The European Union has drawn up a set of rules governing the security of the region's digital infrastructure. Under the framework provisionally agreed last night by Members of the European Parliament (MEPs) and the Luxembourg Presidency of the EU Council of Ministers, transport, energy and other key companies will have to ensure that the digital infrastructure that they use to deliver essential services, such as traffic control or electricity grid management, is resilient enough to withstand online attacks. Similarly, major digital marketplaces like eBay or Amazon, search engines, and cloud services will be required to ensure that their infrastructure is secure, and to report major incidents. Smaller digital companies will be exempt from these requirements.

As a press release from the European Parliament explains: "MEPs put an end to current fragmentation of 28 cybersecurity systems by listing sectors—energy, transport, banking, financial market, health and water supply—in which critical service companies will have to ensure that they are robust enough to resist cyber-attacks. These companies must also be ready to report serious security breaches to public authorities."

Member states will be required to identify "operators of essential services" from these key sectors, using various criteria such as whether the service is critical for society and the economy, whether it depends on network and information systems, and whether an incident could have significant disruptive effects on its provision, or public safety.

A network of Computer Security Incidents Response Teams will be set up by each member state to handle incidents, and to coordinate responses to them. In addition, there will be a new talking shop: "the draft rules sets up a strategic cooperation group to exchange information and best practices, draw up guidelines and assist member states in cybersecurity capacity building."

Alongside a ridiculous name—for some reason best known to itself the EU insists on calling this stuff "cybersecurity," a term that went out of fashion in the 1990s—the latest plans look rather pointless at a time when EU member states are seriously considering undermining online security by weakening encryption or requiring backdoors to be added to key software. Those moves alone will negate any benefit the new rules might have brought, since they will make it far easier to break into critical systems, and to steal sensitive information like access passwords.

The EU would have had a far more positive impact on the resilience of digital infrastructure by bringing in clear rules forbidding member states from weakening existing technologies, particularly in the field of encryption. If EU governments go through with their plans to water down key online protections, the EU's new framework will amount to little more than window-dressing that adds an administrative burden to the companies involved without doing much to boost online security or provide concrete benefits for the public.