In March 2019, the Council of the European Union adopted the EU Cybersecurity Act, which forms part of the EU’s focus on cybersecurity announced in 2017, and the second EU-wide cybersecurity law. In addition to establishing an EU cybersecurity certification framework and promoting the European Union Agency for Network and Information Security (ENISA) to a permanent EU Agency for Cybersecurity, the Cybersecurity Act includes a clear commitment to protect the public core of the Internet. The Act states that the public core of the Internet is a global public good and underpins the normal operation of the Internet as a whole. The new law also tasks ENISA with assisting member states with policies that sustain “the general availability and integrity of the public core of the open Internet.”

The protection of the public core is a principle norm developed by the Global Commission on the Stability of Cyberspace (GCSC) in 2017. “The EU’s adoption of the norm to protect the public core of the Internet bears testament to the fundamental importance of this norm for enhancing stability and security in cyberspace,” said Marietje Schaake, GCSC Commissioner and Member of the European Parliament. “Furthermore, its inclusion in ENISA’s mandate is indicative of the EU’s commitment to protect the technical foundation of the open Internet, a global public good managed in a multistakeholder manner where all actors have a role.”

Michael Chertoff, Co-Chair of the GCSC, stated that, “The Global Commission on the Stability of Cyberspace welcomes the adoption of this resolution and commends the European Union for its sustained commitment to protecting the public core of the Internet.” Latha Reddy, also Co-Chair of the GCSC, added that “this marks an important step in the continuation of the GCSC’s work. We will continue to call upon a wide range of stakeholders to adopt and implement norms of responsible behavior wherever this would advance stability in cyberspace.”

Learn more about the EU Cybersecurity Act here.

Learn more about the GCSC Call to Protect the Public Core of the Internet here and see the definition of the Public Core of the Internet, to which the norm applies, here.