The EU’s Cybercrime and Cyber-Security Rule-Making: Mapping the Internal and External Dimensions of EU Security

EU Security impacts significantly upon individuals and generates many questions of the rule of law, legal certainty and fundamental rights. These are not always central concerns for EU risk regulation, especially given that EU risk regulation has sought to draw close correlations between EU risk and market regulation.

The relationship between internal and external security policies of the EU is both a descriptive and normative challenge, as much as it is for the regulation of risk. This phenomenon is evident in EU rule-making in the area of cyber policies, as a contemporary case study of the process of rule-making in both internal and external security as well as providing an insight into their specific relationship in its formulation and regulation of risk. Cyber regulation inherently necessitates multi-level risk regulation, employing international and supranational components and local enforcement.

The paper explores that the link between the EU’s external and internal rule-making in cybercrime and cyber security is explicit in the rule-making The account examines how the distinction between external and internal security in contemporary EU law manifests itself in large-scale risk regulation and in particular, how the EU relies upon external norms to regulate risk.