Seven European cities are facing off to host an agency that will hand out billions of euros in cybersecurity funding — and bring much-needed jobs.
Brussels, Munich, Warsaw, Vilnius, Luxembourg, Bucharest and León, Spain are all vying for the prize — the European Cybersecurity Competence Center (ECCC), which will be distributing EU money for research into technologies like encryption and network security.
While the ECCC is not a formal EU agency, it does promise to bring dozens of jobs to the winner — about 30 to start, and up to 80 according to some guesses. It should also help boost business for local cybersecurity companies and burnish the host country’s reputation on cyber.
An added perk: The ECCC will serve as a meeting point for EU cyber policymakers and industry officials, promising to boost the local hospitality industry when coronavirus restrictions are eventually lifted.
Countries have been asked to pitch locations that have international schools, nurseries and connections to airports and train lines, as well as an appropriate building to host the center. Among the contenders for an HQ: An iconic TV tower, a 19th-century train station and a shopping center with walkways covered by hanging foliage.
According to the European Commission, the center’s core job will be to manage cybersecurity funds from the EU’s research budgets, including about €2 billion earmarked in its Digital Europe program and many millions more via its innovation funding and coronavirus recovery funds, in addition to member country contributions.
EU deputy ambassadors will select on Wednesday the seat for the center in a vote that requires an absolute majority of the 27 votes to win in one or, if needed, two rounds.
POLITICO looks at the cities in play and how they could win or lose, based on the bid books and EU assessments.
Brussels, Belgium
What it would look like: One of two proposed buildings, the so-called “Bordet” which is located just kilometers from the EU’s main institutions and a stone’s throw from the NATO headquarters, could be mistaken for a miniature version of London’s MI6 “SIS” building.
In its favor: Brussels’ government is betting on 5G security as a selling point. “It is clear that the EU is looking for a secure environment to host the center, especially in terms of connectivity and 5G,” said Pascal Smet, the city’s minister for international relations. Beyond that, Brussels is using its many services like European schools and crèches for eurocrats as a perk to future employees of the center. Belgian security services offered additional services to protect the center, too.
Cause for concern: Its application’s tagline is “Ticking all the boxes” and as such reads uninspired. But the main thing holding Brussels’ proposal back is that … it’s in Brussels. Negotiations over the underlying regulation that would establish the center have been mired in turf wars and fights over national security competences between member countries and the Commission. Putting the center at the heart of the EU’s power structure could look to suspicious capitals like a power grab by the European Union on a core national security issue.
Estimated cost: Offices are free of charge (in one case for 12 years and potentially longer, in another case indefinitely) and the Belgian government set aside a renovation budget of €600,000.
Munich, Germany
What it would look like: Green and leafy. One of the proposed locations is the Fünf Höfe (Five Courtyards) shopping center, which features an impressive walkway adorned with hanging foliage. Not your everyday cybersecurity center.
In its favor: The bid boasts of Munich’s reputation as a “renowned key European cybersecurity hub” — and the city has the credentials to back it up. The Munich Security Conference takes place every year, and many cyber-focused organizations are based here including The Research Institute CODE, the IBM Q Hub, and CONCORDIA, one of the four Horizon 2020 pilot projects.
Cause for concern: Germany, the EU’s largest member country, hosts two EU agencies already. The country is also sometimes hesitant to share too many competences with EU policymakers on cybersecurity. Locating the center in Munich could rub EU officials as well as smaller EU countries the wrong way.
Estimated cost: All proposed premises and offices would be offered free of charge, with costs for setup being paid “to a certain extent” by Bavaria as part of the rent. What’s more, all children of EU civil servants will be able to attend the European School Munich cost-free.
Vilnius, Lithuania
What it would look like: Soaring. The Lithuanian government wants to host dozens of EU cybersecurity officials on the site of its iconic TV tower in Vilnius — the largest structure in the country.
In its favor: Lithuania has a strong reputation on cybersecurity. In part, that’s because “cybersecurity, both military and civilian, are in the same hands: the ministry of defense,” said Raimundas Karoblis, the country’s departing defense minister in an interview on November 27. “We expect the center to benefit from our booming national cybersecurity and digital ecosystem,” he added.
Cause for concern: Location, location, location. For years, the seat of the EU’s official cybersecurity agency ENISA, in Greece, has been a point of criticism that it was too far from the EU power center. Putting its cyber competence center at the geographical fringes of the bloc could cause similar concerns.
Estimated cost: “Minimal costs.” That’s what Karoblis put forward as the country’s unique selling point. “The financial costs of our competitors exceed ours, making them less budgetarily prudent and cost-efficient.”
Luxembourg, Luxembourg
What it would look like: Tall and shiny — but nondescript. Luxembourg’s proposal has identified several suitable locations, one of which is the imaginatively named “Tower B” in the city’s Kirchberg quarter.
In its favor: There are several digital units from the European Commission already established in Luxembourg — with more digital services to come under the Commission’s Digital Pole initiative. The city’s multilingual makeup is also bound to be a bonus.
Cause for concern: Luxembourg is the smallest-but-one EU country by population and yet it already has two EU agencies and plenty of EU officials working there. How much is too much?
Estimated cost: The proposed premises will come free of charge and the country’s pitch stresses the innate “cost-effective” nature of a city as connected as Luxembourg. Plus, all public transport in the city has been made free as of March 1, 2020.
Warsaw, Poland
What it would look like: The government offered three potential locations, one of which would be in the flashy Warsaw Spire building in central Warsaw.
In its favor: Polish Prime Minister Mateusz Morawiecki threw his hat in the ring last month when he wrote to counterparts that the government has invested heavily in its cybersecurity capabilities and offers a well-connected and attractive location for the center. Poland, as the EU’s fifth-largest member country by population, also hosts just one agency, border agency Frontex.
Cause for concern: Poland’s application has been a tad sloppy and lacked a brochure to lure people in.
Estimated cost: The government is covering the rent for 10 years. It’s also covering schooling costs for children of the center’s staff for the first 10 years.
Bucharest, Romania
What it would look like: One proposed location is a renovated neoclassical villa, another a modern office block. Pick and choose.
In its favor: Romania has pushed hard for its proposal. “We were the first member state who was interested in hosting the new [center]. And above all we are the only country in this competition who does not host any European agency or body,” said Alexandru Nazare, the country’s representative at Monday’s EU telecom council meeting. Romania also ranks third in EU statistics on women employees in ICT and 24 percent of ICT graduates in Romania are female, its proposal said. (Then again, Lithuania ranks second on that list.)
Cause for concern: Unlike the others, Romania’s proposal does not indicate it can support specific document management or that it can support “EU SECRET” classified information — for now.
Estimated cost: Unlike some of the other bids, Romania’s proposed premises will not be offered free of charge. Its application has not provided information on estimated set-up costs.
León, Spain
What it would look like: León is offering its old train station building as the location, giving it a 19th-century industrial vibe.
In its favor: The Spanish city got endorsements from business groups in past days, most notably from the International Chamber of Commerce this month. Spanish secretary of state for digitization Carme Artigas also told reporters that putting the center in León would mean “that investment in technology can be outside the main cities.” The city is also the seat of the National Institute of Cybersecurity (INCIBE).
Cause for concern: The European Commission with its 5G security toolbox put a lot of emphasis on this for its broader cybersecurity policy. But Spain — despite saying it is aligning with the EU’s toolbox — has so far refrained from imposing hard limits on “high-risk vendors.” Spain also has three EU agencies already.
Estimated cost: The Spanish government, too, is picking up the bill for rent and refurbishing of the building. The center also wouldn’t have to pay for radio spectrum frequencies it needs to do its job, the proposal said.