What If the EU Did Not Share Data to Protect Its Critical Infrastructure?

Abstract

This scenario shows what could happen if the EU fails to establish an information exchange environment among its critical infrastructure (CI) entities. In 2030, only a few services related to the EU's CI remain local and confined to a single domain. Most are heavily interconnected - and thus increasingly subject to hybrid attacks. Because the EU still provides no common guidelines to record and share information about such attacks, CI operators cannot analyze threats, recognize EU-wide patterns, or identify adversaries. Two EU directives from the early 2020s recognized this gap but did not provide the tools to address it.