CLE Conference, October 2002 CoE’s Cyber Crime Convention Content and background Prof. Dr. Henrik W.K. Kaspersen Vrije Universiteit Amsterdam The Netherlands

CoE Cyber Crime Convention Sydney October 24 & 25, Overview of the presentation n reason for international negotiations n the content of the cyber crime convention n discussion of some dilemma’s n meaning of the convention

CoE Cyber Crime Convention Sydney October 24 & 25, Procedure in the Council of Europe n Start :1997 n Completion: officially December 2000, factually August 2001 n Adoption by Committee of Ministers: November 2001 n Signature Ceremony: Budapest November 23, 2001 n ETS 185, coming into force: ??

CoE Cyber Crime Convention Sydney October 24 & 25, Negotiating Parties n Council of Europe Member States n U.S.A. n Canada n Japan n South Africa

CoE Cyber Crime Convention Sydney October 24 & 25, Signatories to the Convention EU-member states (out of 15): 13 Non-European States: 4 === (includes All G-7) 17 Other CoE members states, 14 === Parties to the Convention 31 Ratifications: 1

CoE Cyber Crime Convention Sydney October 24 & 25, Aim of the Cyber Crime Convention n Harmonisation of criminal substantive law, basis R (89) 9. n Harmonisation of criminal procedural law, basis R (95) 13. n Instruments for mutual legal assistance, basis existing co-operation instruments. n Codification of international law n Framework for future developments

CoE Cyber Crime Convention Sydney October 24 & 25, Scope of the Cyber Crime Convention n Minimum character n Substantive law: – categorisation; distinction cyber crime in narrow and in broad sense. n Procedural law – specific investigative powers related to IT, preliminary measures

CoE Cyber Crime Convention Sydney October 24 & 25, Scope CCC- continued n Mutual assistance – supplementing existing bilateral and multilateral instruments – extradition – scope of application of coercive powers – further assistance

CoE Cyber Crime Convention Sydney October 24 & 25, Harmonising of substantive criminal law n Cyber crime in the narrow sense – C.i.a.-offences: artt. 2-6 n Cyber Crime in the broader sense: – Computer-related offences: artt. 7-8 – Content-related offences: art. 9 – I.p.r.-related offences: art. 10 n Accessory provisions: artt

CoE Cyber Crime Convention Sydney October 24 & 25, General provisions n Definitions: art. 1 – computer system – computer data n Element: “without right” n Element: “intentionally”

CoE Cyber Crime Convention Sydney October 24 & 25, Content-related offences n Child porn – Defines child porn material n refers to sexually explicit conduct including adult actors and realistic virtual material – Criminalised Conduct n possession, production, distribution of digital child porn material including procurement, offering, making available by means of a computer system n Exemptions: to be defined under domestic law as “with right”

CoE Cyber Crime Convention Sydney October 24 & 25, Issues considered but not included n Surreptitiously gathering of personal data (“Cookies”) n Spam (unsolicited ) n Spoofing n Racism and xenophobia (see hereafter) n Other Content-related offences (e.g. gambling) n Non-liability of ISP’s

CoE Cyber Crime Convention Sydney October 24 & 25, Jurisdiction n Scope art. 22: only substantive provisions n Principle: territoriality n Includes ships and aircrafts n Restricted nationality principle n Dedere aut judicare n Conflicts: Consulting mechanism (substantial link)

CoE Cyber Crime Convention Sydney October 24 & 25, Criminal procedural law n Starting point: CoE R(95) 13 n Aim: gathering of electronic evidence of a specific criminal offence n Scope: cyber crimes art.14: a) offences established in the CCC; b) computer system instrument of the crime; c) any other crime for which electronic evidence is needed.

CoE Cyber Crime Convention Sydney October 24 & 25, Criminal Procedural law- general principles n Scope: art. 14 n Scope, conditions and safeguards art. 15: domestic law n Distinction between stored data and flowing data

CoE Cyber Crime Convention Sydney October 24 & 25, Definitions n art. 1 n computer system n computer data n service provider: communication services: TO and ISP equal footing n traffic data: functional definition (path, source)

CoE Cyber Crime Convention Sydney October 24 & 25, Measures concerning stored computer data n Search of computer system and files: art. 19 n Production order: art. 18 n Expedited preservation: art. 16 n Expedited preservation of stored traffic data: art. 17

CoE Cyber Crime Convention Sydney October 24 & 25, Preservation of traffic data n EU-directive Telecommunications and Privacy 1997: – deletion of non-billing data n Other Parties: no restrictions n Principle CCC: “preserve traffic data as is”

CoE Cyber Crime Convention Sydney October 24 & 25, Real time collection of traffic data/interception of content n Art. 20/21 parallel in structure n Art. 21: serious crime only (domestic law) n Specific communication by means of a computer system n Law enforcement authorities or service provider n “As is available”, no technical requirements n Confidentiality clause possibility

CoE Cyber Crime Convention Sydney October 24 & 25, Measures considered but not included n Measures to undo encryption n Specification of individual safeguards n Mandatory retention of traffic data – efficacy vs burden innocent third parties – reasonable time limit – legal safeguards n International harmonisation of collection/interception

CoE Cyber Crime Convention Sydney October 24 & 25, International mutual legal assistance n General principles, art. 24, 26 – to the widest extent possible – scope: art. 14 – expedited, flexible, modern means of communication – basis always domestic law – no refusal for fiscal offences – flexible interpretation of ‘dual criminality’ – spontaneous information

CoE Cyber Crime Convention Sydney October 24 & 25, Mutual legal assistance in general n Extradition: extraditable offences (art. 24) n Factual co-operation:  Can the request be executed on the basis of an existing bilateral or multilateral instrument? (EI) Y, proceed. N, apply art. 27 CCC (comprehensive set for MLA).  Is the application of specific measures necessary? Apply CCC or EI or both.

CoE Cyber Crime Convention Sydney October 24 & 25, Mutual legal assistance- specific measures n Expedited preservation of computer data (art. 29) n Expedited partial disclosure in case of traffic data (art. 30) n Access to computer systems and data (art. 31) n Transborder investigative measures that are lawful (art. 32) n Real time collection of traffic data (art. 33) n Real time interception of content (art. 34) n 24/7 network

CoE Cyber Crime Convention Sydney October 24 & 25, Transborder investigative measures n Only through MLA, except – Accessing and downloading of “Open source” – With permission of the person in control on the territory – Possibly through production order n Notification in EU MLA

CoE Cyber Crime Convention Sydney October 24 & 25, Mutual assistance instruments considered but not included n Adaptation of existing MLA- instruments n Data protection exception n Misuse of jurisdiction n International order for collection/retention of traffic data n Trans-border network search

CoE Cyber Crime Convention Sydney October 24 & 25, Final provisions n Coming into force: 5 ratifications n Accession: unanimity of Parties and majority of Committee of Ministers CoE n Declarations, reservations n Conference of Parties n Amendments n Dispute Resolution: consultation

CoE Cyber Crime Convention Sydney October 24 & 25, Cyber Crime Convention- final observations (I) n Minimum character: electronic environment n Framework character: ongoing development n Need for flanking, internationally co- ordinated measures n Enhances practical co-operation of law enforcement authorities – exchange of expertise – training and education – prevention

CoE Cyber Crime Convention Sydney October 24 & 25, Cyber Crime Convention - final observations (II) n Transparency of the drafting process n Industry and NGO involvement n Human rights and privacy concerns Internet brings people more together than some administrations would like to see.

CoE Cyber Crime Convention Sydney October 24 & 25, st Additonal Protocol on Racism and Xenophobia Procedure: – decision by CDPC in June 2001 – drafting December 2001-April 2002 – adoption CDPC June 2002; Parliamentary Assembly September 2002 – adoption by Committee of Ministers November 6, 2002 – opening for signature: January 2003

CoE Cyber Crime Convention Sydney October 24 & 25, Meaning of the Protocol n harmonising criminal offences concerning dissemination of racist and xenophobic material and related acts in computer networks n provide for adequate means of criminal investigations as defined by the Cyber Crime Convention n address a smaller group of Parties

CoE Cyber Crime Convention Sydney October 24 & 25, Crimes under the 1st Add. Protocol n art. 3: dissemination n art 4: threats n art. 5: insults n art. 6: denial n art. 7: aiding and abetting

CoE Cyber Crime Convention Sydney October 24 & 25, art. 3: dissemination – dissemination or otherwise making available through a computer system n excludes private communications n excludes production, possession, procurement – racist and xenophobic material (art. 2) – intentionally – without right – reservation clauses

CoE Cyber Crime Convention Sydney October 24 & 25, art. 2: racist and xenophobic material n written or any other representation – data carrier required n thoughts and theories n advocating, promoting, inciting n hatred, discrimination, violence n race, colour, decent, national or ethnic origin, religion (qualified)

CoE Cyber Crime Convention Sydney October 24 & 25, art. 4 threats n threat – (private communications included) n with commission of a serious crime n factors from art. 2

CoE Cyber Crime Convention Sydney October 24 & 25, art. 5 insults n insulting publicly n intentionally/without right n iactors from art. 2 n reservation clauses

CoE Cyber Crime Convention Sydney October 24 & 25, art. 6 denial n denial, gross minimisation n holocaust or future genocide or crime against humanity n reservation clause

CoE Cyber Crime Convention Sydney October 24 & 25, Other issues n attempt to art. 3-6 not criminal n copying of the definitions of the Cyber Crime Convention n powers and instruments of the Cyber Crime Convention applicable

CoE Cyber Crime Convention Sydney October 24 & 25, Not included in the Protocol n factors of art. 2: gender, sexual nature, age etc. n set up, running and supporting of racist and xenophobic associations n specific investigative measures

CoE Cyber Crime Convention Sydney October 24 & 25, Conclusion n framework of human rights, Rome Convention 1950 n major step forward in global approach since UN-CERD 1967 n meaning Protocol not restricted to – computer networks – scope of art. 2; role national judge – parties to the protocol or the convention