Convention on Cybercrime
Encyclopedia
The Convention on Cybercrime, also known as the Budapest Convention on Cybercrime or just the Budapest Convention, is the first international treaty
seeking to address Computer crime
and Internet
crimes by harmonizing national law
s, improving investigative techniques and increasing cooperation among nations. It was drawn up by the Council of Europe
in Strasbourg
with the active participation of the Council of Europe's observer states Canada, Japan and China.
The Convention and its Explanatory Report was adopted by the Committee of Ministers of the Council of Europe at its 109th Session on 8 November 2001. It was opened for signature in Budapest, on 23 November 2001 and it entered into force on 1 July 2004. As of 28 October 2010, 30 states had signed, ratified and acceded to the convention, while a further 16 states had signed the convention but not ratified it.
On 1 March 2006 the Additional Protocol to the Convention on Cybercrime
came into force. Those States that have ratified the additional protocol are requited to criminalize the dissemination of racist and xenophobic material through computer systems, as well as of racist and xenophobic-motivated threats and insults.
, computer-related fraud, child pornography
, hate crime
s and violations of network security
. It also contains a series of powers and procedures such as the search of computer networks and Lawful interception
.
Its main objective, set out in the preamble, is to pursue a common criminal policy aimed at the protection of society against cybercrime, especially by adopting appropriate legislation and fostering international co-operation.
The Convention aims principally at:
The following offences are defined by the Convention: illegal access, illegal interception, data interference, system interference, misuse of devices, computer-related forgery, computer-related fraud, offences related to child pornography and offences related to copyright and neighbouring rights.
It also sets out such procedural law issues as expedited preservation of stored data, expedited preservation and partial disclosure of traffic data, production order, search and seizure of computer data, real-time collection of traffic data, and interception of content data. In addition, the Convention contains a provision on a specific type of transborder access to stored computer data which does not require mutual assistance (with consent or where publicly available) and provides for the setting up of a 24/7 network for ensuring speedy assistance among the Signatory Parties.
The Convention is the product of four years of work by European and international experts. It has been supplemented by an Additional Protocol making any publication of racist and xenophobic propaganda via computer networks a criminal offence. Currently, cyber terrorism is also studied in the framework of the Convention.
in August 2006 was both praised and condemned. The U.S. became the 16th nation to ratify the convention. Forty-three nations have signed the treaty.
The Convention entered into force in the USA on January 1, 2007.
"While balancing civil liberty and privacy concerns, this treaty encourages the sharing of critical electronic evidence among foreign countries so that law enforcement can more effectively investigate and combat these crimes," said Senate Majority Leader Bill Frist
.
"The Convention includes a list of crimes that each signatory state must transpose into their own law. It requires the criminalization of such activities as hacking (including the production, sale, or distribution of hacking tool
s) and offenses relating to child pornography, and expands criminal liability for intellectual property violations. It also requires each signatory state to implement certain procedural mechanisms within their laws. For example, law enforcement authorities must be granted the power to compel an Internet Service Provider to monitor a person's activities online in real time. Finally, the Convention requires signatory states to provide international cooperation to the widest extent possible for investigations and proceedings concerning criminal offenses related to computer systems and data, or for the collection of evidence in electronic form of a criminal offense. Law enforcement agencies will have to assist police from other participating countries to cooperate with their mutual assistance requests."
Although a common legal framework would eliminate jurisdictional hurdles to facilitate the law enforcement of borderless cyber crimes, a complete realization of a common legal framework may not be possible. Transposing Convention provisions into domestic law is difficult especially if it requires the incorporation of substantive expansions that run counter to constitutional principles. For instance, the U.S. may not be able to criminalize all the offenses relating to child pornography that are stated in the Convention, specifically the ban on virtual child pornography, because of its First Amendment free speech principles
. Under Article 9(2)(c) of the Convention, a ban on child pornography includes any “realistic images representing a minor engaged in sexually explicit conduct.” According to the Convention, the U.S. would have to adopt this ban on virtual child pornography as well, however, the U.S. Supreme Court, in Ashcroft v. Free Speech Coalition
, struck down as unconstitutional a provision of the CPPA that prohibited "any visual depiction” that "is, or appears to be, of a minor engaging in sexually explicit conduct." In response to the rejection, the U.S. Congress enacted the PROTECT Act to amend the provision, limiting the ban to any visual depiction “that is, or is indistinguishable from, that of a minor engaging in sexually explicit conduct.” 18 U.S.C
The United States will not become a Party to the Additional Protocol to the Convention on Cybercrime.
, Japan
, USA and the Republic of South Africa on 23 November 2001 (the signing took place in Budapest
, Hungary
). Further accessions by other non-European states are planned.
Treaty
A treaty is an express agreement under international law entered into by actors in international law, namely sovereign states and international organizations. A treaty may also be known as an agreement, protocol, covenant, convention or exchange of letters, among other terms...
seeking to address Computer crime
Computer crime
Computer crime, or cybercrime, refers to any crime that involves a computer and a network. The computer may have been used in the commission of a crime, or it may be the target. Netcrime refers to criminal exploitation of the Internet. Such crimes may threaten a nation’s security and financial health...
and Internet
Internet
The Internet is a global system of interconnected computer networks that use the standard Internet protocol suite to serve billions of users worldwide...
crimes by harmonizing national law
Law
Law is a system of rules and guidelines which are enforced through social institutions to govern behavior, wherever possible. It shapes politics, economics and society in numerous ways and serves as a social mediator of relations between people. Contract law regulates everything from buying a bus...
s, improving investigative techniques and increasing cooperation among nations. It was drawn up by the Council of Europe
Council of Europe
The Council of Europe is an international organisation promoting co-operation between all countries of Europe in the areas of legal standards, human rights, democratic development, the rule of law and cultural co-operation...
in Strasbourg
Strasbourg
Strasbourg is the capital and principal city of the Alsace region in eastern France and is the official seat of the European Parliament. Located close to the border with Germany, it is the capital of the Bas-Rhin département. The city and the region of Alsace are historically German-speaking,...
with the active participation of the Council of Europe's observer states Canada, Japan and China.
The Convention and its Explanatory Report was adopted by the Committee of Ministers of the Council of Europe at its 109th Session on 8 November 2001. It was opened for signature in Budapest, on 23 November 2001 and it entered into force on 1 July 2004. As of 28 October 2010, 30 states had signed, ratified and acceded to the convention, while a further 16 states had signed the convention but not ratified it.
On 1 March 2006 the Additional Protocol to the Convention on Cybercrime
Additional Protocol to the Convention on cybercrime
Additional Protocol to the Convention on Cybercrime is an additional protocol to the Council of Europe Cybercrime Convention, addressing materials and "acts of racist or xenophobic nature committed through computer networks," was proposed by some member States. This additional protocol was the...
came into force. Those States that have ratified the additional protocol are requited to criminalize the dissemination of racist and xenophobic material through computer systems, as well as of racist and xenophobic-motivated threats and insults.
Objectives
The Convention is the first international treaty on crimes committed via the Internet and other computer networks, dealing particularly with infringements of copyrightCopyright infringement
Copyright infringement is the unauthorized or prohibited use of works under copyright, infringing the copyright holder's exclusive rights, such as the right to reproduce or perform the copyrighted work, or to make derivative works.- "Piracy" :...
, computer-related fraud, child pornography
Child pornography
Child pornography refers to images or films and, in some cases, writings depicting sexually explicit activities involving a child...
, hate crime
Hate crime
In crime and law, hate crimes occur when a perpetrator targets a victim because of his or her perceived membership in a certain social group, usually defined by racial group, religion, sexual orientation, disability, class, ethnicity, nationality, age, gender, gender identity, social status or...
s and violations of network security
Network security
In the field of networking, the area of network security consists of the provisions and policies adopted by the network administrator to prevent and monitor unauthorized access, misuse, modification, or denial of the computer network and network-accessible resources...
. It also contains a series of powers and procedures such as the search of computer networks and Lawful interception
Lawful interception
Lawful interception is obtaining communications network data pursuant to lawful authority for the purpose of analysis or evidence. Such data generally consist of signalling or network management information or, in fewer instances, the content of the communications...
.
Its main objective, set out in the preamble, is to pursue a common criminal policy aimed at the protection of society against cybercrime, especially by adopting appropriate legislation and fostering international co-operation.
The Convention aims principally at:
- harmonising the domestic criminal substantive law elements of offences and connected provisions in the area of cyber-crime
- providing for domestic criminal procedural law powers necessary for the investigation and prosecution of such offences as well as other offences committed by means of a computer system or evidence in relation to which is in electronic form
- setting up a fast and effective regime of international co-operation.
The following offences are defined by the Convention: illegal access, illegal interception, data interference, system interference, misuse of devices, computer-related forgery, computer-related fraud, offences related to child pornography and offences related to copyright and neighbouring rights.
It also sets out such procedural law issues as expedited preservation of stored data, expedited preservation and partial disclosure of traffic data, production order, search and seizure of computer data, real-time collection of traffic data, and interception of content data. In addition, the Convention contains a provision on a specific type of transborder access to stored computer data which does not require mutual assistance (with consent or where publicly available) and provides for the setting up of a 24/7 network for ensuring speedy assistance among the Signatory Parties.
The Convention is the product of four years of work by European and international experts. It has been supplemented by an Additional Protocol making any publication of racist and xenophobic propaganda via computer networks a criminal offence. Currently, cyber terrorism is also studied in the framework of the Convention.
Accession by the USA
Its ratification by the United States SenateUnited States Senate
The United States Senate is the upper house of the bicameral legislature of the United States, and together with the United States House of Representatives comprises the United States Congress. The composition and powers of the Senate are established in Article One of the U.S. Constitution. Each...
in August 2006 was both praised and condemned. The U.S. became the 16th nation to ratify the convention. Forty-three nations have signed the treaty.
The Convention entered into force in the USA on January 1, 2007.
"While balancing civil liberty and privacy concerns, this treaty encourages the sharing of critical electronic evidence among foreign countries so that law enforcement can more effectively investigate and combat these crimes," said Senate Majority Leader Bill Frist
Bill Frist
William Harrison "Bill" Frist, Sr. is an American physician, businessman, and politician. He began his career as an heir and major stockholder to the for-profit hospital chain of Hospital Corporation of America. Frist later served two terms as a Republican United States Senator representing...
.
"The Convention includes a list of crimes that each signatory state must transpose into their own law. It requires the criminalization of such activities as hacking (including the production, sale, or distribution of hacking tool
Hacking tool
A hacking tool is a program designed to assist with hacking, or a piece of software which can be used for hacking purposes.- Examples :Examples include Nmap, Nessus, John the Ripper, SuperScan, p0f, and Winzapper. Bribes, have also been designated as among the most potent hacking tools, due to its...
s) and offenses relating to child pornography, and expands criminal liability for intellectual property violations. It also requires each signatory state to implement certain procedural mechanisms within their laws. For example, law enforcement authorities must be granted the power to compel an Internet Service Provider to monitor a person's activities online in real time. Finally, the Convention requires signatory states to provide international cooperation to the widest extent possible for investigations and proceedings concerning criminal offenses related to computer systems and data, or for the collection of evidence in electronic form of a criminal offense. Law enforcement agencies will have to assist police from other participating countries to cooperate with their mutual assistance requests."
Although a common legal framework would eliminate jurisdictional hurdles to facilitate the law enforcement of borderless cyber crimes, a complete realization of a common legal framework may not be possible. Transposing Convention provisions into domestic law is difficult especially if it requires the incorporation of substantive expansions that run counter to constitutional principles. For instance, the U.S. may not be able to criminalize all the offenses relating to child pornography that are stated in the Convention, specifically the ban on virtual child pornography, because of its First Amendment free speech principles
First Amendment to the United States Constitution
The First Amendment to the United States Constitution is part of the Bill of Rights. The amendment prohibits the making of any law respecting an establishment of religion, impeding the free exercise of religion, abridging the freedom of speech, infringing on the freedom of the press, interfering...
. Under Article 9(2)(c) of the Convention, a ban on child pornography includes any “realistic images representing a minor engaged in sexually explicit conduct.” According to the Convention, the U.S. would have to adopt this ban on virtual child pornography as well, however, the U.S. Supreme Court, in Ashcroft v. Free Speech Coalition
Ashcroft v. Free Speech Coalition
Ashcroft v. Free Speech Coalition, , struck down two overbroad provisions of the Child Pornography Prevention Act of 1996 because they abridged "the freedom to engage in a substantial amount of lawful speech." The case was brought against the Government by the Free Speech Coalition, a "California...
, struck down as unconstitutional a provision of the CPPA that prohibited "any visual depiction” that "is, or appears to be, of a minor engaging in sexually explicit conduct." In response to the rejection, the U.S. Congress enacted the PROTECT Act to amend the provision, limiting the ban to any visual depiction “that is, or is indistinguishable from, that of a minor engaging in sexually explicit conduct.” 18 U.S.C
The United States will not become a Party to the Additional Protocol to the Convention on Cybercrime.
Accession by other non-European states
The Convention has been signed by CanadaCanada
Canada is a North American country consisting of ten provinces and three territories. Located in the northern part of the continent, it extends from the Atlantic Ocean in the east to the Pacific Ocean in the west, and northward into the Arctic Ocean...
, Japan
Japan
Japan is an island nation in East Asia. Located in the Pacific Ocean, it lies to the east of the Sea of Japan, China, North Korea, South Korea and Russia, stretching from the Sea of Okhotsk in the north to the East China Sea and Taiwan in the south...
, USA and the Republic of South Africa on 23 November 2001 (the signing took place in Budapest
Budapest
Budapest is the capital of Hungary. As the largest city of Hungary, it is the country's principal political, cultural, commercial, industrial, and transportation centre. In 2011, Budapest had 1,733,685 inhabitants, down from its 1989 peak of 2,113,645 due to suburbanization. The Budapest Commuter...
, Hungary
Hungary
Hungary , officially the Republic of Hungary , is a landlocked country in Central Europe. It is situated in the Carpathian Basin and is bordered by Slovakia to the north, Ukraine and Romania to the east, Serbia and Croatia to the south, Slovenia to the southwest and Austria to the west. The...
). Further accessions by other non-European states are planned.
Further reading
- Dennis Jlussi: Handle with care, but don't panic - Criminalisation of hacker tools in German criminal law and its effect on IT security professionals, Hanover 2007. View online or Download as pdf file.
- Center for Democracy and Technology
- United States Department of Justice - Computer Crime & Intellectual Property Section Council of Europe Convention on Cybercrime
External links
- Convention on Cybercrime homepage from the Council of EuropeCouncil of EuropeThe Council of Europe is an international organisation promoting co-operation between all countries of Europe in the areas of legal standards, human rights, democratic development, the rule of law and cultural co-operation...