Introductory text

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Council Regulation (EU) 2019/796 of 17 May 2019 concerning restrictive measures against cyber-attacks threatening the Union or its Member States^f1, and in particular Article 13(1) thereof,

Having regard to the proposal from the High Representative of the Union for Foreign Affairs and Security Policy,

Whereas:

On 17 May 2019 the Council adopted Regulation (EU) 2019/796.

Targeted restrictive measures against cyber-attacks with a significant effect which constitute an external threat to the Union or its Member States are among the measures included in the Union’s framework for a joint diplomatic response to malicious cyber activities (the cyber diplomacy toolbox) and are a vital instrument to deter and respond to such activities.

In order to prevent, discourage, deter and respond to continuing and increasing malicious behaviour in cyberspace, two natural persons and one body should be included in the list of natural and legal persons, entities and bodies subject to restrictive measures set out in Annex I to Regulation (EU) 2019/796. Those persons and that body are responsible for or were involved in cyber-attacks with a significant effect which constitute an external threat to the Union or its Member States, in particular the cyber-attack against the German federal parliament (Deutscher Bundestag) which took place in April and May 2015.

Annex I to Regulation (EU) 2019/796 should therefore be amended accordingly,

HAS ADOPTED THIS REGULATION: