fundamental rights, freedom and democracy – the core values of the EU. Cyberspace is increasingly exploited for political and ideological purposes, and increased polarisation at international level is hindering effective multilateralism. Hybrid threats combine disinformation campaigns with cyberattacks on infrastructure, economic processes and democratic institutions, with the potential for causing physical damage, obtaining unlawful access to personal data, stealing industrial or state secrets, sowing mistrust and weakening social cohesion. These activities undermine international security and stability and the benefits that cyberspace brings for economic, social and political development. The malicious targeting of critical infrastructure is a major global risk 6. The Internet has a decentralised architecture with no central structure and a multi-stakeholder governance. It has managed to sustain exponential increases in traffic volumes while being a constant target for malicious attempts at disruption7. At the same time, there is increased reliance on the core functions of the global and open Internet, such as the Domain Name System (DNS), and essential Internet services for communications and hosting, applications and data. These services are more and more concentrated in the hands of a few private companies 8. This leaves the European economy and society vulnerable to disruptive geopolitical or technical events which affect the core of the Internet or one or more of these companies. The increased internet usage and changing patterns due to the pandemic have further exposed the fragility of supply chains that depend on this digital infrastructure. Concerns about security are a major disincentive to using online services 9. Around twofifths of EU users have experienced security-related problems and three-fifths feel unable to protect themselves against cybercrime10. One-third have received fraudulent e-mails or phone calls asking for personal details in the past three years, but 83% have never reported a cybercrime. One in eight businesses have been affected by cyberattacks11. Over half of business and consumer personal computers that have been infected with malware once are reinfected within the same year12. Hundreds of millions of records are lost each year through data breaches; the average cost of a breach to a single business rose to over €3.5 million in 6 World Economic Forum, Global Risks Report 2020. The pandemic led to a 60% increase in internet traffic according to the Organisation for Economic Cooperation and Development; https://www.oecd.org/coronavirus/policy-responses/keeping-the-internet-up-and-running-intimes-of-crisis-4017c4c9/. The Body of European Regulators for Electronic Communications and the Commission regularly publish reports on the status of internet capacity during coronavirus confinement measures. According to a report by ENISA, there was a 241% increase in total number of Distributed Denial of Service (DDoS) attacks during Q3 2019 compared with Q3 2018. DDoS attacks are increasing in intensity, with the biggest attack ever occurring in February 2020 and reaching a peak traffic of 2.3 terabits per second. In the ‘CenturyLink outage’ in August 2020, a routing problem in the US Internet Service Provider led to a 3.5% drop in global web traffic; https://www.enisa.europa.eu/publications/enisa-threat-landscape-2020-distributed-denialof-service 8 Internet Society, The Global Internet Report: Consolidation in the Internet Economy; https://www.internetsociety.org/blog/2019/02/is-the-internet-shrinking-the-global-internet-report-consolidationin-the-internet-economy-explores-this-question/ 9 https://data.europa.eu/euodp/en/data/dataset/S2249_92_2_499_ENG 10 2020 Digital Economy and Society Index; https://ec.europa.eu/digital-single-market/en/news/digitaleconomy-and-society-index-desi-2020; https://data.europa.eu/euodp/en/data/dataset/S2249_92_2_499_ENG 11 Eurostat Press release, ‘ICT security measures taken by vast majority of enterprises in the EU’, 6/2020 - 13 January 2020. ‘Cyberattacks on critical infrastructure have become the new normal across sectors such as energy, healthcare and transportation’; WEF, The Global Risks Report 2020. 12 Source: Comparitech. 7 2