A Comparative Study of the Legal Framework for Combating Cyberterrorism in Iranian and EU Law

Document Type : Original Article

Author

Master of Criminal Law and Criminology, Islamic Azad University, Lahijan Branch, Gilan, Iran

10.5281/zenodo.23168833
Abstract
Cyberterrorism is not synonymous with serious hacking, ideologically motivated disruption, terrorist propaganda, or state-sponsored cyber operations. This article compares how Iranian law and European Union law address digitally enabled violence and interference that may meet a terrorism threshold, while also assessing ordinary cybercrime, critical-infrastructure security, electronic evidence and procedural safeguards. Employing a qualitative doctrinal and functional comparative method, it reads Iran’s Computer Crimes Act against the EU Counter-Terrorism Directive, the attacks-against-information-systems framework and the layered cybersecurity acquis, with developments through 24 September 2026. It finds a shared capacity to prosecute harmful interference with essential systems but significant differences in the express legal link between cyber interference and terrorist purpose, the distribution of preventive duties and the architecture of cross-border evidence. The comparison also demonstrates that resilience laws cannot replace criminal-law proof of intent and that cybersecurity incident datasets must not be treated as estimates of terrorist offending. The article proposes tightly defined offence criteria, interoperable evidence safeguards and risk-based infrastructure protection without conflating political expression, cybercrime and terrorism. [R01-R17, R20]

Graphical Abstract

A Comparative Study of the Legal Framework for Combating Cyberterrorism in Iranian and EU Law

Keywords

Subjects

[R01] Islamic Republic of Iran. (2009). Computer Crimes Act (Law No. 71063), arts. 1-11, 28 and 32-34 [Persian original; English excerpts in UNODC SHERLOC]. 
[R02] United Nations Office on Drugs and Crime. (n.d.). SHERLOC legislative database: Iran, Computer Crimes Act, arts. 28-31.
[R03] European Parliament and Council. (2013). Directive 2013/40/EU on attacks against information systems. Official Journal of the European Union. 
 [R04] European Parliament and Council. (2017). Directive (EU) 2017/541 on combating terrorism. Official Journal of the European Union. 
 [R07] European Parliament and Council. (2022). Directive (EU) 2022/2557 on the resilience of critical entities (CER).  
[R15] European Union Agency for Cybersecurity (ENISA). (2025). ENISA Threat Landscape 2025 (reporting period: 1 July 2024-30 June 2025).
[R16] European Union Agency for Cybersecurity (ENISA). (2026). ENISA Threat Landscape 2026 (reporting period: January-December 2025), published 22 September 2026. 
[R17] Financial Action Task Force (FATF). (2026, June 19). High-Risk Jurisdictions Subject to a Call for Action.  
[R19] Kian pour, M., Earls Davis, P. A., & Windekilde, I. M. (2025). Digital sovereignty in practice: analyzing the EU’s NIS2 directive. International Journal of Information Security, 24, Article 167.       
[R21] Fidler, M. (2025). Fragmentation of international cybercrime law. University of Louisville Law Review, 2025, 737 et seq.
 [R25] European Union. (2016). Regulation (EU) 2016/679, General Data Protection Regulation (GDPR).  
 [R26] European Union. (2012). Charter of Fundamental Rights of the European Union, especially arts. 7, 8, 11, 47-49 and 52.