The Impact Of Brexit On British Cyber Security

The United Kingdom and the European Union have finally delivered a Brexit deal, but what does this man for cyber security in the UK? 
 
Analysts have begun to dig in to the detail of the newly published trade deal that will govern commercial relationships between the two sovereign entities after the 31st of December and amongst the tortured legal language, the overall aim is to promote cooperation on cyber security while ensuring the autonomy of the  European Union and the United Kingdom's decision-making processes.
 
On page 363 of the Agreement there is a section TITLE II: CYBER SECURITY  Article CYB.1: Dialogue on cyber issues where the text reads as: ‘The Parties shall endeavour to establish a regular dialogue in order to exchange information about relevant policy developments, including in relation to international security, security of emerging technologies, internet governance, cybersecurity, cyber defence and cyber crime. 
 
1. Where in their mutual interest, the Parties shall cooperate in the field of cyber issues by sharing best practices and through cooperative practical actions aimed at promoting and protecting an open, free, stable, peaceful and secure cyberspace based on the application of existing international law and norms for responsible State behaviour and regional cyber confidence-building measures. 
 
2. The Parties shall also endeavour to cooperate in relevant international bodies and forums, and endeavour to strengthen global cyber resilience and enhance the ability of third countries to fight cyber crime effectively. 
Cooperation with the EU Computer Emergency Response Team
 
The EU and the national UK computer emergency response team shall cooperate on a voluntary, timely and reciprocal basis to exchange information on tools and methods, such as techniques, tactics, procedures and best practices, and on general threats and vulnerabilities. 
 
The relevant national authorities of the United Kingdom may participate at the invitation, which the United Kingdom may also request, of the Chair of the Cooperation Group in consultation with the Commission, in the following activities of the Cooperation Group: 
 
  • Exchanging best practices in building capacity to ensure the security of network and information systems; 
  • Exchanging information with regard to exercises relating to the security of network and information systems; 
  • Exchanging information, experiences and best practices on risks and incidents; 
  • Exchanging information and best practices on awareness-raising, education programmes and training; and 
  • Exchanging information and best practices on research and development relating to the security of network and information systems. 
Any exchange of information, experiences or best practices between the Cooperation Group and the relevant national authorities of the UK will be voluntary and, where appropriate, reciprocal. 
 
1. With a view to promoting cooperation on cyber security while ensuring the autonomy of the Union decision-making process, the United Kingdom may participate at the invitation, which the United Kingdom may also request, of the Management Board of the EU Cybersecurity Agency (ENISA), in the following activities carried out by ENISA: 
  • Capacity building; 
  • Knowledge and information
  • Awareness raising and education. 
2. The conditions for the participation of the United Kingdom in ENISA’s activities referred to in paragraph 1, including an appropriate financial contribution, shall be set out in working arrangements adopted by the Management Board of ENISA subject to prior approval by the Commission and agreed with the United Kingdom. 
 
3. The exchange of information, experiences and best practices between ENISA and the United Kingdom shall be voluntary and, where appropriate, reciprocal.’
 
In summary, cybersecurity issues were unlikely to be severely affected unlike other more contentious data sharing on criminal datasets, for instance. This proves to be the case. So there appears to be limited immediate impact on cyber security from this deal. However, it is likely to limit anything fruitful for the UK in the years to come, and it will depend on evolving legislation in the two jurisdictions on whether voluntary participation will continue (especially on things like the NIS Directive). 
 
The UK as a lone jurisdiction that will find itself increasingly steered by the EU’s movements on cyber security and global conditions rather than being at a larger table. 
 
This means that although little will change in the short to medium term - apart from detailed sharing of data, which could impact immediate threats - as cyber security is rapidly evolving, national influence in cyber security will be increasingly limited and will force the UK into equivalence if it wishes to compete in some areas.
 
At the hardest end of the spectrum of cyber threats, cooperation between national intelligence agencies will not be directly affected by Brexit. GCHQ will continue to play its role, including through its extensive network of international partnerships. The UK will still wield significant influence.
 
Overall, however, the picture is mixed. There are ways to mitigate the disruption to the excellent cooperation on cyber security built up with European Partners over recent years, but it will require imagination and  effort and there is an important industrial and commercial dimension, around digital standard setting, that shouldn’t be overlooked, even as we work though issues of quotas, tariffs and rules of origin.
 
AC Dwyer:            European Union:           UK In A Changing Europe:
 
You Might Also Read:
 
Britain's New Regime For Online Platforms:
 
« How to Close the Global Cybersecurity Skills Gap: Two Easy Steps
Cyber Security In 2021 - Predictions & Trends »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 8,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

ShmooCon

ShmooCon

ShmooCon is an annual east coast hacker convention offering three days of demonstrations and discussions of critical infosec issues.

Copper Horse Solutions

Copper Horse Solutions

Copper Horse specialises in mobile and IoT security, engineering solutions throughout the product lifecycle from requirements to product security investigations.

Indium Software

Indium Software

Indium Software is an Independent Software Testing Company offering software testing services (including security testing) and offshore Quality Assurance solutions.

US Cyber Command (USCYBERCOM)

US Cyber Command (USCYBERCOM)

USCYBERCOM conducts activities to ensure US/Allied freedom of action in cyberspace and deny the same to our adversaries.

AllegisCyber Capital

AllegisCyber Capital

AllegisCyber is an investment company with a focus on seed and early stage investing in cybersecurity and its applications in emerging technology markets.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Risk Based Security (RBS)

Risk Based Security (RBS)

Risk Based Security provide the most comprehensive and timely vulnerability intelligence, breach data and risk ratings.

Cybersecurity Collaboration Forum

Cybersecurity Collaboration Forum

The mission of the Cybersecurity Collaboration Forum is to foster information security communication and idea sharing across the C-Suite, enabling leaders to better protect their enterprises.

Crypto Valley Association

Crypto Valley Association

Crypto Valley Association is an independent, government-supported association established to build the world’s leading blockchain and cryptographic technologies ecosystem.

Hexaware Technologies

Hexaware Technologies

Hexaware is an automation-led next-generation service provider delivering excellence in IT, BPO and Consulting services.

Udacity

Udacity

Udacity's mission is to train the world’s workforce in the careers of the future. Our programs range from beginner to expert levels and deliver the hands-on skills for real-world expertise.

Bluefin Payment Systems

Bluefin Payment Systems

Bluefin is the recognized integrated payments leader in encryption and tokenization technologies that protect payments and sensitive data.

Guardz

Guardz

Guardz helps small and growing businesses to go from zero or low cyber protection to having comprehensive security – in the quickest and most straightforward way.

Fulcrum IT Partners

Fulcrum IT Partners

Fulcrum IT Partners is the parent company of an expanding portfolio of established IT solution companies around the world with proven expertise in cyber security, cloud, and managed services.

Chestnut Hill Technologies (CHT)

Chestnut Hill Technologies (CHT)

CHT provide Best Practices IT Cybersecurity and Technology Solutions and Consulting Support to the Mid Cap through Fortune 1000 Nationwide.

OpenZiti

OpenZiti

OpenZiti is the world’s most used and widely integrated open source secure networking platform. OpenZiti provides both zero trust security and overlay networking as pure open source software.