Twenty twenty-two is meant to be a “year of security strategies.” In March, EU leaders are set to endorse the Strategic Compass, a shared European threat assessment to improve joint decision-making. This year, Germany has begun work on its first-ever National Security Strategy in a bid to improve its reliability as a partner. Yet if the EU and Germany really are intent on achieving “European strategic sovereignty,” 2022 got off to a rocky start. During the escalating Russia-Ukraine crisis, the EU was criticized for being “missing in action,” and Germany struggled to present a clear approach. It will be hard for the EU to persuade the great powers to consider it a peer if it continues to fall short of its own rhetoric. But then, the EU has always been an unusual kind of actor.
What the EU Brings to the Table
The EU is struggling in a very public way with its goal to become a “classic” strategic security actor. First and foremost, it must contend with obvious and unflattering comparisons to NATO, which enjoys a military capability and backing from the United States and will itself adopt a new Strategic Concept in June. And yet the EU – not to mention the member states and citizens that comprise it – would benefit if it were to focus more on what it is, rather than what it wants to be. Unlike NATO, which is an intergovernmental security alliance, the EU has considerable political and regulatory power. This also means it has a security superpower that NATO and other such bodies lack: the EU can build resilience.
“Resilience” may sound like a buzzword to be slapped on pandemic-era policy initiatives such as the EU’s Resilience and Recovery Facility. But it retains a core meaning. The term refers to the ability of a system to maintain its vital functions when faced with stress or disruption. Some countries, like Finland, place this principle at the very center of their security strategies, focusing on safeguarding government and administration, internal and external security, the security of supply, and psychological resilience. This matters because so many contemporary risks – hybrid threats like cyberattacks or complex crises like health or climate catastrophes – target these vital functions to erode the fabric of societies.
In this regard, the EU is everything that NATO cannot be: It has competencies that affect how societies organize themselves. Despite this fact, NATO has so far been more concrete about establishing the criteria for resilience in Europe. In 2016, its Allies agreed on “baseline requirements” for maintaining key areas such as the supply of energy, food, and water, as well as communications systems. These were updated to include 5G in 2019 and confirmed in 2021. NATO’s New Strategic Concept will likewise prioritize threats to resilience. However, NATO concedes that resilience is primarily a responsibility of individual Allies. The EU, by contrast, can use its comprehensive political structures and robust regulatory powers to build resilience itself – and to make resilience central to its strategic posture.
The EU Should Realize the Strategic Potential of Resilience
Currently, the EU prefers to focus its strategic thinking on the grand term “European sovereignty.” The object of much conceptual wrangling, this concept remains unclear, perhaps because it has been hijacked as a vehicle for those who want to build up the EU’s military means even before clarifying the ends. Yet European sovereignty is, in fact, resilience in all but name: It describes the EU’s goal of being able to maintain its vital interests – the functioning of the Single Market, democratic values, and the rule of law. Happily, the new German coalition agreement defines strategic sovereignty in just this way: the capacity to act globally and reduce vulnerabilities in critical functions such as energy provision, raw material supply, digital and communication technologies, and health.
But the EU itself has failed to link “resilience” to “strategic sovereignty.” Subsequently, its resilience-building work consists of a host of rather technical initiatives on critical entities, cyber resilience, and industrial policy that it is only just beginning to “join up.” The closest the EU Commission has come to placing resilience at the core of the EU’s strategic posture was in its 2020 Strategic Foresight Report, which declared resilience to be a “new compass for EU policies.” But even this was, at heart, a technical document whose major contribution was to introduce “resilience dashboards” as monitoring tools for social and economic, geopolitical, green, and digital resilience across the EU-27. Its first comprehensive assessment was published last year.
In December 2021, the EU again seemed to be poised to put its resilience initiatives on firmer strategic footing when leaders endorsed the Council’s conclusions on resilience and crisis response. These conclusions promise an “all-hazards approach” of cross-sectoral and cross-border crisis management that integrates strategic foresight and risk analysis, setting out that the EU needs to be prepared for “acute crises […] of a hybrid nature [that] have cascading effects, or occur simultaneously.” But to genuinely achieve this, the individual risk preparedness and crisis management mechanisms designed for distinct type of risks like hybrid threats or natural disasters would need to be brought together under an overarching goal. In practice, the document does not go this far.
Resilience Cannot Be Strategic Without Focusing on Society
A genuinely strategic all-hazards approach – one that pulls together relevant technical tools – would go beyond the list featured in the Council’s conclusions of existing initiatives such as the 2021 Civil Protection Network and the draft Critical Entities Directive. To achieve coherence, the EU should logically center its various efforts around their referent object – society and the effort to maintain its fabric. This focus would unleash a positive dynamic, allowing the EU to maintain its unusual security posture in the face of great power politics. The EU could leverage its resilience as a means of deterrence, anticipating and reducing the vulnerabilities that hostile actors might exploit. This could enhance its credibility as a player vis-à-vis great powers and, in turn, strengthen its societal cohesion.
The EU has already been developing capabilities of relevance to societal resilience but, true to form, in a disjointed way under the specific label of countering hybrid threats. The 2016 Joint Framework on Countering Hybrid Threats centers on cyber security, critical infrastructure, the financial sector, and public health. The 2018 Joint Communication on Increasing Resilience and Bolstering Capabilities to Address Hybrid Threats uses the label societal resilience for the first time, recognizing that “efforts to destabilize countries by undermining public trust in government institutions and by challenging the core values of societies have become more common.” This understanding was developed further with the setup of a Horizontal Working Party on Enhancing Resilience and Countering Hybrid Threats.
Council conclusions from 2019 and 2020 likewise acknowledge how vulnerable democratic societies are to threats such as disinformation and cyberattacks – particularly during multifaceted crises like the COVID-19 pandemic. And, currently, the EU is spearheading a number of initiatives aimed at strengthening democratic resilience under the Democracy Action Plan that aims to improve the EU’s toolbox for countering interference and overhaul the Code of Practice on Disinformation in the context of the Digital Services Act. But it would be fair to say that this technical approach has not exactly captured the imagination of European society itself, adding only to the array of fragmentary technical initiatives.
What Resilience Should Really Mean
The EU’s overarching desire for strategic sovereignty, technical projects to build resilience to specific disruptions, and goal of protecting the fabric of Europe’s democratic society – these various agendas are clearly congruent. So why not bring them together? When the EU launched its latest internal security strategy, the Security Union Strategy, Commission Vice-President Margaritis Schinas proclaimed that all dimensions of security should be addressed together: “online and offline,” “digital and physical,” and “internal and external.” Indeed, this strategy picked up the elements of critical infrastructure protection and hybrid threat resilience – but stopped short of connecting these dots with societal resilience and an overall European security strategy.
Why is it so difficult to connect these dots? One reason – as always in “joined-up” policy-making – is that silos are hard to break. An especially wide variety of actors govern resilience at various levels (national, regional, local) within government, administration, the private sector, and civil society. But the root of the problem is that the EU has not made the political case for resilience. Because it has not yet put forward the idea to voters that resilience is the EU’s contribution to their security, it cannot move beyond disconnected technical means. Curiously, the EU’s first step of engaging with voters may be for it to speak to the outside world: communicating its own resilience as a valuable aspect of deterrence can help underline the EU’s weight as a security actor abroad and at home.
Consequently, in this year of strategies, the EU should use the impetus of the Strategic Compass – which names “resilience” as one of its four focal points – to better link resilience initiatives in strategy, practice, and, above all, public communication. Germany, which has made democratic resilience one of the priorities for its current G7 presidency, has an important role to play here. On a technical level, an inter-institutional Resilience Task Force – involving the Commission, European External Action Service (EEAS), European Parliament, and Council – could help connect work strands. This task force could breathe life into the resilience dashboards by engaging politically with stakeholders from throughout the EU at regional, national, and local levels.
