show image

EU imposes sanctions on Chinese, Russian and North Korean hackers

The European Union has announced plans to impose sanctions on individuals and organisations in China, Russia and North Korea in relation to a string of high-profile cyber attacks.

The intervention – an unprecedented step for the EU – targets three organisations and six individuals linked to four attacks: WannaCry (North Korea), NotPetya (Russia), an attack on the Organisation for the Prohibition of Chemical Weapons (Russia) and the Cloud Hopper campaign against managed service providers (China).

Under the terms of the sanctions, which have been issued through the EU’s cyber diplomacy toolkit for the first time, the organisations and individuals named on the list will be subject to travel bans, asset freezes and restrictions on their access to funds from EU businesses.

In a statement announcing the news, the EU said the “targeted restrictive measures have a deterrent and dissuasive effect and should be distinguished from attribution of responsibility to a third state”. But while it also refrained from identifying China, Russia and North Korea in the statement, it disclosed the names of the individuals and the organisations they worked for in a separate document.

“To prevent, discourage, deter and respond to continuing and increasing malicious behaviour in cyberspace, six natural persons and three entities or bodies should be included in the list of natural and legal persons, entities and bodies subject to restrictive measures set out [in this document],” it states.

“Those persons and entities or bodies are responsible for, provided support for or were involved in, or facilitated cyber-attacks or attempted cyber-attacks, including the attempted cyber-attack against the OPCW and the cyber-attacks publicly known as ‘WannaCry’ and ‘NotPetya’, as well as ‘Operation Cloud Hopper’.”

The UK and US have become more vocal in recent years in attributing cyber attacks to nation states, including China, Russia and North Korea, as well as Iran. But the EU, which has to seek approval from each member state before issuing sanctions, has typically been more reserved. Some European nations have been particularly reluctant to call out Russia and China, which respectively serve as a key source of energy and inward investment into the trading bloc.