The CYRENE project aims to promote trust and confidence of the European consumers, providers and suppliers by enhancing the security, privacy, resilience, accountability and trustworthiness of Supply Chains. One of the main impacts the project will achieve is to pave the way for a competitive and trustworthy Digital Single Market.

CYRENE aims to create certification schemes to support the security and resilience of SCs through the following schemes:

• Security Certification Scheme for Supply Chain (e.g. risk assessment tool and process);
• ICT Security Certification Scheme for ICT-based or ICT-interconnected Supply Chain;
• ICT Security Certification Scheme for SCs’ (e.g. Maritime, Transport or Manufacturing) IoT devices and ICT systems that should differ from traditional IoT and systems as more stress should be put on data protection and privacy issues.

Engaging AI, Information Mining and Deep Learning in security and privacy risk evaluation facilitate the detection and analysis of new, sophisticated and advanced persistent threats, the handling of complex cybersecurity incidents and data breaches and the sharing of security-related information.

In this context, CYRENE introduces AI and machine learning techniques to allow the systems and services to monitor a wider number of factors towards identifying patterns of abnormal activity. It relies on two main components: the artificial intelligence (AI) engine, and the threat intelligence. The AI engine produces optimal learning models for threat detection and enables efficient model update. Threat intelligence, on the other hand, offers real-time cyber threat monitoring and intrusion detection.

From an ethics perspective, the use of AI within CYRENE does not require close monitoring. Its purpose is not necessarily the processing of personal data, so the risks it presents for the rights of individuals are quite limited. The project focuses on more technical aspects of cyber threat monitoring and privacy assurance (the how) rather than on the information including personal data (the what) that may be put at risk due to a potential security incident.

Nevertheless, because the requirements that AI systems must meet in order to be deemed trustworthy remain applicable, Privanova as the ethics and legal lead of the project remain vigilant with this regard. Together with the Project Coordinator and relevant partners, we consider accountability as the key principle in the context of CYRENE. This, in particular concerns the auditability of AI systems. This aspect “enables the assessment of algorithms, data and design processes plays a key role therein, especially in critical applications.”