The criminalization of hacking tools as a reasonable measure of protection regarding attacks against information systems and computer data By Chatziioannou Konstantinos, LLM (Heidelberg), LLM (Aristotle University), PhD candidate, Aristotle University of Thessaloniki, Faculty of Law, Department of Criminal Law and Criminology, Scholar of Program “Heraclitus II”

HACKING TOOLS

Possible threats

International provisions regarding the criminalization of acts related to hacking tools Convention on Cybercrime Article 6 – Misuse of devices 1 Each Party shall adopt such legislative and other measures as may be necessary to establish as criminal offences under its domestic law, when committed intentionally and without right: a the production, sale, procurement for use, import, distribution or otherwise making available of: i a device, including a computer program, designed or adapted primarily for the purpose of committing any of the offences established in accordance with Articles 2 through 5; ii a computer password, access code, or similar data by which the whole or any part of a computer system is capable of being accessed, with intent that it be used for the purpose of committing any of the offences established in Articles 2 through 5 Proposal for a Directive on Attacks against information systems Article 7 Tools used for committing offences ( 1) Member States shall take the necessary measures to ensure that the production, sale, procurement for use, import, distribution or otherwise making available of the following is punishable as a criminal offence when committed intentionally and without right, with the intent that it be used for the purpose of committing any of the offences referred to in Articles 3 to 6 at east for cases which are not minor: (a) (…) a computer program, designed or adapted primarily for the purpose of committing any o f the offences referred to in Articles 3 to 6 (b) a computer password, access code, or similar data by which the whole or any part of an information system is capable of being accessed.

Comparison of provisions that prescribe the criminalization of preparatory acts Convention on Cybercrime Article 6 – Misuse of devices 1 Each Party shall adopt such legislative and other measures as may be necessary to establish as criminal offences under its domestic law, when committed intentionally and without right: a the production, sale, procurement for use, import, distribution or otherwise making available of: i a device, including a computer program, designed or adapted primarily for the purpose of committing any of the offences established in accordance with Articles 2 through 5; ii a computer password, access code, or similar data by which the whole or any part of a computer system is capable of being accessed, with intent that it be used for the purpose of committing any of the offences established in Articles 2 through 5 International Convention for the Suppression of Counterfeiting (1929) Art. 3 par. 5 The following should be punishable as ordinary crimes: …(5) The fraudulent making, receiving or obtaining of instruments or other articles peculiarly adapted for the counterfeiting or altering of currency.

Article 149 of the German Criminal Code Article 149 Preparatory acts (1) Whosoever prepares to counterfeit money or stamps by producing, procuring for himself or another, offering for sale, storing or giving over to another plates, frames, type, blocks, negatives, stencils, computer programs or similar equipment which by their nature are suitable for the commission of the offence …. shall be liable to imprisonment not exceeding five years or a fine if he was in the process to counterfeit money, otherwise with imprisonment not exceeding two years or a fine

Provisions of the EU law that prescribe the criminalization of acts that are related to programs peculiarly adapted to committing specific crimes Framework Decision on increasing protection against counterfeiting in connection with the introduction of euro General offences 1. Each Member State shall take the necessary measures to ensure that the following conduct is punishable: … (d) the fraudulent making, receiving, obtaining or possession of — instruments, articles, computer programs and any other means peculiarly adapted for the counterfeiting or altering of currency Framework Decision on combating fraud and counterfeiting of non-cash means of payment Article 4 Offences related to specifically adapted devices Each Member State shall take the necessary measures to ensure hat the following conduct is established as a criminal offence when committed intentionally: the fraudulent making, receiving, obtaining, sale or transfer to another person or possession of: — instruments, articles, computer programmes and any other means peculiarly adapted for the commission of any of the offences described under Article 2(b);

Difficulties in delimitating hacking tools from programs that control the c.i.a. of information systems and electronic data Hacking tools Programs that control the c.i.a. of information systems and electronic data

Proposals Formulation of reservation based on Art. 6 par. 3 of the Convention on Cybercrime regarding the mere possession of hacking tools De legende ferenda criminalization of acts related to the production and distribution of programs that are exclusively designed or adapted for committing crimes against the c.i.a. of the information systems and electronic data