The machine with no operator

The European Union, and collective cyber action no one owns

The European Union is cast as a rule factory that gave the world data-protection law and would now like to regulate everything else; as a talking shop that issues statements while the member states do the work; or as a strategic actor forever described as not there yet. That the three quarrel with each other is the clue. The Union’s cyber power is real, but it takes a shape the usual words miss: collective action produced by a machine that no one operates and that does not own the strategic capabilities its members retain.

Where France holds the whole stack itself, the Union starts from the opposite end: it holds none of the stack, and builds machinery so that acting together does not require anyone to hold it. The power, such as it is, sits in the arrangement rather than in a hand.

The capability stays national

The substrate is a constitutional division. Under the treaties, national security remains the sole responsibility of each member state, leaving the Union without the sovereign security apparatus that a nation state can place behind its cyber policy. It can coordinate national capabilities, regulate the single market and build common institutions, but intelligence collection, military command and national response stay rooted in the member states. So the machine is not a capability the Union failed to build. It is the only form of cyber power available to a union whose members keep the capability: coordination, rule and collective naming, laid over twenty-seven sovereign hands.

A machine in layers

The machine is built in layers that liaise rather than command. At the technical level the CSIRTs Network joins the national incident-response teams; at the operational level EU-CyCLONe links the crisis authorities between the technical and the political; at the political level the Council decides. No single layer commands the whole stack. Each has a defined role, and each depends on the others to turn information into collective action. The machinery is assembled precisely so that collective action can happen without a single body running the whole thing.

Power by rule

Where the Union is genuinely strong is the lever it does own: rule. The internal-market competence it cannot use to run an operation, it can use to set the terms of the whole market’s security. The NIS2 directive obliges member states and essential operators to meet common security and reporting standards; the Cyber Resilience Act puts mandatory cybersecurity requirements on products before they can be sold in the Union; a certification framework sets common assurance levels. This is real power, and easy to underrate, the security of a continent-sized market shaped by law. It is also slow, and a rule is not an operation.

And rule does more than regulate: it changes what the national hands can do together. A common reporting regime makes incidents comparable across borders; common standards make systems interoperable; a common sanction makes a national attribution politically European. The Union’s capability is partly the new behaviour it induces in capabilities that stay national. France’s sovereignty works by accumulating capability; the Union’s works by changing what the capabilities it does not accumulate can do together.

The sanction is the signature

The machine’s characteristic act is not a strike but a designation. Through the 2017 cyber diplomacy toolbox and the sanctions regime built on it in 2019, the Union answers hostile cyber activity by naming and freezing, a collective political act that the Council is careful to keep short of formal legal attribution. In July 2026 the Council designated nine individuals and four entities, a bulletproof-hosting provider and a pro-Russia hacktivist group among them, alongside the United Kingdom. Read the Union’s cyber output and this is its recurring shape. Not an operation conducted, but an actor named, by twenty-seven states at once.

The machine feeds itself

A diagram of effects for the European Union's cyber posture, drawn as one reinforcing loop with a grey brake. Member-state contribution raises the shared situational picture; the shared picture raises coordinated rules and response; coordination raises interoperability and trust between national bodies; and trust raises contribution again. The four loop edges run in the same direction, so the loop is reinforcing, marked R and read clockwise. Drawn in grey, meaning a sourced effect on a branch with no evidenced return into the loop: the national veto, the unanimity the Union's collective decisions require, which lowers coordinated rules and response from outside the loop. No edge produces a Union-owned sovereign capability: the machine coordinates national capability it never consolidates into one, an absence the loop leaves open. An increase in member-state contribution raises the shared situational picture, by human intervention. An increase in the shared situational picture raises coordinated rules and response, by human intervention. An increase in coordinated rules and response raises interoperability and trust. An increase in interoperability and trust raises member-state contribution. An increase in the national veto lowers coordinated rules and response.

Seen as effects, the machine is a loop that reinforces. Member states lend intelligence and expertise into a shared situational picture; the shared picture makes coordinated rules and response possible; acting together builds interoperability and trust between the national bodies; and the trust draws more contribution. Coordination begets the trust that begets coordination, which is how a machine with no operator grows more capable over time without ever acquiring a capability of its own.

Borrowed hands

What the loop does not do is close on any operational capability the Union owns. The intelligence, offensive tooling and much of the operational response muscle remain with the member states, made available to the European machinery through cooperation rather than transferred into a single EU command. What analysis the Union does, in the external-action service, is fed by the national services rather than gathered on its own. There is no edge in the diagram that produces a Union-owned sovereign capability, because the machine is not designed to become one; it coordinates hands it does not consolidate into a single national-style apparatus. That is the mirror of France. France holds the whole and discovers that the floor beneath it is foreign; the Union holds no sovereign stack and works by design through the capabilities of its members. Each works through something it does not own; the difference is that for France this is the limit of an ambition, and for the Union it is the ambition itself.

As strong as the slowest hand

The grey branch on the diagram is the brake, and it is written into the treaties. Where the Union acts through the Common Foreign and Security Policy, the decision machinery is generally unanimity-based, so a single member can block a designation, prevent a sanctions decision, or simply wait. The machine’s output is only ever as strong as its slowest sovereign hand, and the sovereign hands do not always want the same thing. This is France’s dependence seen from the other side: France finds its autonomy threaded through the European mesh; the Union finds its mesh still needing the sovereign will it cannot compel.

Power or process

Is coordinated twenty-seven-state action with no owner a genuine form of cyber power, or an elaborate procedure for not deciding? The machine is slow, layered and repetitive, and it can jam on a single objection. It is also, at continental scale, more than any one member could manage alone, and the reason it can exist at all is precisely that no one is allowed to own it. A capability owned by one state would be a threat the others would not build; a machine owned by no one is a thing they will all feed.

The far end of the line, then. France holds the whole and finds it cannot, quite. Between the two ends sits Lithuania, the small state that could not hold the whole and worked as a mesh instead. And the Union institutionalises that mesh without owning any of it, and acts anyway, not despite having no operator but because of it. The machine with no operator is the most European of the three forms: cyber power that exists without anyone being in charge of the whole.