Proceedings of a Workshop on Deterring Cyberattacks Informing Strategies and Developing Options for U.S. Policy (2010) / Chapter Skim
Currently Skimming:
The Council of Europe Convention on Cybercrime--Michael A. Vatis
The Council of Europe Convention on Cybercrime--Michael A. Vatis
Pages 207-224
The Chapter Skim interface presents what we've algorithmically identified as the most significant single chunk of text within every page in the chapter.
Select key terms on the right to highlight them within pages of the chapter.
From page 207... ...
bACkgROuND The Convention on Cybercrime is an international treaty that seeks to harmonize national laws on cybercrime,1 improve national capabilities for investigating such crimes, and increase cooperation on investigations.2 The Convention was drafted by the Council of Europe (COE) in Strasbourg, France.
|
From page 208... ...
the Internet, such as illegal money transactions, offering illegal services, violation of copyright, as well as those which violate human dignity and the protection of minors"; • "other substantive criminal law issues where a common approach may be necessary for the purposes of international co-operation such as definitions, sanctions and responsibility of the actors in cyber-space, including Internet service providers"; voice in the drafting process.")
|
From page 209... ...
, rendering illegal material inaccessible and requiring service providers to comply with special obligations, taking into account the problems caused by particular measures of information security, e.g. encryption"; • "the question of jurisdiction in relation to information technology offences, e.g.
|
From page 210... ...
. and the adoption of powers sufficient for effectively combating such criminal offences, by facilitating their detection, investigation and prosecution at both the domestic and international levels and by providing arrangements for fast and reliable international co-opera tion."28 The Convention is divided into three principal parts.
|
From page 211... ...
or conduct that is otherwise not covered by established legal defences, excuses, justifications or relevant principles under domestic law." Convention on Cybercrime, Explanatory Report ¶ 38. In particular, the Convention "leaves unaffected conduct undertaken pursuant to lawful government authority (for example, where the Party's government acts to maintain public order, protect national security or investigate criminal offences)
|
From page 212... ...
. 40 Specifically, the Convention requires that these procedures be available to investigate the substantive offenses described in the Convention, "other criminal offences committed by means of a computer system," and "the collection of evidence in electronic form" of any type of criminal offense.
|
From page 213... ...
. 47 The reference to a service provider's "existing technical capability" (in the provisions concerning both collection of traffic data and communications content)
|
From page 214... ...
Rather, the Requested party must simply "report the final outcome to the requesting Party in due course." 58 Second, Parties must "afford one another mutual assistance to the widest extent possible for the purpose of investigations or proceedings concerning criminal offences related to computer systems and data, or for the collection of evidence in electronic form of a criminal offence." 59 Parties must "accept and respond to" requests made by "expedited means of communication, including fax or email, to the extent The U.S. delegation to the CDPC interpreted this provision of the Convention as calling for states to assert jurisdiction over cybercrimes committed by persons within their territory against computers outside their territory.
|
From page 215... ...
. 64 The Convention requires each Party to "designate a central authority" responsible for sending, answering, or executing requests for mutual assistance.65 The COE Secretary General shall keep an updated register of these central authorities.66 Parties agree to execute requests "in accordance with the procedures specified by the requesting Party, except where incompatible with the law of the requested Party." 67 The Convention provides, however, that Parties may refuse assistance not only for reasons specified in their domestic law or in existing MLATs, but also on the ground that "the request concerns an offence which the requested Party considers a political offence or an offence connected with a political offence" or that "execution of the request is likely to prejudice its sovereignty, security, ordre public or other essential interests."68 In addition, a "requested Party may make the supply of information or material in response to a request dependent on the condition that it is: a)
|
From page 216... ...
stored computer data, regardless of where the data is located geographically." Ibid . 77As the Explanatory Note to the Convention says: "The issue of when a Party is permitted to unilaterally access computer data stored in another Party without seeking mutual assistance was a question that the drafters of the Convention discussed at length.
|
From page 217... ...
he Parties shall provide mutual assistance to each other in the real-time collection or recording of content data of specified communications transmitted by means of a computer system to the extent permitted under their applicable treaties and domestic laws."84 This means Parties must assist each other by engaging in wiretapping of computer communications, but only to the extent permitted under their domestic laws. This does not necessarily mean that if a requested state may wiretap when investigating the same type of offense, it must render the requested wiretapping assistance when another state is investigating an offense.
|
From page 218... ...
III. REACTION TO THE CONvENTION When the Convention entered into force, it was opposed by many civil liberties groups, which feared that the new investigative authorities that would be created in many ratifying states, and the increased law enforcement cooperation, would erode privacy and other rights.91 The view of private industry was mixed, with copyright owners strongly supporting the convention, but Internet service providers and other network operators concerned about the increased burdens the Convention might place on them in the form of additional requests for interception and stored traffic data and subscriber information.
|
From page 219... ...
The ITU has also promoted its own cyber-warning organization, the "International Mul tilateral Partnership against Cyber-Threats" (IMPACT) , which is ostensibly modeled after the Centers for Disease Control and Prevention and strives to serve as an international "early warning system" for cyber attacks, but has relatively few members.98 The COE, however, has pushed back against the criticism, and said that what is needed is to get more countries to accede to the Convention, not to "reinvent the wheel." 99 The COE Secretary General has asserted that the Convention "has received strong support by the Asia-Pacific Economic Coopera tion, the European Union, Interpol, the Organisation of American States and other organisations and initiatives as well as the private sector."100 In addition, the COE's Committee of Experts on Terrorism has stated that, for now, at least, no separate Convention is necessary to deal with the use of the Internet for terrorist purposes, including terrorists' attacks on computer networks, since "large scale attacks on computer systems appeared to be already covered by the Cybercrime Convention."101 It stressed that "at the present stage primary focus should be on ensuring the effective implementation of the Cybercrime Convention and the Con vention on the Prevention of Terrorism, as new negotiations might jeopardize their increasing impact on the international fight against cybercrime and terrorism."102 Instead, the Committee recommended that the COE urge more nations to accede to the Convention on Cybercrime.103 The Committee also stated, though, that "further consideration could be given to the question of responsibility of Internet providers."104 Iv.
|
From page 220... ...
Moreover, the Convention does not address the particular concerns that may be raised by cyber attacks that are not just criminal acts, but may also constitute espionage or the use of force under the laws of war. This may be because the negotiators of the Convention were primarily representatives of law enforcement, justice, and foreign affairs ministries and agencies, or it may be that nations simply refused to discuss military and intelligence matters in that setting.
|
From page 221... ...
Even if amendments along the lines of the preceding paragraph could be drafted sufficiently clearly and tightly, in a way that avoids allowing a requesting Party to rely on them as a pretext for its own espionage or cyberattack, it seems highly unlikely that the Parties to the Convention would agree to them. A more realistic alternative, then, might be for Parties to state unilaterally that they reserve the right to engage in such measures when they experience a highly damaging attack and the requested Party denies a request for assistance without a legitimate, credible reason.
|
From page 222... ...
[or e] ncouraging the activities of international terrorist, extremist or criminal associations, organizations, groups or individual law breakers that pose a threat to the information resources and vital structures of States."113 And in 2008, Vladislav Sherstyuk, a deputy secretary of the Russian Security Council, reportedly described a proposed treaty that would prohibit secretly embedding malicious code in another country's computers for later use in the event of hostilities.114 Russia has also proposed prohibiting attacks on noncombatant systems and on using deception in cyberspace.115 The United States has been cool (at best)
|
From page 223... ...
For example, if a Party to the Convention rejects a request for assistance in investigating a cyber attack without a legitimate, credible reason, that rejection could be regarded as an indication (though not proof in and of itself) that the Party was directly or indirectly responsible for the attack, and thus in violation of the cyber attack treaty.
|
Key Terms
This material may be derived from roughly machine-read images, and so is provided only to facilitate research.
More
information on Chapter Skim is available.