Viet Nam’s pursuit of data sovereignty is reshaping its digital governance, while its implications for individual rights and digital markets require more careful consideration. The transition from the 2018 Cyber Security Law to the 2025 consolidated Cyber Security Law raises an important questions: how can data sovereignty be advanced while preserving legal certainty, rights protection, and digital economic growth? This article applies doctrinal analysis and a regulatory rule-of-law framework to analyse the clarity of new obligations, the proportionality of enforcement powers and penalties, restorative and resilience measures supporting trust and business continuity; and the balance between certainty and adaptability in a rapidly evolving digital economy. It suggests that while consolidation has improved textual coherence and enhanced the State capacity, but may also give rise to broad technology-neutral duties and significant administrative discretions. Without more contestable standards and carefully calibrated safeguards, these developments may place additional compliance burdens on businesses and affect investment confidence and rights protections in Viet Nam.

Hybrid threats represent a continued challenge to the European Union, combining disinformation campaigns with cyber-attacks as a means of destabilising the Union and its Member States, undermining legitimacy and public trust. With social media platforms at the centre of disinformation efforts, as well as potential sites for cyber-attack disruption, the ability to control narratives and disseminate content are essential to hybrid threat actors. Fake Activity Markets (FAMs) are websites offering services that can be used to generate fake engagement, in turn allowing for coordinated inauthentic behaviour online. These websites also constitute a cybersecurity threat in themselves, involved in distributing malware, harvesting user data or comprising information systems. This article seeks to explore the EU approach to hybrid threats and coordinated inauthentic behaviour using FAMs as a case study, highlighting the potential threats to the EU’s social and cyber resilience posed by these actors, the potential regulatory responses, and the ways in which the von der Leyen II Commission’s renewed emphasis on hybrid threats could provide for a more robust ecosystem for countering coordinated inauthentic behaviour.

After an introduction to the notions of cybersecurity and cybersecurity-related risks, this preface introduces four collected contributions on challenges and perspectives of EU cybersecurity policies in cyber-physical ecosystem.

Digital identity theft is not a new phenomenon. A crime occurs when an individual’s identity, such as their first name, last name, nickname or other identifying information, is unlawfully used or compromised in cyberspace. Recognizing the multiple devastating impacts of digital identity theft informed the formulation of Cybercrime Law No. 17 of 2023 by the Jordanian Legislature to address the crime. Article 5 of the same law explicitly outlines offences related to attacks on information systems, information networks and electronic websites. At the same time, Paragraph C criminalizes the act of impersonating the owner of a website, a crime closely linked to unauthorized access offences. Against this background, this paper critically interrogates the contents, strengths and shortcomings of Jordanian Cybercrime Law No. 17 of 2023. The paper contends that though the Jordanian Cybercrime Law has made significant strides in addressing digital crimes, particularly in cases involving identity theft, unauthorized access and digital forgery, the law still has specific gaps that must be strategically addressed to be holistically effective.

In the early 2000, cybersecurity breaches were classified as “Internet crimes” and therefore managed through the tools of the criminal justice system. The Budapest Convention on Cybercrime forged new incriminating provisions and new procedural guidelines, updating the categories of criminal law and criminal procedure for the digital age. This style, unfortunately, has proved to be insufficient. To face the growing number of threats, the EU has shifted towards a much more preemptive, administrative-law-based approach to cybersecurity, with a view to protect critical infrastructure and industries from disruptive attacks. The criminal layer, however, has not been replaced: the relevant, international instruments are still there, and they have been recently extended to cover more ground. The essay will examine the new wave of legislation on cybercrime such as the United Nations Cybercrime Treaty, trying to identify the interactions and the frictions between two different contrast strategies to abusive cyber operations.

E-commerce applications have significantly changed how people transact with each other. This includes digital advances that drive illegal wildlife trade. In Indonesia, the Conservation Act of 1990 was enacted before the internet revolution and does not, therefore, adequately cover online illegal wildlife trade. In this study we identified wildlife traded illegally through advertisements published by five large national e-commerce companies and one social media platform operating in Indonesia, using 39 keywords. We also analysed data on wildlife cybercrime court case outcomes, associated criminal networks and their modus operandi. Over 12 months, we found 996 advertisements for wildlife and wildlife products, including of 45 nationally protected species, from 421 accounts. Amongst the six platforms monitored, Facebook Marketplace had the highest illegal wildlife trade traffic. We found that those prosecuted for online illegal wildlife trade were given low sentences. Our analysis of wildlife legislation, focus group discussions and expert interviews showed that the Government of Indonesia Trade Law (2014) and Law on Electronic Information and Transactions (2008) cannot be used to prosecute online illegal wildlife trade cases because these laws do not acknowledge regulations for protected species. Our study emphasizes the urgency of revising the Conservation Act and changing the definition of trade to include advertisements of protected species. We recommend development of screening tools for advertisements and accounts on e-commerce platforms, review of community/user guidelines to prohibit trade of protected species, and strengthening the approach of combining multi-context laws with stakeholder cooperation to prosecute online illegal wildlife trade cases.

This article studies how ‘cybercrime’ is framed under the pre-existing regional prohibition regimes and how it would be reshaped under the auspices of the UN. This article adopts a sociolegal approach by integrating transnational criminal law (TCL) and the conceptual framework of recursivity. Observations and analyses show that (i) only the Budapest Convention has institutional capacity to shape ‘cybercrime’, while state behaviour of framing ‘cybercrime’ is actually subject to human rights instruments; (ii) states reach an exceptional compromise in transforming ‘cybercrime’ at the global level during the negotiations under the UN; and (iii) protection from cybercrime is emerging as a common interest. This author proposes that the normative changes of framing ‘cybercrime’ reflect the competition of states for normative power on the international plane; therefore, a pursuit of a universalist formula for countering cybercrime would not succeed owing to a lack of a global commitment to what basic norms and rules govern state behaviour in cyberspace. Lastly, this author proposes that transnational criminalization of cybercrime should seek a minimum public order at the first place because it is premature to provide any real global regulation at this moment.

The malicious use of artificial intelligence is growing rapidly, creating major security threats for individuals and the healthcare sector. Individuals with mental illness may be especially vulnerable. Healthcare provider data are a prime target for cybercriminals. There is a need to improve cybersecurity to detect and prevent cyberattacks against individuals and the healthcare sector, including the use of artificial intelligence predictive tools.

Targeted sanctions, namely asset freezes and travel bans, are no longer the province of foreign policy alone. They are increasingly often used by governments in response to crime, such as corruption, human rights abuse, cybercrime, drug trafficking, and transnational organized crime writ large. Such sanctions are imposed based on permissive evidential standards, such as that of “credible evidence” or “reasonable grounds to suspect.” Their advent has added a new layer to a multi-tier system of state responses to crime. First, there is the traditional approach of criminal prosecution and conviction based on the criminal standard of proof. Second, one rung below is non-conviction based asset forfeiture, a notionally civil confiscation of supposed proceeds of crime that eschews the need for compliance with a suite of criminal trial safeguards. At the third level of this hierarchy are crime-based targeted sanctions, which vest the state with the greatest latitude in dealing with suspected criminals. Based on a wide-ranging analysis of international practice, this article contends that not only are crime-based sanctions de facto a criminal justice tool, but also that a coherent set of principles is required to determine their relationship with other responses to criminal behavior.