European Union: Cyberattacks decisions and sanctions

On several occasions, the European Union and its Member States have expressed their concern about and denounced the acts of cyber-malware.

Such acts are unacceptable because they undermine international security and stability as well as the advantages offered by the internet and the use of information and communication technologies (ICT).

The EU is resolutely in favor of a global, open, stable, peaceful and secure global cyberspace where human rights and fundamental freedoms as well as the rule of law are fully applied, in the service of acceleration social, political and economic development.

In order to better prevent, discourage, prevent and counter these acts of cybermalveillance, the Council decided to apply restrictive measures against six people and three entities or bodies involved in cyber attacks with significant effects, or attempted cyber attacks with significant potential effects, which constitute an external threat to the European Union or its Member States, or which have significant effects on third countries or international organizations.


The measures concerned consist of a ban on entering EU territory and an asset freeze with regard to natural persons and an asset freeze with regard to entities or bodies. It is also prohibited to directly or indirectly make funds available to the persons, entities or bodies appearing on the list.

These measures reflect the continued commitment of the European Union and its Member States to protect the integrity, security, social well-being and prosperity of free and democratic societies, as well as the rules-based order and the proper functioning of the international organizations that represent it.

The EU continues to strengthen cooperation to advance international security and stability in cyberspace, increase resilience globally and raise awareness of cyber threats and cyberthreats.

The European Union and its Member States will continue to strongly encourage responsible behavior in cyberspace and call on all countries to cooperate in favor of international peace and stability, to exercise due diligence, to take appropriate measures against perpetrators of cyber-malware, to continue to contribute to the implementation of the existing consensus based on the 2010, 2013 and 2015 reports of the United Nations Group of Governmental Experts (UNGGE) to review the progress of the and telecommunications in the context of international security, approved by the United Nations General Assembly, and to strengthen cooperation in order to consolidate this consensus in the context of the current sixth UNGGE and the open-ended working group as well as other relevant international fora.

The Republic of North Macedonia, Montenegro and Albania [1], candidate countries, Bosnia and Herzegovina, country of the stabilization and association process and potential candidate, and Iceland and Norway, countries of EFTA members of the European Economic Area, as well as Ukraine and Georgia align themselves with this declaration.

[1] The Republic of North Macedonia, Montenegro and Albania continue to participate in the stabilization and association process.



The Council decided to impose restrictive measures against six persons and three entities responsible for or having participated in various cyber attacks. These include the attempted cyberattack against the OPCW (Organization for the Prohibition of Chemical Weapons) and those known as “WannaCry”, “NotPetya” and “Operation Cloud Hopper”.

The sanctions imposed include a ban on entering EU territory and an asset freeze. In addition, EU persons and entities are prohibited from making funds available to listed persons and entities.

Sanctions are one of the options available in the EU's cyberdiplomatic toolkit to prevent, deter and counter cybercrime directed at the EU or its Member States, and it is today. This is the first time the EU has used this tool. The legal framework for restrictive measures against cyber attacks was adopted in May 2019 and recently extended.


Over the past few years, the EU has strengthened its resilience and capacity to prevent, deter, prevent and counter cyber threats and cyber attacks in order to safeguard European security and interests.

In June 2017, the EU stepped up its action by establishing a framework for a joint EU diplomatic response to cyber attacks (the 'cyberdiplomatic toolkit'). This framework allows the EU and its Member States to use all measures under the CFSP, including, where necessary, restrictive measures, to prevent, discourage, prevent and counter acts of cyber-surveillance threatening integrity and the security of the EU and its Member States.

Targeted restrictive measures have a deterrent effect and should be distinguished from attribution of responsibility to a third State.

The EU remains committed to a global, open, stable, peaceful and secure cyberspace and therefore recalls the need to strengthen international cooperation in order to promote a rules-based order in this area.

Council Decision on Restrictive Measures against Cyber Attacks

Virginie Gastine Menou

“Personalized support on the complex road to compliance”

Share the article on the networks!

Articles recent:

IMF: Fiscal Monitor

Budget action to fight the COVID-19 pandemic
A roadmap for the budgetary measures to be taken during the different phases of the pandemic
Public investments for the recovery

en_USEnglish fr_FRFrançais es_ESEspañol