EU sanctions in response to cyber-attacks as crime-based emergency measures

Abstract

This contribution seeks to explore the growing use of administrative measures in response to cybercrimes by analysing the specific case of sanctions in response to cyber-attacks. They constitute a novel crime-based sanctions regime, laying the foundations of personalised deterrence with respect to malicious cyber actors and consist in asset freezes and visa bans. This article reflects on the hazy boundary between crime-based sanctions as administrative or criminal law measures. The paper argues that while crime-based sanctions in response to cyber-attacks present certain similarities with criminal law measures, they remain complementary crime prevention instruments. Their administrative nature allows for an emergency response to malicious cyber operations that would not be permissible if a more stringent evidentiary standard was required.