European External Action Service (EEAS): Auditors find security gaps in communications

Enlarge image

EU foreign policy chief Borrell: Security gaps in communication

Photo: Boris Pejovic / EPA

The European External Action Service (EEAS) is something like the EU's foreign and defense ministries rolled into one: it supports Foreign Affairs Representative Josep Borrell, who is also Vice President of the EU Commission. The EEAS is also responsible for the EU's common foreign, security and defense policy and also organizes the EU's diplomatic relations with other countries and international organizations.

That's complicated enough, one would think. But it is made even more difficult by sometimes massive deficiencies in communications technology, as shown by an audit by the European Court of Auditors (ECA), which SPIEGEL has seen.

The auditors wanted to check whether the Foreign Service was effectively coordinating between third countries, the Council of EU countries, the Commission, international organizations and the 145 EU delegations around the world. The EAD is fulfilling this task “for the most part well,” said Marek Opiola, who was responsible for the audit at the ECA. But he qualified: "We are issuing a warning." Among other things, there are "challenges in information management."

Systems “unsustainable”

That was expressed diplomatically, as it turns out when you read the report more closely. The EEAS and the EU representations deal with a “significant amount of information that must be handled securely,” says the ECA.

But in a survey of the EU's 145 missions, several ambassadors said that the most important system for exchanging classified information was "too slow for the internet speeds in their countries." Overall, the tools for secure communication are “unsustainable.”

This goes so far that employees often don't use the EAD's systems at all - and instead resort to creative solutions, such as commercially available messenger services. According to the auditors' report, this is actually forbidden at the EEAS.

When it comes to using the “Signal” messenger, the EEAS apparently turns a blind eye, at least as long as it only involves exchanging messages and not confidential documents. In the eyes of those responsible for the EEAS, Signal, say employees of the Court of Auditors, “is more in line with their security guidelines than other messengers.”

The desperation becomes understandable when you look at the organizational chart that the ECA report attempts to explain the communications jungle at the Foreign Service. At the EEAS alone there are three different systems for dealing with classified information. Two others work at the Commission and the Council of Member States, and the exchange between them works poorly or not at all. Sometimes you have to print out documents that you want to work on together and send them back and forth by post.

No uniform classifications

In the survey among the representatives, only one of the five communication systems was found suitable by a majority - but is less secure than the others. Overall, only 53 percent of those surveyed were of the opinion that they had tools that enable the secure exchange of documents with the EU Commission.

The EEAS apparently cannot even agree on uniform levels of secrecy internally - but instead uses a mixture of classifications, used partly by the Commission and partly by the EU states. “This increases the risk that an institution will receive a document with a security rating that is unknown to it and then send it via the wrong channel,” criticizes the Court of Auditors.

The problems are by no means new. The EAD had already launched an “information management strategy” in 2019, as the ECA report states. It was said at the time that the existing systems were “not completely suitable for the needs of the EEAS”. There are too many of them, they are complicated to use, cumbersome, do not enable efficient searches, are not interoperable and offer “semi-efficient functions”.

Perhaps this is also why the audit of the ECA apparently met with goodwill among the EEAS employees. According to the Court of Auditors, the response rate to the survey among the 145 delegations was 82 percent. "Many of our criticisms," one of the examiners told SPIEGEL, "had already been noticed by the Foreign Service itself."

An EEAS spokesman, however, explains that the “perceived sluggishness” of the system for transmitting classified information is partly due to its “irregular use in some delegations”. In addition, in some countries there is little to no internet infrastructure. 20 new satellite connections have been made available for such countries. In addition, the EAD completely overhauled its network last year and in some cases significantly increased bandwidths.

The Court of Auditors has now ordered the EEAS to ensure that the IT instruments for secure communication and the exchange of documents work better together. In addition, the EEAS should introduce a uniform system for classifying documents - as the Commission proposed in a draft law in March 2022.

However, it will probably take some time for all of this to happen. The Court of Auditors has given the EEAS a deadline of December 2025.