1. Cybercrime prevention and criminal investigation from a RoL perspective - To what extent should criminalization be used as a means to improve cybersecurity?
Inger Marie Sunde
Professor (PhD)
Member of the Parliamentary Oversight Committe of the National Intelligence- and Security Services (EOS)

2. Criminal offences against cybersecurity (CIA-offences)
Limitation of topic:
Criminal offences against cybersecurity (CIA-offences)
Computer intrusion
Unlawful surveillance
Data interference
System interference
Unlawful dealings with passwords etc., programs and equipment that can be applied for the purpose of committing any of the abovementioned criminal offences.
The European Cybercrime convention article 2 through 6.
I will not talk about traditional crime that has moved to the internet
Fraud, drugs, sexual abuse of children, money laundering, terror financing …

3. Goal: Cybersecurity (national security) Means:
Goals and means
Goal: Cybersecurity (national security)
Means:
Improve cyber infrastructure
Enhance security awareness
Security alert functions (CeRT-functions)
Education, R&D
Cybercrime prevention and cybercrime investigation
- Norwegian Cyber Security Strategy and Action Plan
- Lysne I – NOU 2015: 13

4. Criminalization triggers crime preventing expectations.
Proposition:
There is a general expectation that a crime which has been committed can be investigated and the perpetrator brought to justice. If not, why criminalize?
Criminalization triggers crime preventing expectations.

5. Basic questions: Criminal punishment
What is criminal punishment? Definition
What is its purpose? Outcome (future oriented)
How is it justified? Effects (future oriented)
The answers will be used to question how far we should go down the road of cybercriminalization

6. deliberately inflicted by the State on the criminal offender
1. Criminal punishment
«… is hardship
deliberately inflicted by the State
on the criminal offender
due to the perpetration of a crime,
with the intent that it shall be experienced (felt) as hardship»
- Legal theory and practice

7. 2. The purpose of criminal punishment
«…to influence future behaviour,
and thus contribute to a society and forms of coexistense
which
– pursuant to current values –
are deemed as desirable».
The overarching goal is preventive: To prevent
undesirable behaviour
and social unrest caused by undesirable behaviour
which still occurred.
Ot.prp.nr. 90 ( ) p

8. 3. Desired effects of criminal punishment (justification)
Individual preventive effect:
Render the perpetrator harmless / incapacitation (imprisonment)
Deterrence (no motivation for further criminal activity)
Positive psycholgical effect (penitence)
General preventive effect:
A wish to avoid hardship
Cost-benefit calculations («is it worth it?»)
Create and reinforce habitual lawabiding behaviour
Maintain social peace:
Sentiments of fairness (justice be done)
Sociopsycholgical sanitization (see that justice is done)

9. Individual preventive effect:
3. Desired effects of criminal punishment (justification) Nearly all of the effects require that the criminal is caught and punished
Individual preventive effect:
Render the perpetrator harmless / incapacitation (imprisonment)
Deterrence (no motivation for further criminal activity)
Positive psycholgical effect (penitence)
General preventive effect:
A wish to avoid hardship
Cost-benefit calculations («is it worth it?»)
Create and reinforce habitual law abiding conduct
Maintain social peace:
Sentiments of fairness (justice be done)
Sociopsycholgical sanitization (see that justice is done)
Level of punishment / perceived risk of detection
Sanctions should be effective, proportio-nate and dissuasive
- CCC art. 13

10. Problems with bringing the perpetrator to justice
Anonymity
Level of expertise in the police
Speed and prioritization
Jurisdiction – perpetrator is located abroad
International cooperation
Political aspects

11. Fundamental RoL-principles:
Criminal liability can be declared only by a court, for an act criminalized by law
Fundamental RoL-principles:
The principle of legality – ECHR art. 7, NC § 96
The right to fair trial – ECHR art. 6, NC art. 95
Presumption of innocence
Protection against self-criminalization
The prosecutor carries the burden of proof
Guilt must be proved beyond any reasonable doubt
Principle of objectivity – applicable also to the investigation
Time and resources to prepare the defense

12. Fundamental RoL-principles:
Criminal liability can be declared only by a court, for an act criminalized by law
Fundamental RoL-principles:
The principle of legality – ECHR art. 7, NC § 96
The right to fair trial – ECHR art. 6, NC art. 95
Presumption of innocence
Protection against self-criminalization
The prosecutor carries the burden of proof
Guilt must be proved beyond any reasonable doubt
Principle of objectivity – applicable also to the investigation
Time and resources to prepare the defense
CCC art

13. Fundamental RoL-principles:
Criminal liability can be declared only by a court, for an act criminalized by law
Fundamental RoL-principles:
The principle of legality – ECHR art. 7, NC § 96
The right to fair trial – ECHR art. 6, NC art. 95
Presumption of innocence
Protection against self-criminalization
The prosecutor carries the burden of proof
Guilt must be proved beyond any reasonable doubt
Principle of objectivity – applicable also to the investigation
Time and resources to prepare the defense
CCC art
Effects of crim. punishment?

14. Criminalization as an impetus to crime preventive intitiatives
The principle of legality – ECHR art. 7, NC § 96
The Norwegian Police Act § 2 (7): «the police shall prevent crime and other violations against public order and security».
Traditional strategies are oriented towards:
Situational elements
The individual perceived as a risk
Local cooperation

15. Criminalization as an impetus to crime preventive initiatives
The principle of legality – ECHR art. 7, NC § 96
The Norwegian Police Act § 2 (7): «the police shall prevent crime and other violations against public order and security».
How to prevent cybercrime?
Situational elements – Improve cybersecurity?
The individual perceived as a risk – Within reach for dialogue?
Local cooperation – Cert functions in cooperation with the police? (VDI/NorCert) – How about the situation of SME (small&medium sized enterprises)? NorSIS

16. Criminalization as an impetus to crime preventive initiatives
The principle of legality – ECHR art. 7, NC § 96
The Norwegian Police Act § 2 (7): «the police shall prevent crime and other violations against public order and security».
***
Effects: Expectations concerning crime prevention

17. Criminalization as an impetus to crime preventive initiatives
The principle of legality – ECHR art. 7, NC § 96
The Norwegian Police Act § 2 (7): «the police shall prevent crime and other violations against public order and security».
***
Is increased surveillance the inevitable outcome?
If so, what is the proper role of the police ?
Effects: Expectations concerning crime prevention

18. Criminalization as an impetus to crime preventive initiatives
The principle of legality – ECHR art. 7, NC § 96
The Norwegian Police Act § 2 (7): «the police shall prevent crime and other violations against public order and security».
***
Is increased surveillance the inevitable outcome?
If so, what is the proper role of the police ?
RoL: Right to private life and freedom of speech
ECHR art. 8, 10; NC § 102, 100.
Procedural principle of legality: Interference with the fundamental rights must have legal basis
(+ proportionality and legitimate aim).
Effects: Expectations concerning crime prevention

19. Criminalization as an impetus to crime preventive initiatives
The principle of legality – ECHR art. 7, NC § 96
The Norwegian Police Act § 2 (7): «the police shall prevent crime and other violations against public order and security».
***
Is increased surveillance the inevitable outcome?
If so, what is the proper role of the police ?
RoL: Right to private life and freedom of speech
ECHR art. 8, 10; NC § 102, 100.
Procedural principle of legality: Interference with the fundamental rights must have legal basis
(+ proportionality and legitimate aim).
Effects: Expectations concerning crime prevention

20. To sum up: Criminalization carries costs
Criminal prosecution and punishment may not be feasible in important cases. Criminal punishment may strike somewhat randomly.
The benefits are not clear, as the desired effects are highly uncertain.
Criminalization is an impetus for more crime preventive initiatives. The role of the police in this respect is not clear.
The solution is hardly to decriminalize cybercrime (CIA-offences)
Obligation to criminalize (Cybercrime convention)
CIA-offences are often committed for the purpose of facilitating or carrying out other forms of crime, e.g. different kinds of fraud and ID theft.
But perhaps more of an effort is called for with respect to our ability to distingush between incidents properly to be dealt with as matters of cybersecurity, and incidents properly to be dealt with as crime. The distinction has a bearing both on prevention and prosecution.