Deputy Prime Minister and Foreign Minister Antonio Tajani placed the cyber emergency at the centre of the G7 agenda in Paris, calling for a collective response from the leading Western democracies. Meanwhile, Defence Minister Guido Crosetto described an epochal challenge, urging institutions to overcome divisions and political confrontation to build a shared strategy.
But raising the alarm is not enough. What is needed is operational capacity, investment, and, above all, a different awareness of the risks involved. It is from this perspective that Ettore Rosato, deputy secretary of Azione and a member of the Foreign Affairs Committee of the Italian Chamber of Deputies, addresses the issue, identifying European technological sovereignty, stronger defense capabilities, and the protection of the productive system as essential steps to prevent Italy from being left exposed.
Q: Crosetto’s remarks convey the scale of a threat that no longer seems attributable to isolated incidents. Are we facing a paradigm shift in national security?
A: The work being done seems to me serious and fully aware of the risks we are facing. These risks are far greater than people may realise. The speed at which technology innovates and improves our lives, production processes, and everyday activities brings enormous benefits, but at the same time opens up a vast range of weaknesses and vulnerabilities. Attacking through the internet is much easier than defending against attacks. This is why we must understand that we are not facing a simple evolution of threats, but a profound change in the way security is exercised. And we must equip ourselves accordingly.
Q: Tajani has chosen to bring the cyber emergency to the G7, calling for a coordinated response from the major democratic countries. But how much can Europe achieve if it fails to develop its own strategic autonomy?
A: Tajani was right to make this appeal. But we must follow through. We cannot ask Europe to take on ever greater responsibilities while maintaining the right of veto on decisive issues. This leaves the Union a lame duck, weak and incapable of responding to the demands placed upon it. Cybersecurity requires speed in decision-making, investment capacity, and a common vision. We cannot continue calling for a strong Europe and then prevent it from acting when necessary.
Q: One of the central issues is technological autonomy. Today, a substantial share of Europe’s digital infrastructure depends on non-European providers. Is this also a security problem?
A: It is an enormous problem. We have entrusted a substantial part of our technological infrastructure to providers across the Atlantic, starting with cloud services. The United States is our ally, and we are fully committed to that alliance, but we must not confuse transatlantic friendship with giving up our autonomy. Americans would never entrust Europeans with responsibility for their own security.
- Why should we do so? We must invest in our own European infrastructure, develop proprietary technologies, and strengthen our industrial expertise. This applies to cloud computing, artificial intelligence, and, of course, cybersecurity. Technological sovereignty is not a slogan, but a necessary condition for protecting our interests.
Q: At the national level, the National Cybersecurity Agency (ACN) is the cornerstone of Italy’s response. Are the resources and tools at its disposal sufficient?
A: The ACN is doing its job well. It performs a fundamental function, including through its advisory and support activities for the private sector. It is an indispensable safeguard, but it needs to be further strengthened.
- There is also another sector in which we must invest with even greater determination: defence. We need more resources to develop cybersecurity capabilities, strengthen expertise, and build tools suited to the nature of the new threats. The cyber dimension must become a structural component of our defence capabilities.
Q: Crosetto has called for overcoming political and institutional divisions, even raising the need for a common strategy to address this phase. To what extent could political confrontation hinder the development of a national strategy?
A: This issue cannot become a matter of institutional competences or political affiliation, much less a dispute over who should manage cybersecurity. It is an issue that must cut across politics and all institutions. In this respect, I agree with Crosetto’s appeal: we need to recognise that we are facing a threat affecting the entire country, although I fear that the centre-right still has some issues to resolve within the governing majority.
- We are willing to cooperate with the government and with all political forces. For months, we have been working on disinformation and the democratic shield. These issues require serious discussion and institutional convergence. We cannot afford to allow political divisions to become a source of national vulnerability.
Q: Then there is the business sector. Cybersecurity is often discussed in relation to major public infrastructure or government ministries, but Italy’s productive system consists primarily of small and medium-sized enterprises. How can they be protected?
A: This is one of the areas where the government should act with greater urgency. We need to introduce an extraordinary funding measure for SMEs, enabling them to secure their IT infrastructure. I am also thinking of a tax credit mechanism to support companies’ investments in cybersecurity.
- We cannot simply impose obligations and responsibilities: we must provide the resources needed to meet them. A small business does not have the same tools or financial resources as a large public administration or an industrial group. Yet it may be exposed to equally serious risks. Protecting businesses means protecting our productive system, the continuity of work, and an essential part of national security.
Q: So the risk is that the cyber threat will continue to be perceived as something removed from the everyday lives of citizens and business owners?
A: Exactly. A large part of the Italian population is still not fully aware of the danger. Recent incidents must help us understand that this is not a problem confined to major public administrations or strategic infrastructure, which themselves have resources and tools that need to be further developed.
- An attack can hit a company, disrupt a service, compromise personal data, and put entire communities in difficulty. Digital security concerns everyone. This is why investment must be accompanied by a major effort to raise awareness and provide training.
Q: If you had to identify the priorities of an Italian and European strategy against hybrid warfare, where would you start?
A: With three main priorities.
- The first is strengthening national capabilities, starting with the ACN and defence.
- The second is an extraordinary plan to secure the productive system, with particular attention to small and medium-sized enterprises.
- The third is a policy of public investment, at both national and European level, in artificial intelligence, cybersecurity, and cloud computing.
The bottom line: “We must build autonomous technological capabilities, because we cannot continue to depend entirely on infrastructure developed and controlled elsewhere,” said Rosato.
- “Our friendship with the United States is not in question, but Europe must be able to protect itself. Security cannot be delegated. Above all, it cannot be addressed only when the next attack occurs.”
