The EU's cross-border cybercrime enforcement and the limits of extraterritorial jurisdiction

Abstract

This article examines the European Union’s external dimension in the crossborder fight against cybercrime and assesses its compatibility with the limits of extraterritorial jurisdiction under general international law. Cybercrime, as a structurally transnational phenomenon, challenges traditional jurisdictional doctrines due to the fragmentation of offenders, victims, and digital infrastructures across multiple legal orders. In response, the European Union has developed an increasingly integrated framework for cross-border criminal cooperation in cyberspace. This framework includes mechanisms for the preservation and cross-border access to electronic evidence, enhanced operational cooperation between EU and third-state law enforcement authorities, and the external projection of EU standards in cybercrime investigation and judicial cooperation. The article argues that these developments reflect an emerging form of functional extraterritoriality embedded within the EU’s external action in the field of criminal justice. While certain measures may be justified under established bases of prescriptive jurisdiction in international law, such as the effects doctrine and the protection of essential interests, other practices raise concerns where they generate de facto enforcement effects beyond EU territory without clear consent of affected third states. Methodologically, the analysis is based on doctrinal interpretation of international jurisdictional principles and relevant EU legislative and cooperative instruments. The article concludes that the EU has become a central actor in shaping global cybercrime enforcement architecture, yet its expanding cross-border reach exposes unresolved tensions between effective transnational crime control and the constraints of state sovereignty under international law.