For the first time, the EU imposes sanctions for cyber attacks

Taking a firm geopolitical stand, the European Union imposed sanctions on targeted individuals and entities from Russia, China and North Korea in a sign that it was tackling cyber warfare head on.

As part of the measures, the six individuals and assets of the three institutions will be frozen and the people involved won’t be allowed entry into the bloc, the EU said in a statement on Thursday, adding that EU companies and individuals are forbidden from sending funds to those on the list.

The EU targeted the individuals and entities over their involvement in the attempted attack against the Organization for the Prohibition of Chemical Weapons in 2018 as well as the 2017 Not Petya cyberattacks, a virus that first infected computers in Ukraine demanding $300 in cryptocurrency to unlock systems before spreading to Europe and the U.S.

Both events were attributed to Russian actors by government officials.

EU officials also hit groups with penalties over their involvement in the 2017 Wannacry ransomware assault that affected hundreds of thousands of computers in more than 150 countries, which U.S. officials have attributed to North Korea.

In addition, sanctions were also imposed on those involved in hacking operations—tied to Chinese spies—that targeted the world’s biggest IT service providers.

New Toolbox

While the EU statement did not explicitly name the people involved or their countries of origin, people familiar with the matter said the individuals and entities were based in Russia, China and North Korea.

The sanctions represent the first application of the EU’s so-called cyber sanctions regime—a toolbox including travel bans and asset freezes intended to deter cyberattacks.

Experts say attribution of such actions is still a murky exercise given tricks bad actors deploy to give the appearance that other groups are behind an attack. That in turn makes imposing sanctions on specific actors equally challenging.

Sanctions require unanimity among the EU’s 27 members, which has frequently paralyzed EU foreign policy decisions. China, in particular, is a touchy subject among countries, with some wary of endangering relations with the bloc’s second biggest trading partner and a major foreign investor. Others are seeking a progressive normalization of relations with Russia, on which the EU depends for much of its energy supplies.