CLE Conference, October 2002 CoE’s Cyber Crime Convention Content and background Prof. Dr. Henrik W.K. Kaspersen Vrije Universiteit Amsterdam The Netherlands

CLE Conference, Sydney October 24 & 25, Overview of the presentation n Reasons for international negotiations n Content of the cyber crime convention n Discussion of some dilemma’s n Meaning of the convention

CLE Conference, Sydney October 24 & 25, Procedure in the Council of Europe n Start :1997 n Completion: officially December 2000, factually August 2001 n Adoption by Committee of Ministers: November 2001 n Signature Ceremony: Budapest November 23, 2001 n ETS 185, coming into force: ??

CLE Conference, Sydney October 24 & 25, Negotiating Parties n Council of Europe Member States – 43 n Non-member States – U.S.A. – Canada – Japan – South Africa

CLE Conference, Sydney October 24 & 25, Signatories to the Convention EU-member states (out of 15): 13 Non-European States: 4 === (includes All G-7) 17 Other CoE members states, 16 === Parties to the Convention 33 Ratifications: 1

CLE Conference, Sydney October 24 & 25, Aims of the Cyber Crime Convention n Harmonisation of criminal substantive law, basis R (89) 9. n Harmonisation of criminal procedural law, basis R (95) 13. n Instruments for mutual legal assistance, basis existing co-operation instruments. n Codification of international law n Framework for future developments

CLE Conference, Sydney October 24 & 25, Scope of the Cyber Crime Convention n Minimum character n Substantive law: – categorisation; distinction cyber crime in narrow and in broad sense. n Procedural law – specific investigative powers related to IT, preliminary measures

CLE Conference, Sydney October 24 & 25, Scope CCC- continued n Mutual assistance – supplementing existing bilateral and multilateral instruments – extradition with regard to cybercrimes – scope of application of coercive powers – further assistance

CLE Conference, Sydney October 24 & 25, Harmonising of substantive criminal law n Cyber crime in the narrow sense – C.i.a.-offences: artt. 2-6 n Cyber Crime in the broader sense: – Computer-related offences: artt. 7-8 – Content-related offences: art. 9 – I.p.r.-related offences: art. 10 n Accessory provisions: artt n Civil and criminal liability legal persons

CLE Conference, Sydney October 24 & 25, General provisions n Definitions: art. 1 – computer system – computer data n Notion: “without right” n Notion: “intentionally”

CLE Conference, Sydney October 24 & 25, Content-related offences n Child porn – Defines child porn material n refers to sexually explicit conduct including adult actors and realistic virtual material – Criminalised Conduct n possession, production, distribution of digital child porn material including procurement, offering, making available by means of a computer system n Exemptions: to be defined under domestic law as “with right”

CLE Conference, Sydney October 24 & 25, Issues considered but not included n Surreptitiously gathering of personal data (“Cookies”) n Spam (unsolicited ) n Spoofing and integrity internet- communications n Racism and xenophobia (see hereafter) n Other Content-related offences (e.g. gambling) n (Non)-liability of ISP’s

CLE Conference, Sydney October 24 & 25, Jurisdiction n Scope art. 22: only relating to substantive provisions n Principle: territoriality n Includes ships and aircrafts n Restricted nationality principle n Dedere aut judicare n Determining jurisdiction (substantial link) n Conflicts: Consulting mechanism

CLE Conference, Sydney October 24 & 25, Criminal procedural law n Starting point: Recomm. CoE R(95) 13 n Aim: gathering of electronic evidence of a specific criminal offence n Scope: cyber crimes art.14: a) offences established in the CCC; b) computer system instrument of the crime; c) any other crime for which electronic evidence is needed.

CLE Conference, Sydney October 24 & 25, Criminal Procedural law- general principles n Scope: art. 14 relating to art. 20/21 n Scope, conditions and safeguards art. 15: domestic law n Distinction between stored data (in existence) and flowing data (in transmission)

CLE Conference, Sydney October 24 & 25, Definitions n Art. 1 – computer system n stand-alone, networks, telecommunication systems – computer data – service provider: communication services: TO and ISP equal footing – traffic data: functional definition (path, source)

CLE Conference, Sydney October 24 & 25, Measures concerning stored computer data n Search of computer system and files: art. 19 n Production order: art. 18 n Expedited preservation: art. 16 n Expedited preservation of stored traffic data: art. 17

CLE Conference, Sydney October 24 & 25, Preservation of traffic data n EU-directive Telecommunications and Privacy 1997: – deletion of non-billing data – 2002-review: extension to marketing – mandatory retention possible n Other Parties: no privacy restrictions n Principle CCC: “preserve traffic data as is” n G8: establish necessary traffic data

CLE Conference, Sydney October 24 & 25, Real time collection of traffic data/interception of content n Art. 20/21 parallel in structure n Art. 21: serious crime only (domestic law) n Specific communication by means of a computer system n Direct through Law enforcement authorities or with assistance of service provider n “As is available”, no technical requirements n Confidentiality clause possible

CLE Conference, Sydney October 24 & 25, Measures considered but not included n Measures to restrict proliferation of encryption n Order to undo encryption n Specification of individual safeguards n Mandatory retention of traffic data – efficacy vs burden innocent third parties – reasonable time limit – legal safeguards n Harmonisation of collection/interception powers

CLE Conference, Sydney October 24 & 25, International mutual legal assistance n General principles, art. 24, 26 – to the widest extent possible – scope: art. 14 – expedited, flexible, modern means of (direct) communication – basis always domestic law – no refusal possible for fiscal offences – flexible interpretation of ‘dual criminality’ – spontaneous information

CLE Conference, Sydney October 24 & 25, Mutual legal assistance in general n Extradition: extraditable offences (art. 24) n Factual co-operation:  Can the request be executed on the basis of an existing bilateral or multilateral instrument? (EI) Y, proceed. N, apply art. 27 CCC (comprehensive set for MLA).  Is the application of specific measures necessary? Apply CCC or EI or both.

CLE Conference, Sydney October 24 & 25, Mutual legal assistance- specific measures n Expedited preservation of computer data (art. 29) n Expedited partial disclosure in case of traffic data (art. 30) n Access to computer systems and data (art. 31) n Transborder investigative measures that are lawful (art. 32) n Real time collection of traffic data (art. 33) n Real time interception of content (art. 34) n 24/7 network  central authority

CLE Conference, Sydney October 24 & 25, Transborder investigative measures n CCC: only through MLA, except – Accessing and downloading of “Open source” – With permission of the person in control on the territory – Possibly through production order of art. 18 n EU MLA: interception of satellite communications: notification

CLE Conference, Sydney October 24 & 25, Mutual assistance instruments considered but not included n Adaptation of existing MLA- instruments n Data protection exception n Misuse of jurisdiction (U-turn) n International order for collection/retention of traffic data n Trans-border network search

CLE Conference, Sydney October 24 & 25, Final provisions n Coming into force: 5 ratifications required n Accession: unanimity of Parties and majority of Committee of Ministers CoE n Declarations, reservations n Conference of Parties n Amendments n Dispute Resolution: no court but consultation

CLE Conference, Sydney October 24 & 25, Cyber Crime Convention- final observations (I) n Minimum character: electronic environment n Framework character: ongoing development n Need for flanking, internationally co- ordinated measures n Enhances practical co-operation of law enforcement authorities – exchange of expertise – training and education – prevention

CLE Conference, Sydney October 24 & 25, Cyber Crime Convention - final observations (II) n Transparency of the drafting process n Industry and NGO involvement n Human rights and privacy concerns

CLE Conference, Sydney October 24 & 25, st Additional Protocol on Racism and Xenophobia Procedure: – decision by CDPC in June 2001 – drafting December 2001-April 2002 – adoption CDPC June 2002; Parliamentary Assembly September 2002 – adoption by Committee of Ministers November 6, 2002 – opening for signature: January 2003

CLE Conference, Sydney October 24 & 25, Meaning of the Protocol n Harmonising criminal offences concerning dissemination of racist and xenophobic material and related acts in computer networks n Provide for adequate means of criminal investigations as defined by the Cyber Crime Convention n Most Parties to the Convention

CLE Conference, Sydney October 24 & 25, Crimes under the 1st Add. Protocol n art. 3: dissemination n art 4: threats n art. 5: insults n art. 6: denial n art. 7: aiding and abetting

CLE Conference, Sydney October 24 & 25, art. 2: racist and xenophobic material n written or any other representation – data carrier n thoughts and theories n advocating, promoting, inciting n hatred, discrimination, violence n race, colour, decent, national or ethnic origin, religion (qualified)

CLE Conference, Sydney October 24 & 25, art. 3: dissemination n dissemination or otherwise making available through a computer system – excludes private communications – excludes production, possession, procurement n racist and xenophobic material (art. 2) n intentionally n without right n reservation clauses concerning discrimination

CLE Conference, Sydney October 24 & 25, art. 4 threats n threat – (private communications included) n with commission of a serious crime n factors from art. 2

CLE Conference, Sydney October 24 & 25, art. 5 insults n insulting publicly n intentionally/without right n factors from art. 2 n reservation clauses

CLE Conference, Sydney October 24 & 25, art. 6 denial n denial, gross minimisation, n holocaust or future genocide or crime against humanity n reservation clause

CLE Conference, Sydney October 24 & 25, Other issues n attempt of art. 3-6 not criminalised n copying definitions and notions of the Cyber Crime Convention n powers and instruments of the Cyber Crime Convention applicable

CLE Conference, Sydney October 24 & 25, Not included in the Protocol n factors of art. 2: gender, sexual nature, age etc. n set up, running and supporting of racist and xenophobic associations n specific investigative measures

CLE Conference, Sydney October 24 & 25, Conclusion n framework of human rights, Rome Convention 1950 n major step forward in global approach since UN-CERD 1967 n meaning Protocol not restricted to – computer networks – scope of art. 2; role national legislator /court – model law