Well, not just content, but also activity like making fake sites to steal credentials, send out phishing emails/texts, and that kind of thing. I guess that may fall under the same point though, of the law not being universal regarding these activities, e.g. talk of some governments ignoring bad actors so long as their activities only target other nations’ citizens.