Cybersecurity is an integral part of citizens’ lives. Not only are economic activities, but also the orderly functioning of societies and democracy at large, increasingly dependent on interconnected networks, information systems, and devices. The security of these digital technologies must be ensured not only for individuals to trust them but also to uphold human rights and fundamental freedoms. The widespread use of networks, information systems, and connected devices from the 1990s to the early 2000s led to an expansion of the “attack surface,” which refers to the potential areas that malicious actors can target. Yet, the increasing deployment of cyber-physical systems (CPS) signifies a fundamental shift in the threat landscape.Footnote ¹ CPS sit at the intersection of the physical and digital worlds, integrating components such as physical objects, software, and networks to control physical processes in real time. Through sensors and actuators, they gather environmental data, autonomously determine operational status and interact with other CPS.Footnote ² Supported by 5G, cloud computing, and artificial intelligence, CPS technologies are transforming industry, agriculture, healthcare, transportation and public policies by increasing automation and autonomy. However, significant security challenges are emerging. On the one hand, CPS represent a new attack surface for cyber threats, as highlighted by ENISA, which predicts a rise in attacks by 2030.Footnote ³ The lack of specialised skills, misconfigurations, insufficient maintenance and inadequate support make these devices vulnerable. Attacks can exploit outdated devices or those with default settings to gain initial access, move laterally across networks, and compromise sensitive data. Against the background of today’s “digital-physical”Footnote ⁴ environment, risk factors and threats go beyond the technical infrastructure networks, information systems and devices. Cyberattacks could also infringe individuals’ fundamental rights, impair physical safetyFootnote ⁵ and have critical consequences for the democratic process of a society.

On the other hand, CPSs coupled with AI-based surveillance technologies have become extremely attractive to profile consumers or predict their preferences and enhance law enforcement authorities’ control and monitoring.

The massive collection of behavioral, health and connected device data exposes individuals to risks such as profiling and social engineering attacks. To ensure the secure and sustainable development of CPS, an integrated approach is needed that balances innovation, fundamental rights and advanced cybersecurity measures, preventing the misuse of technology and mitigating risks to users’ and citizens’ privacy and security.

Cyber threats are, therefore, on the rise, varied and sophisticated, and the changing geopolitical scenario has further intensified the scope of the risk: known challenges have returned to the fore, and new ones have emerged, such as the security of supply chains on which critical infrastructures often rely.

In the context of rising safety and cybersecurity risks due to the digitisation and datafication of society, this special issue seeks to highlight the various normative challenges – legal, ethical and social – that cybersecurity governance faces, with a particular focus on the European continent. Thus, in recent years, risk-based regulationFootnote ⁶ has predominantly been the model of governance adopted by the European Union since the publication of the Digital Single Market Strategy.Footnote ⁷ EU legislation in the fields of data, online content and artificial intelligence is informed by a risk-based approach, albeit with differences.Footnote ⁸ Recent EU legislation in the field of cybersecurity makes no exception to this regulatory trend.

Against the background of EU cybersecurity policy, in December 2020 the EU Commission and the EU High Representative for Foreign Affairs and Security Policy presented the third EU “Cybersecurity Strategy for the Digital Decade.”Footnote ⁹ Cybersecurity is now a key, integrated component aligned with the European Digital Transition Plan,Footnote ¹⁰ the Recovery Plan,Footnote ¹¹ and the European Security Strategy of July 2020.Footnote ¹²

The Strategy contains proposals for legislative, investment and policy initiatives in three areas of EU action: (1) resilience, technological sovereignty and leadership; (2) developing operational capabilities for prevention, deterrence and response; and (3) promoting a global and open cyberspace.

Against this background, this special issue aims to achieve twofold objectives. First, it seeks to examine the challenges presented by implementing the Commission’s ambitious Strategy. Second, it aims to assess the implications of utilising new technologies for national security purposes.

To increase the level of cyber resilience and cybersecurity of the EU’s public and private sectors, several actions have been promoted and will be tackled in the proposed contributions. In particular, two contributions will examine the legislative initiatives introduced by the European Union with the objective of preventing cyber-attacks. Pier Giorgio Chiara’s article, entitled “Understanding the regulatory approach of the Cyber Resilience Act: protection of fundamental rights in disguise,” will focus on the regulatory foundations and fundamental rights implications of the Cyber Resilience Act, which sets technical requirements for products with digital elements. In her article (“The Cyber Solidarity Act: framework and perspectives for the new EU-wide cybersecurity solidarity mechanism under the EU legal system”), Susanna Villani addresses the proposed Cyber Solidarity Act, which aims to enhance the detection of and preparedness for cyber threats across the EU.

A third selected contribution is based on the premise that the recent wave of EU regulations seems to neglect a traditional tool in the fight against cyber threats, namely criminal law. In “Cybersecurity and the Fight against Cybercrime: Partners or Competitors?” Laura Bartoli analyses the rationale behind this approach and the emergence of new trends and proposals aimed at facilitating the prosecution of cybercriminals.

The final contribution, by Giulia Gabrielli (“The use of facial recognition technologies in the context of peaceful protest: the risk of mass surveillance practices and the implications for the protection of human rights”), takes a human rights approach to examine the implications of the use of AI-based technologies by law enforcement authorities. Since the EU advances a vision of cyberspace founded on the rule of law, human rights and democratic values, it is imperative to ensure that the implementation of public security policies is aligned with States’ obligations under human rights treaties.

The articles in this special issue are the first research outputs of the project “EcoCyber – Risk management for future cyber-physical ecosystems,” within (Spoke 8 “Risk Management and Governance”) the Italian project SERICS (SEcurity and RIghts in the CyberSpace, PE00000014) funded by the European Union – NextGenerationEU through the Italian Ministry of the University and Research National Recovery and Resilience Plan – Mission 4 Component 2, Investment 1.3.