POSITION OF FEDIL – FUTURE CYBERSECURITY RESEARCH & COMPETENCE CENTRE

Context

In a world increasingly connected where borders tend to disappear, digitalisation is no longer a futuristic vision but a tangible reality. Social and economic activities have migrated to the internet, creating a digital economy defined by new interactions and behaviours.

Large-scale cyber attacks such as WannaCry and NotPetya have brought cyber risks into the public eye showing that threats have evolved as quickly as this new economy. A need to propose a set of tools to better defend ourselves has been highlighted by the European Commission, proposing a Cybersecurity Package – a voluntary and collaborative approach based on three pillars of action (resilience, deterrence and defence) to ensure European citizens’ and businesses’ online safety. Especially, to strengthen cybersecurity collaboration and research in the EU, the Commission foresees the establishment of a network of cybersecurity competence centres spread across the Union, managed by a Cybersecurity Research and Competence Centre.

Cybersecurity is a tremendous economic opportunity and is a growth engine for Luxembourg’s attractiveness. We do believe that Luxembourg is ideally positioned to host this future centre, having the experience, knowledge and culture of collaboration to allow all the Member States of the European Union to fully benefit from it. This paper constitutes FEDIL’s contribution to the matter.

An ICT Hub in the heart of Europe

Located at the crossroads of Europe, Luxembourg is within driving distance of all major business centres on the continent, with an estimated 60% of the EU wealth being concentrated within a 700km radius.

Following the launch of its “Digital Lëtzebuerg” strategy in October 2014, Luxembourg’s Government has prioritised 6 key areas of development to transform the country into a “Digital Nation”:

  • Infrastructure
  • Innovation
  • FinTech
  • E-skills
  • E-administration
  • Promotion

It boasts first-class infrastructure including 23 datacentres, 8 of which have Tier IV certification and hosts most of the EU’s datacentre infrastructure. It is also connected through 23 different fibre routes to the main internet exchange hubs in Europe with extremely low latency rates. In terms of local internet connectivity, Luxembourg will gradually benefit from an excellent Fibre to the Home (FTTH) programme rolled out by 2020 and has the highest level of internet usage in the EU with over 94% of coverage rates for next-generation networks.

Putting in place a world-class digital infrastructure is key to support the digitalization of the country. The country has also benefited from the installation of several critical entities in the European Union like the Digital Pole, the world’s first “Data Embassy” from Estonia and is awaiting confirmation for the Euro High Performance Computing Joint Undertaking, a legal and financial structure which will not only buy, implement and deploy a pan-European supercomputer infrastructure, but also support a research and innovation programme to develop technologies and machines (hardware), as well as the applications (software) that operate on these supercomputers. EU Commission’s IT and network directorates (DIGIT) is also a Luxembourg’ based entity which has recently been transferred from Brussels. Other critical services from Communications Networks, Content & Technology (DG-CONNECT) are also Luxembourg-based like Robotics & Artificial Intelligence, Digital Society, Trust and Cybersecurity.

Therefore the share of ICT specialists has been growing steadily and now accounts for nearly 5% of the total employment compared to 4% in 2011 – meaning more than 12,000 employees and growing.

The country aims to take a strong role in the EU’s emerging digital single market and those flagship entities as well as the ICT specialists have contributed to further position the Grand-Duchy as one of Europe’s top business hub.

A magnet for New Technologies

Since the creation of SES in 1989, Luxembourg has a long history of high tech attractiveness and a forward-looking position as a magnet for new technologies. Indeed, 7% of its economy growing at a fast pace is already coming from ICT. Its labour market is a melting pot of different cultures and nationalities, with the highest share of high-skilled workers in the world and the largest cross-border labour market in EU with 160,000 daily commuters. We estimate today that the cybersecurity workforce in Luxembourg has reached more than tens of thousands of workers.

The efforts of the Luxembourg government and Information security sector stem from both from the country’s good reputation as a business partner, especially in industry, banking and ICT, as well as from the nation’s drive towards peace, freedom and sovereignty, embedded in EU community values. They have also arisen from the DNA of the country itself: a safe, open and neutral economy with sound fundamentals, political and social stability.

Luxembourg is one of the very few countries that has more than 10 active years of experience in cybersecurity since the adoption in 2005 of the first Governmental Cybersecurity Strategy. This long history of excellence in the matter has contributed to develop an active community of private, public and academic entities inside Luxembourg:

  • the highly effective and collaborative network of Cyber Emergency Response Teams provides early warning information and sharing capabilities
  • Securitymadein.lu acts as an information and strategy forum for cybersecurity companies with its two main divisions CASES and CIRCL
  • The new Cybersecurity Competence Centre C3 provides threat intelligence,

cybersecurity skills and expertise, as well as training and testing facilities in IoT, space technologies, fintech or autonomous driving

Furthermore, Luxembourg regularly proves its willingness to share ideas, methodologies and best practices with other countries. It has developed exceptionally high standards of cybersecurity that are readily available to all companies. This expertise in protecting individual client data and systems, driven at its origin by the needs of the financial sector, is essential for e-business and the economy at large. For example, it developed Monarc, a risk analysis method later adopted by Belgium.

Moreover, several partnerships programs have been initiated by the research infrastructure of Luxembourg. The interdisciplinary Centre for Security, Reliability and Trust (SnT) at the University of Luxembourg has been internationally leading research and innovation and has organized the transfer of new technological approaches thanks to its Technology Transfer Office. It conducts internationally competitive ICT research with high relevance for business. Research focus areas include secure and compliant data management, fintech, cybersecurity, satellite systems, connected vehicles and smart cities. Through its partnership programme which involves the most prominent ICT players, the SnT develops concepts that give companies in Luxembourg and beyond a solid competitive advantage. So is the Luxembourg Institute of Science and Technology (LIST) currently doubling down on data analytics and highlighting how academic research will play a fundamental role in accelerating scientific results into innovations.

he adjustment of the legal framework in recent years has boosted Luxembourg’s attractiveness in areas dealing with information security. New laws are now digital by default and designed to back company development. Luxembourg-based companies can benefit from the “Professional of the Financial Sector” status that requires financial centre regulation thus adding significantly to investor protection and client confidence. PSF enjoy special access to the market in financial activities and fall within the financial sector’s specific sphere of information confidentiality and security. More than 300 PSF account for almost 4% of jobs of the working population in the Grand Duchy, are the second-largest employers in the financial industry and have improved Luxembourg’s attractiveness dramatically (50% of PSF created have been of foreign origin). This approach is unique to Luxembourg and has contributed to the development of a centre of excellence in the regulated outsourcing of a whole range of activities, adding a further incentive to companies for consolidating their central services in Luxembourg.

Moreover, the cyber community has been largely stimulated by Luxembourg’s voluntary approach, which proved once again that it is able to move fast, act as a pioneer and is willing to provide straightforward access to top political decision makers.

Conclusion

To be relevant in hosting a centre that will be core to the cybersecurity of citizens and businesses across the European Union, it is crucial to lead by example and be best-in-class in Europe. We believe that Luxembourg is a recognized, dynamic leader in cybersecurity with constantly improving set of skills and experience. It has shown its efficiency and credibility in developing and securing its own digital economy as well as collaborating towards a more effective European one. It has done so by putting ICT and the data-driven economy at the core of its country strategy (Digital Luxembourg) and by showing that more than a repressive focus, there is a need for a pragmatic risk-prone approach.

Based on those elements and the ambition to establish a strong cybersecurity defence in Europe, it appears clear that Luxembourg needs to step up and present its candidacy to host the future Cybersecurity Research and Competence Centre.