In a nutshell: The European Commission is developing a new strategy to enhance internal security across the entire European Union. The plan introduces a cultural shift in how internal security is perceived, but some aspects of the proposal could potentially weaken digital security instead.

The recently announced ProtectEU plan aims to safeguard Europe from internal threats, European Commission President Ursula von der Leyen stated, emphasizing that security is a fundamental pillar of open societies and thriving economies. Among the most pressing threats identified by the European Commission are terrorism, organized crime, cybercrime, and attacks on critical infrastructure.

The EC is positioning ProtectEU as a broad initiative in response to an increasingly complex geopolitical landscape. With hybrid threats and state-sponsored cyberattacks wreaking havoc online, Europe urgently needs a significant overhaul of its internal security strategy. While ProtectEU does not yet include a detailed proposal, the official announcement outlines several key objectives as a foundation for the plan.

ProtectEU advocates for a new security governance framework, aiming to transform the European Commission’s approach to internal security. The initiative calls on EU member states to enhance intelligence-sharing practices through a newly proposed platform, the Single Intelligence Analysis Capacity. Additionally, the Commission envisions expanding Europol’s role, effectively transforming it into a European equivalent of the FBI, with enhanced operational capabilities.

The most intriguing – and concerning – aspect of ProtectEU from a technological standpoint is its focus on Europol’s expanded enforcement tools, which are intended to address increasingly complex criminal investigations involving digital information. The plan includes provisions for “lawful access to data,” outlining a technology roadmap that targets encryption and evaluates the EU’s current data retention rules.

Granting Europol the ability to access encrypted data can only mean one thing: Brussels is proposing some form of government-mandated backdoor for communication platforms protected by end-to-end encryption. These systems are notoriously difficult to breach, making them a challenge for law enforcement. However, security researchers have repeatedly demonstrated that implementing so-called “lawful” backdoors is inherently flawed as such vulnerabilities would inevitably be discovered, accessed, and exploited by cybercriminals and black-hat hackers.

It remains to be seen how the EU plans to move forward with its encryption-breaking ambitions, though expectations for a practical or effective outcome are low. Meanwhile, the ProtectEU initiative also includes proposals to strengthen digital infrastructure, tighten regulations against organized crime networks, and expand international cooperation, particularly with Latin America and the Mediterranean region.

Notably, the European Commission makes no mention of new partnership initiatives with the United States.