The last three decades have seen the development of the European Union (EU) as a security actor. The transnational character of the security threats and the challenges identified by the EU have led to progressive integration between internal and external security concerns. These concerns have often led to calls for greater coherence within EU security policies. The literature, however, indicates that this need for coherence has, so far, not been systematically operationalized, leading to a fragmented security field. This article has two main aims: To devise a framework for the analysis of the EU's coherence as a security actor, and to apply it to the cybersecurity field. By focusing on EU cybersecurity policy, this article will explore whether the EU can be considered a coherent actor in this field or whether this policy is being implemented according to different and unco-ordinated rationales.

The protection of cyberspace has become one of the highest security priorities of governments worldwide. The EU is not an exception in this context, given its rapidly developing cyber security policy. Since the 1990s, we could observe the creation of three broad areas of policy interest: cyber-crime, critical information infrastructures and cyber-defence. One of the main trends transversal to these areas is the importance that the private sector has come to assume within them. In particular in the area of critical information infrastructure protection, the private sector is seen as a key stakeholder, given that it currently operates most infrastructures in this area. As a result of this operative capacity, the private sector has come to be understood as the expert in network and information systems security, whose knowledge is crucial for the regulation of the field. Adopting a Regulatory Capitalism framework, complemented by insights from Network Governance, we can identify the shifting role of the private sector in this field from one of a victim in need of protection in the first phase, to a commercial actor bearing responsibility for ensuring network resilience in the second, to an active policy shaper in the third, participating in the regulation of NIS by providing technical expertise. By drawing insights from the above-mentioned frameworks, we can better understand how private actors are involved in shaping regulatory responses, as well as why they have been incorporated into these regulatory networks.

While issues relating to the development, legitimacy and accountability of the European Police Office, Europol, have been intensively discussed in political and academic circles, the actual impact of Europol on policy-making in the European Union has yet to receive scholarly attention. By investigating the evolution and the role of Europol's organized crime reports, this article elaborates on whether Europol has been able to exert an influence beyond its narrowly defined mandate. Theoretically informed by the assumptions of experimentalist governance, the article argues that the different legal systems and policing traditions of EU member states have made it difficult for the EU to agree on a common understanding on how to fight against organized crime. This lack of consensus, which has translated into a set of vague and broadly formulated framework goals and guidelines, has enabled Europol to position its Organized Crime Threat Assessments as the point of reference in the respective EU policy-making area. Europol's interest in improving its institutional standing thereby converged with the interest of different member states to use Europol as a socialization platform to broadcast their ideas and to 'Europeanize' their national counter-organized crime policy.

No abstract