Whisper “Trickbot” or “Conti,” and cybersecurity experts will be spooked. These are pieces of malware and ransomware used by a gang of Russia-based hackers to sneak into computer servers and demand at least $800 million from Western corporations, hospitals, and government agencies. In February and September, Britain and the United States imposed joint sanctions on 18 members of the hacker syndicate behind the attacks. In doing so, Washington and London dealt a blow not just to the hackers but also to Moscow: The Trickbot-Conti gang has supported the invasion of Ukraine and probably received directions from Russian security services. The sanctions ban the syndicate’s members from traveling to the United States or Britain and freeze their assets in these countries. But there’s a catch: The European Union has not imposed sanctions, leaving the hackers free to operate in the bloc.
This apparent flaw is not an administrative glitch. Since Britain left the EU in 2020, London and Brussels have made sanctions decisions completely separately, and there is no formal mechanism to ensure alignment between British and European measures. This has resulted in regulatory divergences—a polite way to say sanctions loopholes—that Moscow and other malicious actors can exploit. The Trickbot-Conti gang is only one example of such exploitation, but it highlights the fact that restarting British-EU collaboration on sanctions is long overdue. Increased cooperation would be a quick and cheap way for Britain and the EU to close glaring sanctions loopholes and deal a blow to the Kremlin.
