It’s Lights Out on Xmas in EU Cyber War Game

Public and private sector cyber officials from 30 European nations kicked off a massive cyber war game today that includes hacks against internet-connected infrastructure and the cyber-induced blackout of an entire nation—during Christmas, no less.

The two-day war game, known as Cyber Europe 2016, will also incorporate drones, cloud computing, cyberattacks against mobile devices and ransomware, according to a news release from the European Union Agency for Network and Information Security, known as ENISA.

In a ransomware attack, hackers seize and scramble an organization’s records and won’t unscramble them unless the organization pays up.

» Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

This is the EU’s third biennial cyber exercise. The exercises revolve around fictional scenarios including cyberattacks that technology, policy and political leaders must respond to.

The 2014 exercise scenario, for example, centered on a series of increasingly sophisticated cyberattacks aimed at destabilizing EU energy markets and preventing EU leaders from passing a new tax to promote green energy, according to an after-action report .

The 2016 scenario, for the first time, will include simulated news coverage and social media responses aimed at “bringing in the public affairs dimension associated with cyber crises” and “increas[ing] realism to a level never seen before in cybersecurity exercises,” ENISA said.

ENISA shared few details about the 2016 scenario beyond the Christmas season attack. The agency did, however, release a slick video announcing the exercise that appears to portray a cyberattack against a nation’s electricity grid, replete with lightning flashes, sweaty brows, flashing computer code and an ominous figure in a hoodie. One scene in the video shows the lights going out across an urban landscape.

All 28 EU member nations will participate in the exercise along with Switzerland and Norway, ENISA said. Participants come from more than 300 organizations, including nations’ cybersecurity agencies, EU offices, internet, software and cloud computing companies, the agency said.

An after action report on the exercise is due out in 2017.

The biennial exercises are vital to help EU member nations stay prepared to combat evolving cyber threats, ENISA Director Udo Helmbrecht said in a statement.

“We are better prepared than we were, but that does not mean we have done enough and the work must continue,” Helmbrecht said. He added that “cyberattacks are more sophisticated than before” and “cybersecurity is not a state, it is a process.”