Preventing or Mitigating Adversarial Supply Chain Attacks; a legal analysis

TL;DR

This paper analyzes legal approaches to preventing and mitigating adversarial supply chain attacks, highlighting the limitations of current national laws and the potential of EU law to better address cybersecurity threats.

Contribution

It provides a legal analysis of supply chain attack mitigation, emphasizing the need for more specific regulations and the potential of EU law to improve cybersecurity measures.

Findings

Current national laws lack technology-specific regulations.

EU law shows promise in addressing supply chain cybersecurity.

Vigilance is necessary to combat large-scale supply chain threats.

Abstract

The world is currently strongly connected through both the internet at large, but also the very supply chains which provide everything from food to infrastructure and technology. The supply chains are themselves vulnerable to adversarial attacks, both in a digital and physical sense, which can disrupt or at worst destroy them. In this paper, we take a look at two examples of such successful attacks and consider what their consequences may be going forward, and analyse how EU and national law can prevent these attacks or otherwise punish companies which do not try to mitigate them at all possible costs. We find that the current types of national regulation are not technology specific enough, and cannot force or otherwise mandate the correct parties who could play the biggest role in preventing supply chain attacks to do everything in their power to mitigate them. But, current EU law is on the right path, and further vigilance may be what is necessary to consider these large threats, as national law tends to fail at properly regulating companies when it comes to cybersecurity.