The EU Introduces A New Sanctions Framework In Response To Cyber-Attack Threats

In a previous client alert, we highlighted a recent U.S. sanctions regime aimed at deterring threats of election interference¹, which further expanded the U.S. menu of cyber-related sanctions.² Across the Atlantic, as a step forward that demonstrates its voiced determination to enhance the EU's cyber defense capabilities³, on May 17, 2019, the EU established a sanctions framework for targeted restrictive measures to deter and respond to cyber-attacks that constitute an external threat to the EU or its Member States.⁴ The new framework is expounded in two documents, Council Decision (CFSP) 2019/797 and Council Regulation 2019/796.

The newly-introduced framework is significant for two reasons. First, the framework enables the EU to implement unilateral cyber sanctions, a move that expands the EU's sanctions toolkit beyond traditional areas of sanctions, such as sanctions imposed due to terrorism and international relations-based grounds.⁵ Second, it represents a major,