Cyber hacker Photo: Shutterstock

The European Union used some uncharacteristically broad language in its decision approving the framework for bringing new sanctions against cyberattackers, according to a London-based in-house leader.

“This is highly un-technical language for a [European] Council decision,” Alessandro Galtieri, deputy general counsel of global telecom company Colt Technology Services, said Monday. He believed that the EU's decision during a May 17 meeting in Brussels was deliberately styled to “grant more flexibility” in imposing sanctions.

“A more technical approach would have been to identify cyberattacks as a reason to apply the existing sanctions regime,” Galtieri added. “But I suspect that this was seen as too cumbersome and slow, and the EU wanted to use a more flexible approach.”

The EU's decision to begin punishing cyberattackers with sanctions, including asset freezes and travel bans, comes amid concerns about possible Russian interference in the European Parliament elections next week. 

U.K. Foreign Secretary Jeremy Hunt trumpeted the new sanctions regime as “decisive action to deter future cyberattacks.”

“For too long now, hostile actors have been threatening the EU's security through disrupting critical infrastructure, attempts to undermine democracy and stealing commercial secrets and money running to billions of Euros,” he added.

Under the new framework, EU members, including the U.K., will be able to sanction “persons or entities that are responsible for cyber-attacks or attempted cyber-attacks, who provide financial, technical or material support for such attacks or who are involved in other ways,” according to the European Council's decision.

The sanctions apply to cyberattacks and attempts that have a “significant impact” or “potentially significant effect” and originate from outside the EU or involve infrastructure, persons or entities beyond the EU's borders. 

Cyberattackers who are identified could be banned from traveling to the EU and have their assets frozen, while EU residents and companies would be banned from “making funds available” to the blacklisted cyber villains. 

“It won't deter state agents that much,” Galtieri said, “but may concentrate the minds of those in Beijing or Moscow with a nice pad in London and children who want to study here.”

Read More:

UK Breaches Drop, While Scope of Targets May Be Narrowing

2 US Law Firms Among Cybercrime Victims, DOJ Says

What US Businesses Need to Know About Foreign Governments' Theft of Their Data