While many viruses and other types of malware are designed simply to cause chaos, more and more malware is
created by organized crime to steal credit card numbers, online banking credentials, and other sensitive data.
What Article 28 (3) with its omission of public policy grounds seems to suggest in my view is that — to a certain extent — the mere fact of a 10 years residence has
created a link between the EU citizen and the host Member State that is similar to the link between a national and its state; as a consequence expulsion can only be a valid means if this link is deliberately destroyed
by the EU citizen; this would be the case of a serious security threat, i.e. an individual determined to engage in actions that jeopardize the security of the host Member State's society at large, which could indeed be the case of
organized crime.