The EU’s Cybercrime and Cyber-Security Rulemaking

By taking the EU Cyber Strategy as a case in point, this contribution examines how the distinction between external and internal security in contemporary EU law manifests itself in large-scale risk regulation and in particular, how the EU relies upon external norms to regulate risk. This article also maps the evolution of the rule-making processes themselves.