L 239/54 EN Official Journal of the European Union 19.9.2017 Europol/EC3: The European Cybercrime Centre (EC3) set up in 2013 within Europol supports the law enforcement response to cybercrime in the EU. EC3 offers operational and analytical support to Member States' investigations and serves as the central hub for criminal information and intelligence supporting operations and investigations by Member States with operational analysis, coordination and expertise as well as highly specialised technical and digital forensic support capabilities. CERT-EU: the Computer Emergency Response Team of the EU Institutions, Bodies and Agencies has a mandate to improve the protection of the EU institutions, bodies and agencies against cyber threats. It is a member of the CSIRTs network. CERT-EU has technical agreements on sharing information about cyber threats with NATO CIRC, some third countries and major commercial actors in the field of cybersecurity. The EU Intelligence Community comprises the EU Intelligence Analysis Centre (INTCEN) and EU Military Staff (EUMS) Intelligence Directorate (EUMS INT) under the SIAC arrangement of the Single Intelligence Analysis Capacity (SIAC). SIAC mission is to provide intelligence analyses, early warning and situational awareness to the High Representative of the European Union for Foreign Affairs and Security Policy and to the European External Action Service (EEAS). SIAC offers its services to the various EU decision making bodies in the fields of the Common Foreign and Security Policy (CFSP), the Common Security and Defence Policy (CSDP) and counterterrorism (CT), as well as to the Member States. EU INTCEN and EUMS INT are not operational agencies and do not have any collection capability. The operational level of intelligence is the Member States' responsibility. SIAC only deals with strategic analysis. EU Hybrid Fusion Cell: The Joint Communication on Countering Hybrid Threats of April 2016 designates the EU Hybrid Fusion Cell (EU HFC) as the focal point for all source analysis on hybrid threats in the EU: its mandate was approved in December 2016 by the Commission through an inter-services consultation. Based in the INTCEN, the EU Hybrid Fusion Cell is part of the SIAC and hence works jointly with the EUMS INT and has a permanent military member assigned. Hybrid refers to the deliberate use by a State or non-State actor of a combination of multiple covert/overt, military/ci­ vilian tools and levers, such as cyber-attacks, disinformation campaigns, espionage, economic pressure, use of proxy forces or other subversive activity. The EU HFC works with an extensive network of points of contact (PoCs), both within the Commission and Member States to provide the integrated response/whole of government approach required to counter diverse challenges. EU Sitroom: The EU Situation Room is part of the EU Intelligence and Situation Centre (EU INTCEN) and provides the EEAS with operational capacity to ensure an immediate and effective response to crises. It is a permanent civilian-mi­ litary stand-by body that provides worldwide monitoring and situational awareness with a 24/7 capacity. Relevant instruments Framework for a Joint EU Diplomatic Response to Malicious Cyber Activities: The Framework, agreed in June 2017, is part of the EU's approach to cyber diplomacy, which contributes to conflict prevention, the mitigation of cybersecurity threats and greater stability in international relations. The framework makes full use of measures within the Common Foreign and Security Policy, including, if necessary, restrictive measures. The use of the measures within the Framework should encourage cooperation, facilitate mitigation of immediate and long-term threats and influence the behaviour of the responsible perpetrator and potential aggressors in the long term. 2. CYBERSECURITY CRISIS COORDINATION IN THE IPCR ARRANGEMENTS — HORIZONTAL COORDINATION LAYER AND POLITICAL ESCALATION The IPCR arrangements can be (and have been) used to address technical and operational issues, but always from a politi­ cal/strategic angle. In terms of escalation, the IPCR can be used according to the level of the crisis by moving from ‘monitoring mode’, to ‘information-sharing mode’ which is the first level of IPCR activation, and ‘IPCR full activation’. Activation in full mode is a decision of a rotating Presidency of the Council of the EU. The Commission, EEAS and GSC can activate the IPCR in information-sharing mode. Monitoring and information-sharing trigger different levels of