ukraine with a series of cyberattacks, Ukrainian officials have said. Since the start of the shooting war, bad actors in cyberspace haven’t notably expanded their activity beyond Ukraine. “I don’t make the assumption that that’s going to continue,” Mr. Ilves said.

Doug Saylors, co-leader, ISG Cybersecurity, a unit of technology research and advisory firm Information Services Group Inc., said the cybersecurity threat from Russia will likely get worse before it gets better.

Mr. Ilves also said CIOs and digital ministers will be able to speak to a much more politically receptive audience in the wake of the conflict. Political cost, disruption to the status quo and short-term opposition have been in the way of governments investing in digital transformation in the past, he said, and that is less the case now.

Estonia’s own digital transformation began over two decades ago after the tiny country came out of the Soviet Union. Mr. Ilves said there was a strategic realization that if the country of 1.3 million people was going to be successful it had to choose innovations over status quo and become integrated with the rest of the world through networking.

Initiatives such as its e-citizenship program, which provides every citizen with a secure digital identity, have garnered attention world-wide. 

“Being small and being reminded from time to time that there is an alternative to your being an independent successful country right across the border has a sobering and chastening effect,” Mr. Ilves said. “Estonians probably have been ringing the alarm bell about Russia for a decade and a half.”

The threat of Russian invasion didn’t drive Estonia’s digital transformation, Mr. Ilves said, but it has positioned it well in case of conflict.

For example, Estonia set up an experimental “data embassy” in Luxembourg to house all government information in case a natural disaster or military invasion destroyed the country’s physical data centers. Mr. Ilves said the events of the last few weeks validate the business case for the experiment.

“You can’t be ambitious about digital transformation without being ambitious about security because otherwise you undercut your own goals. The main difference is that that’s now obvious to everyone,” Mr. Ilves said.

Write to Isabelle Bousquette at [email protected]