CYBERDEFENSE REPORT Romania's National Cybersecurity And . - CSS

Romania’s National Cybersecurity and Defense Posture2 Cybersecurity Policy2.1 Overview of Key Policy Documents2.1.1Cybersecurity Strategy of Romania,2013 8(CSR)The Cybersecurity Strategy of Romania adoptedin 2013 is Romania’s first cybersecurity strategy anddetails the country’s cybersecurity policy. The RomanianGovernment issued the CSR as a response to the EU’sregulatory process with regard to cybersecurity and incompliance with Romanian Government decision 489 of2011 on the establishment of the CERT-RO. The CSRexplains the contextual framework of cybersecurity inRomania –rapid development of ICT, the benefits ofdigitalization and the vulnerabilities linked to it. The goalof the CSR is to protect national interests with regard tocybersecurity, while being in compliance with the goalsof the National Strategy for Critical InfrastructureProtection 9 and the National Defense Strategy 20202024 10 (NDS). The strategy states eight goals that heavilyfocus on creating an integrated national system calledthe National Cyber Security System 11 (NCSS) responsiblefor the implementation of all measures for preventingand responding to cyberattacks and cyber incidents. Inaddition, the strategy in its goals emphasizesdevelopment of cooperation and adaption of standardsregarding cyberdefense in line with the EU, NATO andthe US.safety, private life, communications secrecy, limitationsto the exercise of certain rights or freedoms, respectingthe attributions of the Supreme Council for NationalDefense as well as complying with European Uniontreaties” (Jasmontaite et Burloiu 2017).The sweeping scope of the PCL sought to extendregulatory powers over all legal entities in both thepublic and private sector that use ICT and handlepersonal data without indicating any data protectionmeasures in case of misuse. This expansion would haveincluded journalistic outlets and non-governmentalorganizations (NGOs).Moreover, the governmental authorities incharge of cybersecurity – predominantly the RomanianIntelligence Service – would have been granted accessto ICT systems and logs of data-hosting providerswithout additional prior legal authorization. Finally, thePCL elevated the RIS as the national authority oncybersecurity questions and assigned the agency thelead on Romanian cybersecurity. Since 2015, the PCL hasbeen revised several times but is still – as of October2020 –not yet adopted (Turcu 2016; Jasmontaite etBurloiu 2017; CYBERWISER.eu 2019).2.1.3National Defense Strategy 2020-2024,2020 (NDS)In order to align its cybersecurity policy with theEU and NATO – and without any public consultation –the Romanian Government developed the Proposal forthe Cybersecurity Law. This bill was submitted to theParliament, which accepted it in December 2014without publicity. However, the document generatedcontroversies and members of the Parliament and 13non-governmental organizations strongly opposed theadoption of this law, many provisions of which itutional Court struck down the Cybersecurity Lawin its entirety on January 2015 because it violatedprovisions contained in at least eight articles ofRomanian constitution: “ Articles 1(3) and (5), 21, 23(1),26, 28, 53, 119, 148 concerning state sovereignty andthe rule of law, access to justice, personal freedom andThe National Defense Strategy 2020-2024,entitled “Together, for a safe and prosperous Romaniain a world marked by new challenges”, builds on a seriesof planning documents: the 1991 Law of NationalSecurity of Romania, the 1994 Law of National Defenseof Romania, Romania's 2001 National Security Strategy,Romania's Military Strategy 2002-2004, the 2004 WhitePaper on Government Security, the National Defense,the Law on the Planning of the National Defense ofRomania, the National Defense Strategy 2008-2015, andespecially on the National Defense Strategy 2015-2019of 2015.The National Defense Strategy, published in July2020, is the latest national defense strategy issued bythe government of President Klaus Iohannis. This is thesecond defense strategy – following the one of 2015 –that considers a paradigm shift in national defense andsecurity reflecting the increasing complexity,interconnection and unpredictability of the dynamics ofthe overall security environment as well as a potentialglobal power reconfiguration (Parlamentul Romaniei,2020a, p. 17). Moreover, this strategy includespandemics and puts an emphasis on the use of cybercapabilities in the context of geopolitics and warfare.8Strategia de securitate cibernetică a României şi a Planul de acţiunela nivel naţional privind implementarea Sistemului naţional desecuritate cibernetică, 201310 Strategia naţională de apărare a ţării pentru perioada 2020 ‐ 2024 Impreună, pentru o Românie sigură şi prosperăîntr-o lume marcatăde noi provocări, 2020Strategia Națională Privind Protecția Infrastructurilor Critice,Hotărâre 718, 201111Sistemul Naţional de Securitate Cibernetică12Legea privind securitatea cibernetică, 20142.1.29Proposal for the Cybersecurity Law,2014 12 (PCL)7

Romania’s National Cybersecurity and Defense PostureThe National Defense Strategy focuses onensuring the national security and increased resilienceof Romanian society and critical infrastructures againstpossible crises through convergence with EU and NATOprerogatives and political lines.Moreover, the document identifies the followingmajor trends with potential to affect and influence thesecurity environment: rising geostrategic tensions witha reconfiguration of international and regional balancesof influence, aftermath of the Covid-19 pandemic, otherpandemics, migratory fluxes, increasing influence ofRussia, resurgence of nationalism and extremism as wellas hybrid and cyber threats.The National Defense Strategy 2020-2024continues to highlight cyber-related issues such as: ity, threats related to the emergingtechnologies, 5G –related vulnerabilities as well as“Cryptocurrencies, blockchain technology, artificialintelligence, machine learning, the Internet of Things,big data or quantum technology or the Dark Internet[and the] perspectives for their use in terms of organizedcrime, cybercrime, hacktivist, terrorist or extremistactivities. , as well as offensive operations coordinatedby entities related to the interests of some state actors.[moreover, t]he risk of adapting hybrid offensive actionsto technological developments is profiled, through acontinuous diversification of the modalities of actionand of the coordinated resources, in order to affect thenational interests, including security” 13 (ParlamentulRomaniei, 2020a, pp. 18–19).Such references mostly stand in the context ofnational security objectives, the assessment of theinternational security environment, and the priorityactions envisioned to address the main national-levelthreats, risks, and vulnerabilities. Across all thesecategories, the emphasis is put on cyber threatsemanating from hostile states and non-state actorstargeting critical infrastructure systems or strategicinterests in the private or public sector. The strategyrecognizes that cyber threats may take asymmetricaland hybrid forms especially with regard to terroristactivity, cyber criminality, and information operations.Finally, the National Defense Strategy 2020-2024,within its lines of action, highlights the priority measuresto mitigate the aforementioned cyber-related threatsand risks. The strategy does not address options for howRomania might respond to a significant cyberattack.13Translated from Romanian by the author.Strategia Națională privind Agenda Digitală pentru România 2020,2015142.1.4National Strategy on the Digital Agendafor Romania 2020 14 (NSDAR)The National Strategy on the Digital Agenda forRomania 2020, approved by the Romanian Governmentin February 2015, is aligned with the European policydocument called Digital Agenda for Europe of 2010.Romania’s Digital Agenda is adapted to the overallcontext of Romania and aims at defining Romania’sstrategic vision for ICT over the timeframe 2015-2020. Inparticular, the NSDAR aims at ensuring the developmentof ICT in Romania to EU standards and Romania’s furtherintegration into the EU digital single market. Thedocument sets out four areas of action (Administratiaprezidentiala al Romaniei, 2015a):Area 1: e-Government, Interoperability, CyberSecurity, Cloud Computing and Social Media: efforts toincrease efficiency and reduce costs in the public sectorin Romania by modernizing the administration.Area 2: ICT in education, culture and health:support for these technologies at the sectoral level.Area 3: ICT in e-commerce and research,development and innovation in ICT: regionalcomparative advantages of Romania, and backinggrowth in the private sector.Area 4: Broadband and digital infrastructureservices: efforts to ensure social inclusion (Administratiaprezidentiala al Romaniei 2015b).2.1.5Romanian National Cyberdefense: Fields,Tasks and PrioritiesIn Romania, cyberdefense is organized throughthe National Defense Strategy 2020-2024 15 and theMilitary Strategy of Romania 2016 16 (MSR). The latter isthe main document that regulates Romania’s overalldefense planning at the national level, ensures thestrategic framework and the coordination mechanismswithin Romania’s administration. Considering thecountry’s defense as a whole, the NDS promotes anextensive and holistic national security concept thatputs the emphasis on streamlining internationalcooperation and convergence with NATO and EUprinciples. The incorporation of cyberdefenseconsiderations also takes into account Romania’sgeopolitical situation, on the frontlines of the conflictssurrounding the Black Sea, which has inspired a growingsense of insecurity at the national and internationallevel. These dynamics are specially shaped by thedeterioration of the relations between NATO and theRussian Federation, the conflict in Ukraine, new terroristthreats and hybrid warfare.Strategia Naţională De Apărare A Ţării Pentru Perioada 2015 ‐2019: O Românie puternică în Europa şi în lume15Strategia Militară A României din 28 septembrie 2016: Forţearmate moderne, pentru o Românie puternică în Europa şi în lume168

Romania’s National Cybersecurity and Defense PostureCybersecurity is part of the national securityobjectives and measures set forth in the NDS and isusually linked to the protection of critical infrastructure,asymmetric threats or terrorism. In this document,cyberspace is seen as a means or vector to counterterrorism or asymmetric threats. Cyber threats aredefined as hostile actions initiated state or non‐stateactors with the aim or ability to negatively affectstrategically important information infrastructuresystems of public institutions or companies. Thesecyberattacks of national significance include operationsperformed by cybercrime or extremist groups with thecapability to materially affect Romania’s nationalsecurity (Parlamentul Romaniei 2015, 14‑15) .The Military Strategy of Romania 2016 givesmore information about Romania’s cyberdefense.Cyberattacks are defined as a “complex category ofthreats” characterized by “the increasing dynamic,global character, [and] difficulty in identifying thesources of attack and establishing effectivecountermeasures. The critical civilian infrastructureobjectives, as well as defense communications systemsand information technology equipment may beprobable targets for such attacks” (MoND 2016, 8).According to the MSR, the Romanian Armed Forces areresponsible for the cyberdefense of their own ICTinfrastructure, in time of peace and war. The RomanianArmed Forces are required to develop offensive anddefensive capabilities in order to fulfill their mandate.Moreover, the Romanian Armed Forces have tocollaborate at both the national and international levelwith regard to cyberdefense. At the national level,cyberdefense is considered as part of the NCSS and iscoordinated through the CIC. At the international level,the Romanian Armed Forces execute joint cyberdefenseexercises and take part in various joint activities andexercises with NATO and the EU and bilaterally withother strategic partners, in particular the US.The following diagram describes the timeline ofRomanian national and international policies and thekey trends that impacted Romanian cybersecurity andcyberdefense policies.Diagram 2: Timeline of Policy Developments and TrendsPolicy focus on threatson informationtechnologies andcritical infrastructureas well as ondecentralization as areaction to the end ofthe communist regimePolicy shift on information technologies seenthrough the lenses of asymmetric warfare andprimarily the impact cyber threats might haveon Romania’s critical infrastructure;Clear positioning along Western countries,especially the US and the internationalcommunity (NATO, EU, OSCE, etc.)Policy focus on consolidatingthe relationship with NATO,the EU, and the US andcentralization;Stronger focus for the militaryon regional contextSource: CSS, ETH Zürich.9Policy shift on expandingthe strategy to capturerisks posed by propagandaand espionage;Policy focus oncentralization ofRomania’s cybercapabilities within theNational Cyber SecuritySystem

Romania’s Cybersecurity and Cyberdefense Posture2.2 Key Policy PrinciplesThe CSR 2013, the NDS 2020, and the MSR 2013are three complementary documents that cover bothcyberdefense and cybersecurity. These strategydocuments emphasize maintaining Romania’s state andterritorial integrity, democracy and rule of law byincreasing Romania’s cybersecurity and cyberdefensepreparedness and resilience to cyber threats andincidents.Moreover, these three strategic documents alignin their assessment of the geopolitical situation ofRomania, the risk posed by Russian threat actors, theneed for a tight national cross-sectoral cooperation, andthe need for strong international partnerships withinthe NATO and EU setting. In this context, each of theaforementioned documents considers cyber-relateddomains to be of national importance because of theirtight links to national critical infrastructures. In all threedocuments, cyber capabilities are also associated withasymmetrical threats, organized crime, and terrorism.This link between cyber and terrorism and asymmetricalthreat puts cyberdefense and cybersecurity in a positionof great importance for Romania’s national security,which is consistent with NATO and EU’s defensepriorities.The CSR 2013 mentions the MoND and theArmed Forces only in the action plan for itsimplementation. This organization demonstrates theintention to formally separate cyberdefense andcybersecurity as institutional responsibilities, whilepromoting an open inter-institutional cooperationframework to explore and leverage synergies. To thisend, these mission sets are integrated through the NCSS.At the strategic level, both are overseen by the SCNDand at the operational level coordinated by the CIC.10

Romania’s National Cybersecurity and Defense Posture3 Public CybersecurityStructures andInitiatives3.1 Overview of the NationalOrganizational FrameworkThe following section describes the state of playof Romania’s cyberdefense- and cybersecurity-relatedinstitutions and their cooperation. Some centralinstitutions, like the National Cyber Security System arede jure already established, yet not functional. Diagram3 shows the already implemented and functionalinstitutions and the cooperation mechanisms betweenthem.Diagram 3: Oversight Organigram Structures and Cooperation MechanismsSCNDPolicy Development andOversight levelNational Cyber Security System *MoNDNICOperational levelRomanian GovernmentPCIRISCYBERINTNationalCenterFISMI *DefenseStaffMCIS SPrivateSectorRPGSLegendOtherPolicy directionCo-operation* Not fully implemented yetCERT-ROSource: CSS, ETH Zürich.3.2 National Cybersecurity Structuresand Initiatives: Organization,Mandates, and OperationalCapabilitiesAs is the case with numerous nationalcybersecurity and cyberdefense sector policyframeworks, Romania’s approach is divided into twodistinct levels: policy development and oversight andthe operational level, as shown in Diagram 3.The 2013 CSR establishes the NationalCybersecurity System with a list of roles andresponsibilities for various authorities and institutionsinvolved in ensuring cybersecurity, including public- andprivate sector cooperation and internationalcooperation at both strategic and operational level. Thestakeholders engaged include NGOs, the intelligencecommunity, professional associations, and academia.This complex framework shows that Romania’sorganizational structures charged with cybersecurity11

Romania’s National Cybersecurity and Defense Postureand cyberdefense are comparatively decentralized andexhibits continuities with Romania’s wider securityarchitecture, including the prominent role of theintelligence community.Overall, strategy development and policymakingare directed by the SCND, which receives its ordersdirectly from the Romanian Government. The MCIScoordinates the policy and strategy implementationwith the other public authorities competent in the field,namely the NIC, the MoND, the Ministry of Interior 17(MI), the Special Telecommunication Service 18 (STS), theMinistry of Foreign Affairs 19 (MFA), and the RomanianProtection and Guard Service 20 (RPGS). At theoperational level, all aforementioned ministries andservices collaborate with each other.Since 2013, a lot of work has been undertakenwith regard to Romania’s cybersecurity responsibilities and operation of the MCIS, the NCSS, theCyber Security Operative Council 21 (CSOC), the TechnicalSupport Group 22 (TSG), and the National Cyber AlertSystem (NCAS) are still in progress.In accordance with the 2013 CSR, both strategicand operational responses concentrate on the followingthreats and actors: Threats:cyber-attacksagainsttheinfrastructure supporting public functions orinformation society services, whose disruptionor damage t

cyberdefense-related events that Romania's shaped policies. Several cyberattacks are mentioned in government releases and in international organizations' reports as trigger points and reasons for significant shifts in Romania's cybersecurity and policies. cyberdefense. 2 (Mihai 2019; Cocolan, s. d.; Vevera 2014). 2