CLE Conference, 24-25 October 2002
CoE’s Cyber Crime Convention
Content and background
Prof. Dr. Henrik W.K. Kaspersen
Vrije Universiteit Amsterdam
The Netherlands
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
2
Overview of the presentation
reason for international negotiations the content of the cyber crime convention discussion of some dilemma’s meaning of the convention
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
3
Procedure in the Council of Europe Start :1997 Completion: officially December 2000,
factually August 2001 Adoption by Committee of Ministers:
November 2001 Signature Ceremony: Budapest November
23, 2001 ETS 185, coming into force: ??
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
4
Negotiating Parties
Council of Europe Member States U.S.A. Canada Japan South Africa
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
5
Signatories to the Convention
EU-member states (out of 15): 13
Non-European States: 4
===
(includes All G-7) 17
Other CoE members states, 14
===
Parties to the Convention 31
Ratifications: 1
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
6
Aim of the Cyber Crime Convention Harmonisation of criminal substantive law, basis
R (89) 9. Harmonisation of criminal procedural law, basis R
(95) 13. Instruments for mutual legal assistance, basis
existing co-operation instruments. Codification of international law Framework for future developments
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
7
Scope of the Cyber Crime Convention Minimum character Substantive law:
– categorisation; distinction cyber crime in narrow and in broad sense.
Procedural law– specific investigative powers related to IT,
preliminary measures
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
8
Scope CCC- continued
Mutual assistance– supplementing existing bilateral and
multilateral instruments– extradition– scope of application of coercive powers– further assistance
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
9
Harmonising of substantive criminal law Cyber crime in the narrow sense
– C.i.a.-offences: artt. 2-6 Cyber Crime in the broader sense:
– Computer-related offences: artt. 7-8 – Content-related offences: art. 9– I.p.r.-related offences: art. 10
Accessory provisions: artt. 11-13
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
10
General provisions
Definitions: art. 1 – computer system – computer data
Element: “without right” Element: “intentionally”
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
11
Content-related offences
Child porn– Defines child porn material
refers to sexually explicit conduct including adult actors and realistic virtual material
– Criminalised Conduct possession, production, distribution of digital child porn
material including procurement, offering, making available by means of a computer system
Exemptions: to be defined under domestic law as “with right”
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
12
Issues considered but not included Surreptitiously gathering of personal data
(“Cookies”) Spam (unsolicited e-mail) Spoofing Racism and xenophobia (see hereafter) Other Content-related offences (e.g. gambling) Non-liability of ISP’s
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
13
Jurisdiction
Scope art. 22: only substantive provisions Principle: territoriality Includes ships and aircrafts Restricted nationality principle Dedere aut judicare Conflicts: Consulting mechanism
(substantial link)
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
14
Criminal procedural law
Starting point: CoE R(95) 13 Aim: gathering of electronic evidence of a
specific criminal offence Scope: cyber crimes art.14:
a) offences established in the CCC;
b) computer system instrument of the crime;
c) any other crime for which electronic evidence is needed.
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
15
Criminal Procedural law- general principles Scope: art. 14 Scope, conditions and safeguards art. 15:
domestic law Distinction between stored data and flowing
data
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
16
Definitions
art. 1 computer system computer data service provider: communication services:
TO and ISP equal footing traffic data: functional definition (path,
source)
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
17
Measures concerning stored computer data Search of computer system and files: art. 19 Production order: art. 18 Expedited preservation: art. 16 Expedited preservation of stored traffic
data: art. 17
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
18
Preservation of traffic data
EU-directive Telecommunications and Privacy 1997: – deletion of non-billing data
Other Parties: no restrictions Principle CCC: “preserve traffic data as is”
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
19
Real time collection of traffic data/interception of content Art. 20/21 parallel in structure Art. 21: serious crime only (domestic law) Specific communication by means of a
computer system Law enforcement authorities or service
provider “As is available”, no technical requirements Confidentiality clause possibility
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
20
Measures considered but not included Measures to undo encryption Specification of individual safeguards Mandatory retention of traffic data
– efficacy vs burden innocent third parties– reasonable time limit– legal safeguards
International harmonisation of collection/interception
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
21
International mutual legal assistance General principles, art. 24, 26
– to the widest extent possible– scope: art. 14– expedited, flexible, modern means of
communication– basis always domestic law– no refusal for fiscal offences– flexible interpretation of ‘dual criminality’– spontaneous information
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
22
Mutual legal assistance in general
Extradition: extraditable offences (art. 24) Factual co-operation:
Can the request be executed on the basis of an existing bilateral or multilateral instrument? (EI) Y, proceed. N, apply art. 27 CCC (comprehensive set for MLA).
Is the application of specific measures necessary? Apply CCC or EI or both.
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
23
Mutual legal assistance- specific measures Expedited preservation of computer data (art. 29) Expedited partial disclosure in case of traffic data
(art. 30) Access to computer systems and data (art. 31) Transborder investigative measures that are lawful
(art. 32) Real time collection of traffic data (art. 33) Real time interception of content (art. 34) 24/7 network
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
24
Transborder investigative measures Only through MLA, except
– Accessing and downloading of “Open source”– With permission of the person in control on the
territory– Possibly through production order
Notification in EU MLA
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
25
Mutual assistance instruments considered but not included Adaptation of existing MLA- instruments Data protection exception Misuse of jurisdiction International order for collection/retention
of traffic data Trans-border network search
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
26
Final provisions
Coming into force: 5 ratifications Accession: unanimity of Parties and
majority of Committee of Ministers CoE Declarations, reservations Conference of Parties Amendments Dispute Resolution: consultation
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
27
Cyber Crime Convention- final observations (I) Minimum character: electronic environment Framework character: ongoing development Need for flanking, internationally co-ordinated
measures Enhances practical co-operation of law
enforcement authorities– exchange of expertise– training and education– prevention
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
28
Cyber Crime Convention - final observations (II) Transparency of the drafting process Industry and NGO involvement Human rights and privacy concerns
Internet brings people more together than some administrations would like to see.
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
29
1st Additonal Protocol on Racism and XenophobiaProcedure:
– decision by CDPC in June 2001– drafting December 2001-April 2002– adoption CDPC June 2002; Parliamentary
Assembly September 2002– adoption by Committee of Ministers November
6, 2002– opening for signature: January 2003
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
30
Meaning of the Protocol
harmonising criminal offences concerning dissemination of racist and xenophobic material and related acts in computer networks
provide for adequate means of criminal investigations as defined by the Cyber Crime Convention
address a smaller group of Parties
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
31
Crimes under the 1st Add. Protocol art. 3: dissemination art 4: threats art. 5: insults art. 6: denial art. 7: aiding and abetting
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
32
art. 3: dissemination
– dissemination or otherwise making available through a computer system
excludes private communications excludes production, possession, procurement
– racist and xenophobic material (art. 2)– intentionally– without right– reservation clauses
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
33
art. 2: racist and xenophobic material written or any other representation
– data carrier required thoughts and theories advocating, promoting, inciting hatred, discrimination, violence race, colour, decent, national or ethnic
origin, religion (qualified)
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
34
art. 4 threats
threat – (private communications included)
with commission of a serious crime factors from art. 2
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
35
art. 5 insults
insulting publicly intentionally/without right iactors from art. 2 reservation clauses
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
36
art. 6 denial
denial, gross minimisation holocaust or future genocide or crime
against humanity reservation clause
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
37
Other issues
attempt to art. 3-6 not criminal copying of the definitions of the Cyber
Crime Convention powers and instruments of the Cyber Crime
Convention applicable
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
38
Not included in the Protocol
factors of art. 2: gender, sexual nature, age etc.
set up, running and supporting of racist and xenophobic associations
specific investigative measures
CoE Cyber Crime Convention Sydney October 24 & 25, 2002
39
Conclusion
framework of human rights, Rome Convention 1950
major step forward in global approach since UN-CERD 1967
meaning Protocol not restricted to– computer networks– scope of art. 2; role national judge– parties to the protocol or the convention