1. U.S. Department of Justice
International cooperation in investigations involving computers and the Internet
U.S. Department of Justice

2. Why do international issues matter?
Number or IP addresses at location
United States Department of Justice

3. Topics we’ll cover Enacting laws to criminalize computer abuses
Locating and identifying criminals
Improve abilities to collect and share evidence internationally
Working with the USA
United States Department of Justice

4. Making attacks on computer networks a crime
International Cooperation in Cybercrime Investigations
Making attacks on computer networks a crime
“Dual criminality” usually necessary for two countries to cooperate on a particular criminal matter
Dual criminality forms the basis for:
Extradition treaties
Mutual Legal Assistance Treaties
United States Department of Justice

5. Overcoming the dual criminality divide
International Cooperation in Cybercrime Investigations
Overcoming the dual criminality divide
Countries must agree on what to criminalize
United Nations General Assembly Resolution 55/63
Law enforcement cooperation for investigating and prosecuting cybercrime should be coordinated among states
Legal systems should protect confidentiality, integrity, and availability of data
Legal systems should permit preservation of data and quick access to data
Mutual assistance regimes should ensure timely investigation
United States Department of Justice

6. Overcoming the dual criminality divide
International Cooperation in Cybercrime Investigations
Overcoming the dual criminality divide
One major effort to do so: Budapest Cybercrime Convention
Three main roles:
Creates a substantive baseline for criminalizing cybercrime
Creates a substantive baseline for collecting and using electronic evidence
Serves as basis for formal mutual legal assistance & requires members to provide a 24/7 point of contact for rapid, informal international communication
Items in blue need to be implemented through your national law
United States Department of Justice

7. The Budapest Convention
It is the only international treaty currently in effect designed to enable countries to share evidence and work together to investigate and prosecute cybercrimes
National laws need to be brought into alignment with Budapest Convention baseline
United States Department of Justice

8. The problem of locating and identifying criminals
International Cooperation in Cybercrime Investigations
The problem of locating and identifying criminals
Primary investigative step is to locate the source of the attack or communication
What occurred may be relatively easy to discover
Identifying the person responsible is very difficult
Applies to hacking crimes as well as other crimes facilitated by computer networks
United States Department of Justice

9. Tracing a communication
International Cooperation in Cybercrime Investigations
Tracing a communication
There are only 2 ways to trace a communication:
While it is actually occurring
Using stored/historical data
United States Department of Justice

10. Tracing a communication
International Cooperation in Cybercrime Investigations
Tracing a communication
Infrastructure must generate traffic data
Carriers/others must keep sufficient data to allow tracing
Laws and procedures must allow for timely access by law enforcement that does not alert customer
Information must be shared quickly
United States Department of Justice

11. Solving the tracing problem: traffic data
International Cooperation in Cybercrime Investigations
Solving the tracing problem: traffic data
Countries should encourage providers to generate and retain critical traffic data
Law enforcement’s ability to identify criminals is enhanced by access to traffic data
Countries have taken different approaches to balancing this need against other societal concerns
United States Department of Justice

12. Law enforcement access
International Cooperation in Cybercrime Investigations
Law enforcement access
Legal systems must give law enforcement authority to access traffic data
Example: access to stored log files and to traffic information in real-time
Preservation of evidence by law enforcement
Critical because international legal assistance procedures are slow
Must be possible without “dual criminality”
Convention on Cybercrime, Article 29: expedited preservation of data
United States Department of Justice

13. International Cooperation in Cybercrime Investigations
Sharing evidence
Countries must improve their ability to share data quickly
If not done quickly, the electronic “trail” will disappear
Most cooperation mechanisms take months (or years!), not minutes
Convention on Cybercrime, Article 30: expedited disclosure of traffic data if source is an ISP in a third state
United States Department of Justice

14. International Cooperation in Cybercrime Investigations
Sharing evidence
When law enforcement gets a request, it should be able to:
Preserve all domestic traffic data
Notify the requesting country if the trace leads back to a third country
Provide sufficient data to the requesting country to allow it to request assistance from the third country
Countries must be able to do this for each other quickly, and on a 24/7 basis
United States Department of Justice

15. 24/7 High-Tech Crime Network
A means for preserving electronic evidence
Fifty-nine (59) member states worldwide
All states encouraged to join this informal network
Details:
Prosecutor or police in each member state are available at all times to respond to urgent requests from other member states related to electronic evidence
Must communicate network requests in English
Parties to Budapest Convention are obligated to have a point of contact and to preserve data upon request
CCIPS is point of contact for the United States
United States Department of Justice

16. Collecting and sharing evidence
International Cooperation in Cybercrime Investigations
Collecting and sharing evidence
Will evidence collected in one country be admissible in another country’s courts?
Potential for evidentiary problems
Collection of digital evidence
Tracing electronic communications across the globe
Computer forensics
Current mutual legal assistance treaties may not accommodate electronic evidence
United States Department of Justice

17. Unilateral evidence collection
International Cooperation in Cybercrime Investigations
Unilateral evidence collection
Publicly available information
Obtaining electronic evidence with consent of owner
United States Department of Justice

18. Formal cooperation: Mutual Legal Assistance Treaties
Advantages
Efficient
Central authority to central authority
Obligation to assist
Disadvantages
Slow for capturing electronic evidence
May require dual criminality
Law enforcement and technical resource limits
Requires underlying bilateral treaty
United States Department of Justice

19. Formal cooperation: Other tools
Letters rogatory
The customary method of obtaining judicial assistance from abroad in the absence of a treaty or executive agreement
They are requests from courts in one country to the judiciary of a foreign country requesting the performance of an act which, if done without the sanction of the foreign court, could constitute a violation of that country’s sovereignty
Executive agreements
United States Department of Justice

20. Informal cooperation: Investigator to investigator
International Cooperation in Cybercrime Investigations
Informal cooperation: Investigator to investigator
Advantages
Flexible and faster
Existing law enforcement contacts
Disadvantages
Domestic legal restrictions
May be difficult to locate an investigator who will provide assistance
Investigator may be limited in what actions they can take without opening an investigation
United States Department of Justice

21. Informal cooperation: Joint investigations
International Cooperation in Cybercrime Investigations
Informal cooperation: Joint investigations
US point of contact
FBI Legal Attaché (LEGATT), an FBI agent
Department of Justice Legal Attaché, a prosecutor
INTERPOL and similar organizations
United States Department of Justice

22. Solutions for collecting and sharing evidence
International Cooperation in Cybercrime Investigations
Solutions for collecting and sharing evidence
Budapest Convention on Cybercrime
Acts as a Mutual Legal Assistance Treaty where countries lack one
Parties agree to provide assistance to other countries to obtain and disclose electronic evidence
Developing international technical standards
Forensic computer examinations
United States Department of Justice

23. Working with the USA Emergency disclosure
Preservation requests are vital
You can contact the FBI Legat for your country/region
Members of the 24/7 Network can use the network to contact CCIPS
United States Department of Justice

24. United States Department of Justice