The EU's Cybercrime and Cyber-Security Rulemaking: Mapping the Internal and External Dimensions of EU Security

Abstract

By taking the EU Cyber Strategy as a case in point, this contribution examines how the distinction between external and internal security in contemporary EU law manifests itself in large-scale risk regulation and in particular, how the EU relies upon external norms to regulate risk. This article also maps the evolution of the rule-making processes themselves.

Understanding the European Union's Perception of the Threat of Cyberterrorism: A Discursive Analysis

“…In some cases, stated EU aims and objectives have not been met, as EU agents have been rebuffed by their American counterparts (Christou and Simpson, 2011). This narrative, of a regional organization that is proactive in the politics of cyberspace is a common theme through the literature, notwithstanding some critiques (Guitton, 2013;Fahey, 2014;Sliwinski, 2014;Carrapiço and Barrinha, 2017;Christou, 2018). Sperling and Webber (2019) have argued that the EU can be said to have acted as a 'collective' securitising actor, including in the politics of cyber-security.…”

Discursive continuity and change in the time of Covid-19: the case of EU cybersecurity policy

“…The case of the Madrid (2004) and London (2005) attacks are particularly important as they opened up the window of opportunity for the area's second critical juncture. Although there is no change at the level of the underlying philosophy, there is a very important shift in programmatic terms, justified on the basis of the level of threat, with the EU moving from a soft law approach to a much more formalised approach, characterised by binding instruments and the creation of a dedicated policy area (Fahey 2014).…”

The collective securitisation of cyberspace in the European Union

“…In cybercrime, it has been trends rather than any major precipitating external event that has driven EU initiatives 3 (Fahey 2014;Wessel 2015). The first such trend has been the shift in The approach advocated by the Commission has meant explicit movement towards a type of security governance that entails both non-legal stakeholder interaction (supporting partnership, coordination) and regulatory interaction (legislation to add legal clarity and improve cooperation between law enforcement agencies).…”

“…This constitutes a threat to the achievement of a safer information society and an area of freedom, security and justice, and therefore requires a response at the level of the European Union (Council of the European Union 2005).Similar concerns were expressed on issues of sexual exploitation of children and child pornography giving rise to a 2004 Council Framework Decision (Council of the European Union 2004). That decision stipulated only minimal requirements in terms of approximation of legislation across EU Member States, and subsequently led to problems in prosecuting offenders within and between national borders(Fahey 2014). The legal logic behind these framework decisions, however, was to make coordination of efforts easier between the relevant public authorities (to improve horizontal stakeholder interaction) even if in practice there remained constraints given that there was no real collective culture of cybersecurity.The European Commission's communication A Strategy for a Secure Information Society (European Commission 2006) and the subsequent, broader Digital Agenda for Europe initiative (European Commission 2010) took coordination further.…”