Perspectives for an effective European-wide fight against cybercrime Anne Flanagan Institute for Computer and Communications Law Centre for Commercial Law Studies, Queen Mary, University of London

Introductory Remarks l Transnational crime –Substantive & procedural harmonisation l EU: ‘First Pillar’, ‘Third Pillar’ & the Lisbon Treaty l Sanction & remedies l Policing cyberspace –Public & private law enforcement l The role of intermediary service providers –Council of Europe Guidelines for Co-operation (2008) –Controlling content & monitoring communications l Safeguarding rights

Sanction and remedy l Sentencing –statutory minimums, judicial discretion l Cyber Security Enhancement Act of 2002 –‘aggravating circumstances’ l e.g. EU Framework Decision, art. 7 l Restraint orders –Collard [2004] EWCA Crim 1664 l “..prohibited from owning, using, possessing or having any access to any personal computer, laptop computer or any other equipment capable of downloading any material from the Internet…” l Compensation –Civil enforcement, e.g. 18 U.S.C. § 1030(g)

Policing cyberspace l Public law enforcement –Industrial-scale & organised crime l e.g. US Landslide investigations & the UK 7000 –Local, national & international policing structures l e.g. reporting crimes –International co-operation l e.g. –‘Operation PIN’ –community policing in cyberspace: ‘simply another public place’

Policing cyberspace –Interaction with private sector l Exchanging information –e.g. Single Points of Contact (SPOCs) –Prosecution expertise l And judicial training –Pro-active intervention? l To ‘attack’ online resources

Policing cyberspace l Private law enforcement –private prosecutions l e.g. Federation Against Software Theft (FAST) –investigative & reporting functions l e.g. Computer Emergency Response Team (CERT) l e.g. Internet Watch Foundation –vigilantes l e.g. US v Jarrett 338 F.3d 339 (Va., 2003) –an ‘unholy alliance’?

Protected data l Biggest challenge for computer forensics in the 21 st Century –Access & conversion protections l Obtaining access –Requirement to provide in intelligible form –Requirement to hand over ‘key’ l “any key, code, password, algorithm or other data” l Failure to disclose in ‘a national security case’: 5 years l Self-incrimination? –S and A [2008] EWCA Crim 2177

Criminals and actors l Perpetrator –a criminal type? –motivation, opportunity & skill l From ‘script-kiddies’ to ‘überhackers’ l Inchoate offences –Attempt, conspiracy & incitement l Demanding supply l Misuse of devices, e.g. Convention, art. 6 l Intermediaries –communications service provider l limitations on liability

Intermediary liability l Service providers as gatekeepers –User-generated content l indecent or obscene, encouragement of terrorism…… l Electronic commerce Directive (00/31/EC) –‘mere conduit’, ‘caching’ & ‘hosting’ l ‘actual knowledge’ l Duties to report? –Monitoring and action l LVMH v Google (2009) l Commission review –Content aggregation, search engines, linking

Controlling illegal content l Notice and take-down (in jurisdiction) –Terrorism Act 2006, s. 3 ‘internet activity’ l Liability for endorsement l Blocking access (out jurisdiction) –e.g. Internet Watch Foundation l database of URLs for child sexual abuse images l Voluntary, but with threat of mandation l International reach, e.g. Google & Yahoo! l Web-based traffic, but not P2P & other services –Problem of collateral interference l e.g. Wikipedia & Scorpions ‘Virgin Killers’

Monitoring communications l Interception of content –For law enforcement purposes l e.g. Airline bombers, Madrid bombers –For commercial purposes l Phorm & behavioural targeted advertising l Accessing communications data –Attributes: Traffic, usage, location & subscriber data l e.g. 21/7 bombers (?) – from London to Italy –Data retention: 6-24 months (Directive 06/24/EC) l Google agreement with EU

Safeguarding Rights l European Convention on Human Rights –Fair trial (art. 6), privacy (art. 8) & freedom of expression (art. 10) l ‘chilling effect’ l Derogations –In accordance with the law l Legal certainty –Applicable interest l i.e. national security –Necessity and proportionality

Concluding remarks