CYBERCRIME LEGISLATION WORLDWIDE UPDATE 2007 Professor Pauline C. Reich Waseda University School of Law Director, Asia-Pacific Cyberlaw, Cybercrime and Internet Security Research Institute Tokyo, Japan pcreich@yahoo.com 9/2/2007 1
Council of Europe Cybercrime Convention Signatures without ratifications as of August 2007 22 Austria, Belgium, Czech Republic,Germany, Greece, Ireland, Italy, Malta, Moldova, Montenegro, Norway, Poland, Portugal, Serbia,Spain, Sweden, Switzerland, UK + Canada, Japan, South Africa Ratifications as of August 2007 21-Albania, Armenia, Bosnia & Herzegovina, Bulgaria, Croatia, Cyprus, Denmark, Estonia, Finland, France, Hungary, Iceland, Latvia, Lithuania, Luxembourg, Netherlands, Romania, Slovenia.. 9/2/2007 2
(continued) Former Yugoslavian Republic of Macedonia, The Ukraine, the United States 9/2/2007 3
A Model for National Legislation? Aims of the Convention: Harmonizing domestic criminal substantive law elements of offenses and related provisions in the area of cybercrime Providing for domestic criminal law powers for the investigation and prosecution of such offenses as well as other offenses committed using a computer system or evidence related to them which is in electronic form; Setting up a fast and effective regime of international cooperation. CONVENTION ON CYBERCRIME EXPLANATORY REPORT 9/2/2007 4
Four chapters of the Convention Ch. I. Use of terms Ch. II. Measures to be taken at domestic level Ch. III. Internation al cooperation Ch. IV. Final clauses Substantive and procedural law Mutual legal assistance, e.g. for extradition 9/2/2007 5
Chapter II Section 1 substantive law 9 offenses in 4 categories+ Illegal access Illegal Interception Data interference Misuse of devices Data interference System interference Computer-related forgery Computer-related fraud Offenses related to child pornography Offenses related to copyright and neighboring rights 9/2/2007 6
Ch. II, Section 2 - procedural Any offense committed by means of a computer system or the evidence of which is in electronic form Procedural powers: expedited preservation of stored data; expedited preservation and partial disclosure of traffic data; production orders; search and seizure of computer data; real-time collection of traffic data; interception of traffic data 9/2/2007 7
Council of Europe OCTOPUS Meeting Strasbourg, France June 2007 COUNTRIES PARTICIPATING Albania Argentina Armenia Austria Azerbaijan Belgium Bosnia and Herzegovina Brazil Bulgaria 9/2/2007 8
And Canada Germany Chinese Taipei Hungary Croatia India Cyprus Italy Czech Republic Ireland Dominican Republic Japan Egypt Estonia Finland Kosovo (Serbia) Latvia Lithuania France Mexico 9/2/2007 9
And Moldova Monaco Morocco Netherlands Nigeria Norway Pakistan Portugal Philippines Romania Russian Federation Serbia Slovakia South Africa Spain Former Yugoslavian Republic of Macedonia Turkey Ukraine United Kingdom United States Total 49 9/2/2007 10
Country Profiles Submitted to the Council of Europe Albania Argentina Armenia Austria Brazil Bulgaria Republic of Croatia Cyprus 9/2/2007 11
Profiles (continued) Czech Republic Dominican Republic Former Yugoslav Republic of Macedonia France Germany Hungary Lithuania Kingdom of Morocco Mexico Moldova Portugal Romania Republic of Serbia Slovakia Turkey (23 profiles) But to what degree are Asia, Oceania, Africa, Latin America, the Middle East participating? 9/2/2007 12
What approaches have countries taken in their legislation? Various models among the laws in effect in countries worldwide: 1.Some interpret and extend existing criminal laws and procedures 2. Some adopt new criminal laws and procedures 3. Some have a mixture of both 4. Some have laws mainly written to facilitate e-commerce 5. Some apply tort law as well as criminal law, e.g. for spam 6. Some countries are stalled 9/2/2007 13
COUNTRY COMMENTARIES - CYBERCRIME AND SECURITY Baltic States Brazil Czech Republic Japan South Africa Israel India The Netherlands The Philippines Singapore Uruguay Thailand United States and others in progress (Australia, Republic of Korea, Malaysia, Serbia, Croatia, Bulgaria, Rumania, Italy, Ireland, Sweden, and more) 9/2/2007 14
Total number of countries that are members of the United Nations 192 Total number of countries in the world - 194 Until the whole world is on the same page, Cybercrime legislation will not be effective in curbing Cybercrime 9/2/2007 15
What s delaying adoption of legislation? Legislators may not understand technology Even if there is legislation, some countries are not utilizing it due to lack of trained law enforcement personnel who know how to conduct investigations, preserve data, etc. Judges may not understand the legislation or technology issues and may not be able to apply the laws Courts may not allow digital evidence Prosecutors and defense lawyers may not have training or knowledge of such laws need to include such training in law faculty/law school curriculum and in continuing education The general public may not understand the issues and may not be pushing for new legislation Countries may not have enough technology use to merit adoption, however they may be conduits of cybercrime Countries may not have overall policy about Cybercrime/Cybersecurity and may be issuing legislation that conflicts with other legislation (existing or new) 9/2/2007 17
Case Study - Thailand Two chapters of CYBERCRIME AND SECURITY written by Police Major Kissana Phathanacharoen, entitled Thailand Cybercrime and Security Issues, (9/06) and The Application of Existing Thai Criminal Law Dealing with Computer Hacking (11/06). Good news: Legislation has come into effect as of July 18, 2007 Computer Related Crime Act Prosecution was previously hampered as a result Recent cross border case -Country used as a conduit for cybercrime 9/2/2007 18
Case Study - Singapore Very advanced in use of technology Adequate legislation Prosecutions New legislation to address new issues Government policy favors adoption of legislation and it is carried out in a timely manner 9/2/2007 19
Case Study - Republic of Korea Multiple laws related to cybercrime New laws and amendments as new issues arise Leader in the region in Cybercrime law and Cybersecurity areas Producing doctoral dissertations about Cybercrime 9/2/2007 20
Case Study -Japan Has passed some laws, signed Cybercrime Convention but has not ratified it Stalled Need for curriculum in law faculties and new law schools, interdisciplinary collaborations between law and tech communities Need for public awareness Need to train lawyers, prosecutors, judges, law enforcement 9/2/2007 21
Case Study -India Original law designed for purpose of e- commerce Slow to amend Focuses primarily on public morality cases when prosecutions arise Amended legislation pending will reach Parliament in December 2007 9/2/2007 22
Case Study - Kingdom of Cambodia Little telephone penetration with land lines Mobile phone penetration is higher Gradual adoption of Internet, e.g. mobile Internet Recent efforts to start a CERT Needs technical assistance to develop law 9/2/2007 23
Case study - Australia Has adopted Cybercrime legislation Some prosecutions Protracted controversy about privacy protection 9/2/2007 24
Case study - Malaysia Has adopted legislation Few prosecutions Ongoing concerns about human rights protections 9/2/2007 25
United Nations Involvement We must remember, the world is not Silicon Valley Pauline C. Reich Much of the model legislation is from the developed countries Many developing countries are in a different stage in use of the Internet, email, computers, etc. 9/2/2007 26
Need for communication and sharing of model laws Countries need to look at model laws from other countries with similar circumstances and degrees of technology use Many countries need technical assistance My proposal: distance learning, online conferences (regional, global) 9/2/2007 27
Some considerations in determining legislation to adopt Countries need to be able to adapt laws as new forms of technology are used, for example, wireless Internet, mobile phone for payments, VoiP Convergence and net neutrality issues arise Laws adopted must take into account human rights issues, privacy 9/2/2007 28
More work is needed on a legislative model that is viable for all the countries of the world, giving them the flexibility to adapt the model to their own legal systems and technological use in the present and into the future. Countries also need an overall policy, rather than piecemeal adoption of legislation. 9/2/2007 29
Sources of further information BOOKS Jody Westby, Editor International Guide to Combating Cybercrime (American Bar Association, 2003) Jody Westby, Editor International Guide to Cyber Security (American Bar Association, 2004) TREATISE Pauline C. Reich, General Editor, CYBERCRIME AND SECURITY (Oceana, a division of Oxford University Press 3 volume looseleaf set updated every 2-3 months) 9/2/2007 30
And. Jody Westby, Editor International Guide to Privacy, (American Bar Association, 2004) Bert-Jaap Koops and Susan W. Brenner, Editors, Cybercrime and Jurisdiction A Global Survey (Cambridge University Press, 2006) Ian Walden, Computer Crimes and Digital Investigations (Oxford University Press, 2007) U.S. General Accounting Office GAO-07-705 CYBERCRIME - Public and Private Entities Face Challenges in Addressing Cyber Threats June 2007 9/2/2007 31
Websites The Register ZDNet.com SiliconValley.com Sydney Morning Herald Washington Post AUSTLII HKLII CANLII WorldLII, etc. 9/2/2007 32
Council of Europe Convention on Cybercrime Additional Protocol to the Convention on Cybercrime Concerning the Criminalization of Acts of a Racist and Xenophobic Nature Committeed through Computer Systems Two Explanatory Reports See CYBERCRIME AND SECURITY and Council of Europe website 9/2/2007 33