How the EU combats cybercrime

Cybercrime in the EU

Cyberattacks and cybercrime are increasing across Europe, both in number and in sophistication. This trend is set to grow further as the number of connected households and devices increase. In 2024 94% of households in the EU had access to the internet, compared to around 80% in 2014. 71% of individuals aged 16-74 years in the EU used internet connected devices in 2024.

Cybercrime refers to criminal activities carried out using electronic communication networks and information systems. It takes various forms. For example, criminals can:

gain control over personal devices using malware
steal or compromise personal data and intellectual property to commit online fraud
use internet and social media platforms to distribute illegal content
use the 'darknet' to sell illicit goods and hacking services

Some forms of cybercrime, such as child sexual exploitation online, cause serious harm to their victims.

EU measures against cybercrime

The EU is working to combat online criminal activity and strengthen online security across Europe. Its measures are designed to:

enhance the prevention, investigation, and prosecution of cybercrime, including child sexual exploitation

collaborate with industry partners to empower and protect citizens online

strengthen the capabilities of law enforcement agencies and the judiciary

Through these efforts, the EU aims to create a safer and more resilient digital environment for everyone.

Cybercrime prevention and investigation

Several key centers within the EU play a crucial role in preventing and investigating cybercrime activities:

the European cybercrime centre, a specialised agency set up by Europol, helps EU countries investigate online crimes and dismantle criminal networks
the European multidisciplinary platform against criminal threats (EMPACT) is a security initiative driven by member states that identifies and addresses threats posed by organised international crime. Countering cyberattacks is one of its priorities.

Safety of children online

In 2021, the EU adopted a law on temporary measures allowing providers of electronic communications services, such as web-based email and messaging services, to continue to detect, remove and report child sexual abuse online, also covering anti-grooming, until permanent legislation is in place. Those measures entered into force in August 2021 and expired in 2024. In April 2024, the EU extended the measures until April 2026.

In May 2022, the European Commission proposed new legislation to tackle online child sexual abuse and exploitation. The new rules are currently being discussed at the Council.

Non-cash payment fraud

Fraud and counterfeiting involving non-cash means of payment pose a serious threat to the EU's security and provide a significant source of income for organised crime. Moreover, this kind of fraud affects consumers' confidence in the security of digital technologies.

In April 2019, the EU adopted rules to combat non-cash payment fraud.

The EU puts in place tighter rules to combat non-cash payment fraud (press release, 9 April 2019)

Justice and law enforcement

EU rules and policies also tackle other justice and law enforcement aspects of the fight against cybercrime and crime in general, such as access to e-evidence, encryption and data retention.

Access to e-evidence

Criminals exploit digital technology to commit offences and conceal illicit activities. Law enforcement and judicial authorities are therefore relying increasingly on electronic evidence, such as texts, emails or messaging apps, for their criminal investigations and prosecutions.

That is why the EU is working on new rules which will make access to e-evidence across borders easier and faster.

Better access to e-evidence to fight crime

Encryption

The EU is striving to establish an active discussion with the technology industry to strike the right balance between ensuring the continued use of strong encryption technology and guaranteeing the powers of law enforcement and the judiciary to operate on the same terms as in the offline world.

In December 2020, the Council adopted a resolution on encryption, highlighting the need for both security through encryption and security despite encryption.

Encryption: Council adopts resolution on security through encryption and security despite encryption (press release, 14 December 2020)

Data retention

To fight crime effectively today, it is important that service providers retain certain data that can be disclosed under certain strict conditions for the purpose of combating crime. However, data retention can infringe individual fundamental rights, in particular the right to privacy and the right to the protection of personal data.

The Council adopted conclusions regarding the retention of electronic communication data for the purpose of combating crime. The Council tasked the Commission with gathering further information and organising targeted consultations as part of a comprehensive study on possible solutions for retaining data, including the consideration of a future legislative initiative.