Doc. 9031

10 April 2001

Draft Convention on Cyber-crime1

Report

Committee on Legal Affairs and Human Rights

Rapporteur: Mr Ivar Tallo, Estonia, Socialist Group

Summary

The report recognises the importance and the impact of the draft Convention on Cyber-crime, which will be the first international agreement in its field.

However, it would like the imperatives of individual freedom to be guaranteed more substantially in the draft Convention.

In particular, the report considers that time-limits should be set for data conservation, that the level of criminal or non-criminal sanctions or measures should be specified, and that the principle of the proportionality should systematically be taken into account along with the adequate protection of human rights.

Finally, the report concludes that an additional protocol to the new Convention should immediately be drawn up between the parties in order to include the dissemination of racist and xenophobic propaganda in the list of crimes covered.

I.       Draft opinion

1.        The Assembly considers the fight against cyber-crime to be a crucially important challenge in view of the obstacle which this form of crime may pose to the development of new technologies.

2.        The Assembly notes that support for a binding legal instrument is unanimous, on the basis that specific international controls and the harmonisation of domestic laws will compensate for the failings of regulation left entirely in the hands of the operators concerned and for certain countries’ policy of uncompromising suppression. It therefore welcomes the preparation of the draft convention as the first international text in its field.

3.        While recognising that the new convention will provide a substantial response to immediate requirements,        the Assembly observes that the text will need to retain a certain amount of flexibility allowing for the relatively changeable nature of the different forms of cyber-crime and the speed with which the new technologies are developing. It notes that the draft convention has been negotiated and will be adopted by states which possess the necessary technology to combat cyber-crime, and that this fact will inevitably influence other states’ policy choices.

4.        In the view of the Assembly, it is essential that there be common definitions of criminal offences, that the private sector continue to work on rendering computer networks secure, that governments issue appropriate and proportionate domestic legislation, that the business community, law enforcement bodies and civil society engage in dialogue, that an effort be made to standardise security procedures, and that awareness-raising programmes be launched.

5.        The Assembly supports the draft Convention on Cyber-crime presented by the Committee of Experts on Crime in Cyberspace (PC-CY) with the aim of pursuing “a common criminal policy aimed at the protection of society against cyber-crime, inter alia by adopting appropriate legislation and fostering international co-operation”, while upholding the imperatives of individual freedom.

6.        The Assembly considers that the text rightly follows the lead of the various recommendations adopted by the Committee of Ministers by laying down an obligation for Parties to criminalise certain offences, and it welcomes the fact that the European Commission’s communication on “creating a safer information society by improving the security of information infrastructures and combating computer-related crime” drew inspiration from the convention, thereby proving to cyber-criminals that they face united opposition.

7.        The Assembly believes that the challenge which the draft convention presents to national legal systems in terms of personal data protection necessitates extreme vigilance on its part. In this connection, it expresses its concern about the differing degree to which guarantees relating to government intrusion are honoured in Council of Europe member states as compared with non-members, even though the gap is being narrowed by the adoption of appropriate legislation in the latter countries.

8.        The Assembly considers that the rights guaranteed by the draft convention must also be effectively protected in cases of transborder personal data transfers to third countries by surrounding such transfers with suitable safeguards. In this context, it takes note of the agreement reached between the European Commission and the United States, despite European Parliament reservations, on “safe harbours”.

9.        The Assembly reiterates its appeal to the Committee of Ministers to assist states which are not yet party to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data to introduce appropriate regulations in this field.

10.        Accordingly, the Assembly recommends that the Committee of Ministers amend the draft convention as follows:       

i.        in the preamble, remove the brackets around "as conferred e.g. by the 1981 Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data" and "Recommendation No R (87) 15 regulating the use of personal data in the police sector" and add, after this last phrase, "Recommendation No (97)18 concerning the protection of personal data collected and processed for statistical purposes";

ii.        at the end of the first sentence in Article 2, add the following phrase:

", where that system is protected and recognised as such in domestic law";

iii.        add the following sentence at the end of Article 3:

"These provisions extend to private and confidential professional communications from employees of private firms.”;       

iv. add the following sentence at the end of Article 5:

"These provisions extend to the sending of unsolicited electronic mail which obstructs the functioning of a computer system and to unsolicited inclusions on mailing lists.";

v. in Article 6 (1)(a)(1), replace the word "primarily" by the word "specifically";

vi. in Article 6 (3), replace the words "in paragraph 1(a)(2)" by "in paragraph 1(a)(1)";

vii. in Article 10 (3), delete the phrase "that other effective remedies are available and";

viii. in Article 11 (1), replace "in accordance with Articles 2 – 10" by "in accordance with Articles 2 – 9";

ix. in Article 11 (2), replace "in accordance with Articles 3 through 5, 7, 8, 9 (1) a and 9 (1) c" by "in accordance with Articles 3 through 5, 7, 8, 9 (1) a, 9 (1) b, 9 (1) c and 9 (1) d";

x. in Article 13 (1), replace "in accordance with Articles 2 – 11" by "in accordance with Articles 2 – 9 and 11" and add "and monetary sanctions" at the end of the paragraph;

xi. insert a new paragraph 2 in Article 13:

"Each Party shall take the necessary legislative and other measures to ensure that the criminal offences established in accordance with Article 10 are punishable by effective, proportionate and dissuasive sanctions";

xii. in Article 13 (1), thus amended, and new Article 13 (2), indicate what constitute permissible effective, proportionate and dissuasive sanctions, including deprivation of liberty, and monetary sanctions;

xiii. in new Article 13 (3), indicate what constitute permissible effective, proportionate and dissuasive criminal or non-criminal sanctions or measures, including monetary sanctions;

xiv. at the end of footnote 29 to Article 15, add "and the 1981 Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data";

xv. in Article 15, replace "and, where applicable, the proportionality of the power or procedure" by "and the proportionality of the power and procedure or an equivalent principle";

xvi. in Article 16 (1), remove the brackets around "specified";

xvii. in Article 16 (2), replace "as necessary" by "from a minimum of sixty days to a maximum of one year”;

xviii. in Article 18 (3), replace "users of its service" by "subscribers";

xix. at the end of Article 27 (4)(b), add ", with due regard to the generally accepted guarantees concerning data protection";

xx. remove the brackets around Article 27 bis and replace "may" by "shall" in paragraphs 2 and 4;

xxi. in Article 29 (7), replace "not less than sixty days" by "from a minimum of sixty days to a maximum of one year";

xxii. insert the following paragraph after Article 39 (2):

"Where such an agreement or treaty is applied or relations are otherwise established in respect of the matters dealt with in the present Convention, this shall be done in accordance with the principles of this Convention.";

xxiii. lastly, provide a clear and detailed definition of the term “traffic data”.

11.        The Assembly also recommends that the Committee of Ministers urge member states which have not already done so, as well as non-member countries wishing to accede to the new convention:

i.        to sign and ratify the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, then its new additional protocol, as soon as possible;

ii.        to legislate on the protection of personal data on the basis of the principles contained in the convention mentioned in sub-paragraph i. above.

12.        The Assembly recommends that the Committee of Ministers seeks to ensure that the new Convention and European Community legislation in the field are compatible with each other.

13.        Finally, the Assembly recommends immediately drawing up a protocol to the new convention under the title "Broadening the scope of the convention to include new forms of offence", with the purpose of defining and criminalising the dissemination of racist propaganda, abusive storage of hateful messages, use of the Internet for trafficking in human beings, and the obstruction of the functioning of computer systems by “spamming” (sending “junk e-mail”).

14.        The Assembly invites the Committee of Ministers to put the text of the draft convention before the Assembly again after the Committee of Ministers has decided upon that text, should substantial changes have been made other than those proposed by the Assembly.

II.       Explanatory memorandum by Mr Tallo, Rapporteur

A.       Background

1.        On 9 November 2000 the Bureau instructed the Committee on Legal Affairs and Human Rights to prepare an Assembly opinion on the draft Convention on Cyber-Crime as it appears in draft No. 22 rev. 2 transmitted by the Committee of Ministers (Doc. 8875). Amendments having been made to the draft since that date, this opinion will concern document PC-CY (2000) Draft No. 25 REV.2

2.        The draft convention on crime in cyberspace will be the first international convention to focus, from a strictly criminal law and criminal procedure viewpoint, on the different forms of criminal behaviour affecting computer systems, networks and data and other offences of a similar nature. It is due to be finalised by a group of experts before summer 2001 with possible adoption and opening for signature by the Committee of Ministers in the autumn. Non-member states of the Council of Europe and the European Commission are actively involved in negotiations. The draft is a response to two recommendations made by the Committee of Ministers in 1989 and 1995 to encourage member states to adapt their legislation to the challenges of computer crime.3

3.       Following the draft convention’s publication, the committee took the lead of the Directorate General of Legal Affairs by deciding to organise a first public hearing on the text. This was held in Paris on 6 March 20014. The committee invited some ten experts, whom it would like to thank for their very apt contributions, and many groups, organisations and interested individuals were given the opportunity to attend as observers. The hearing gave rise to a constructive exchange of information.

4.       As rapporteur, I also attended a public hearing organised on 7 March 2001 by the European Commission, where I was privileged to state the aims of the draft convention and the conclusions of our own hearing. The Commission plans to hold a European forum on computer crime in May this year, which will be followed by forums in member states so as to continue talks with all interested parties before taking the further step of suggesting common definitions to member states in December. I have received comments from several Internet and telecommunications operators, and I should now like to thank them for replying to my invitation to express their views.

5.       This explanatory memorandum keeps very closely to the order followed by the committee when considering the key chapters of the draft convention at its hearing on 6 March 2001.

B. The purpose of the convention

6.       The committee welcomes the culmination of four years of negotiations in the first international agreement on cyber-crime. The new instrument has three aims: to harmonise substantive law, align procedural laws and implement an effective system of international co-operation.

7.       A good deal of criticism has been voiced in response to what is seen as an imbalance between the various operators concerned. The most important has centred on individual privacy and the claim that excessive demands have been imposed on the industry. However, certain elements of criticism are due to misunderstanding, although others reflect genuine differences of opinion. We believe that the draft convention’s adoption must not be delayed. Addressing the committee on 6 March 2001, the Belgian Minister of Justice vigorously defended the draft and announced that he would take advantage of the Belgian presidency of the European Union in the second half of 2001 to press for swifter ratification by EU member states.

8.       The European Union too is supportive of the Council of Europe’s draft convention. In May 1999 the fifteen member states adopted a joint position on the text, approving the introduction of provisions to facilitate investigation and prosecution. They are particularly favourable to the idea of cyber-crime contact points in each country and to the possibility of using transfrontier computer searches in the investigation of serious criminal offences. The Union has indicated that the convention should also cover crimes against the confidentiality and integrity of computer data, computer fraud and forgery and content-related offences, especially in the field of child pornography.

C.       Protection of privacy and data preservation

9.       One of the most virulent criticisms of the draft convention is that it offers far greater protection to economic interests than to individual rights. Its recognition of the propensity of states to intrude upon private life is all the more upsetting given the respect for privacy and the duties required of the business sector.

10.       Where the draft concerns the protection of personal data, it is vital to abide by Europe’s legal acquis: the European Convention on Human Rights (in particular Article 8), various conventions on the protection of personal data and the case-law of the European courts. For instance, communications can not conceivably be intercepted except in accordance with Article 8 of the ECHR. Measures must be grounded in clear legal principles, and there must be effective opportunities for appeal. All intrusion into private life must be justified and carried out under strict judicial control. As well as certain routine operations, some forms of intrusion are of such a nature as to constitute violations of privacy. Data preservation measures must be focused, proportionate and subject to limitation. No exemptions should be allowed without good reason and unless data requests can be justified. Another issue is anonymity on the Internet: users must be able to choose to remain anonymous.

11.       From the privacy angle, it is essential that online operators involved in gathering information disclose how they intend to use it. In this sense the draft convention challenges the right to anonymity.

12.       Another frequent criticism comes from Internet service providers (ISPs), which believe that too much power lies with one agency, the law enforcement bodies. The various interests which need to be taken into account are the rights of individuals to privacy and freedom of expression, the collective right to place reasonable restrictions on individual freedoms for the purpose of law enforcement and criminal prosecution, the need for society in general to have access to reliable services and stable communication and information networks and, lastly, the economic interests of the new technology sector.

13.       Argument surrounds the issue of traffic data. Most significantly, several experts believe that this concept is defined too broadly and covers practically all communication on the Internet, with the result that registering or preserving the data concerned is beyond the capacities of ISPs. It has therefore been proposed that the draft convention clearly define what constitutes traffic data and that the definition be restricted to call numbers, duration of communication and ISP addresses. The draft also fails to distinguish clearly between subscribers and users, although ISPs should be able to provide information on the former but not on the latter.

14.              A number of problems have been raised with regard to data preservation. They concern the quantity of data (only a limited quantity of content-related data), difficulties in recording data (skilled staff are required), preservation time (given the huge storage capacity and its very high cost), the necessary conditions for data preservation so that it is available to the police and prosecution services (degree of confidentiality and measures to prevent tampering) and the cost and inherent risk of data storage (the greater the quantity stored, the higher the risk, and besides which the cost of storage to ISPs is exorbitant). In any case, the technological possibilities appear to have been over-estimated, while costs have been under-estimated. Consequently, it is essential to set limits on the type and quantity of data to be preserved and the duration of preservation.

15.       It is the committee’s view that only “specified” data need be preserved, for which reason the draft convention should retain this term, and that the definition of traffic data and preservation time must be reviewed. Data should in practice be stored within a maximum period of one year. It will also have to be decided whether mention should be made of ISPs’ technological limitations. On the other hand, the committee does not favour the partial state reimbursement of costs, already provided for in the United States. Similarly, it seeks no changes to the article on attempt and aiding and abetting or that on liability. However, a reference to spamming would not be out of place in the article on system interference.

16.        One concern raised by the European Union’s “Article 29” working party on data protection, which gave its opinion on the draft on 22 March 2001, is that the convention will apply in countries which are not Council of Europe members and which, consequently, are not bound by the same data protection obligations. A fear which is often voiced concerns the risk of moving towards a “two-speed” world with differing levels of data protection. Those parts of the new convention which largely ignore data protection must therefore be tightened up. Non-member states must also be invited to sign the Council of Europe’s Data Protection Convention (ETS No.108). Alongside other general principles that need to be observed, legislative measures must be brought into line with data protection criteria. There is increasing grass-roots interest in data protection on the Internet.

17.       The committee proposes that a clear reference be made in the draft convention to guarantees on the protection of personal data in transborder data flows.

D.       Network security

18.       On the Internet, the ephemeral nature of information exchanged via e-mail, the tendency not to preserve evidence of such information, the fact that messages are usually sent in real time and the absence of moderators with responsibility for monitoring or intercepting unacceptable content, are likely to make it difficult in practice to bring charges for criminal liability.

19.       For several years, electronic IDs have been developing as a means of improving the security of e-mail and e-commerce. It is essential in the course of sensitive operations to accurately identify Internet users rather than merely the terminal they are using. By stealing passwords, computer pirates are able to take control of computers which do not belong to them.

20.       In the United States, the FBI and the National White Collar Crime Center jointly set up an Internet Fraud Complaint Center on 8 May 2000. Japan passed an anti-piracy law in February 2000. The United Kingdom police are only now starting to become organised, and a national unit to combat high technology crimes has just been set up.

21.       In response to the growth of Internet fraud, insurance companies have elected to provide guarantees and other protection for individuals shopping on the Web, especially in France, the United Kingdom and the United States. Fear of being cheated is currently a major obstacle to the development of electronic commerce. A study commissioned by the public relations firm Shandwick International has indicated that every third person in the United Kingdom would not purchase via the Internet for fear of having their credit card number stolen. In France, fraud reportedly amounts to between 0.2% and 0.5% of electronic business turnover, while in the United States, according to a study by the consultancy firm Gartner, it is twelve times higher on the Web than in regular shops. At present the market is still in its infancy. According to Lloyds of London, the online business activities of more than 75% of all United Kingdom firms are still not insured.

22.       In the interest of promoting co-operation between member states in the field of Internet security, on 30 January 2001 the European Commission published a communication on cyber-crime which defines its overall policy and is largely based on the work of the Council of Europe’s Committee of Experts. It proposes guidelines for improving the security of electronic transmission, with the aim of increasing user and investor confidence, especially in the field of electronic commerce. The document was prepared jointly by the Commission services responsible for the information society and those in the justice and home affairs sector. Specifically, it encourages service providers to introduce more effective security measures and make use of the latest technologies in encryption and other areas. The European Commission also supports the development of co-operation between the police and legal services in cases of transfrontier cyber-crime. At present, although there is ad hoc co-operation on computer crime investigations between the relevant specialised departments in member states, no dedicated institution exists at European level. One solution might be to bring cyber-crime within the jurisdiction of Europol or Interpol. On the legal front, the communication provides a list of offences that could be charged in cases of Internet crime and establishes which courts should have jurisdiction and what penalties should apply.

23.       The European Commission also emphasises non-legislative measures, which it believes to be just as effective and important. Network security plays a key role, for although system damage is often accidental the consequences are as serious as if there had been intent. Security is also essential inasmuch as prevention is preferable to retribution where child pornography, piracy, blocks on access to online services and the effects of computer viruses are concerned. Lastly, the fight against computer crime necessitates other measures besides the controls laid down in the draft convention. Network security depends not only on technological intervention but also on the degree of user responsibility, hence the need to involve users in technical measures on the periphery of networks. This active approach stems from recognition that the choice of security technology must coincide with a genuine policy choice. It follows that governments should begin an international process of standardisation in order to ensure the compatibility of chosen solutions. However, one of the most common criticisms is that the draft convention should not result in the adoption of rules detrimental to security or user confidence. In the European Commission’s view, one extremely valuable non-legislative measure would be to set up a specialised computer crime unit in each country, complete with well-trained staff and equipment. The committee supports this standpoint.

24.       The committee also believes that computer owners must not wait for illegal access to become an offence before installing security systems designed to prevent it. Alternatively, illegal access could be deemed to refer only to systems which the state specified as protected. The criminalisation of illegal interception must take account of the balance between economic interests and personal freedoms by stipulating precisely who could authorise interception and protecting confidential communications from a company’s employees (whether private or work-related).

25.       The draft convention ignores inconvenience to private individuals, and it should also refer to acts which hinder computer use, such as spamming, the unauthorised or intrusive use of e-mail and unsolicited inclusions on mailing lists. The committee is extremely doubtful as to the usefulness of listing technological devices used for committing the offences mentioned in the draft. It welcomes the inclusion of corporate liability. Lastly, it would observe that limits should be placed on sanctions and that the draft should at least indicate what form sanctions would take.

E. New criminal offences

26. The draft convention provides inter alia that computer piracy and devices used for this purpose will be subject to the criminal law of signatory states, as will the illegal interception of data, interference with computer systems and computer-related fraud and forgery. It also prohibits online child pornography, including the possession of downloaded files of this nature, and the unauthorised reproduction and transmission of works protected by copyright. In addition, it addresses matters relating to the individual or corporate liability of offenders and provides for minimum penalties. Another area dealt with is enforcement: parties will be required to empower their competent authorities to search computer systems and seize data, compel those concerned to hand over the data in their possession and preserve sensitive data or have it preserved by those concerned. The possibility of intercepting data transmissions via telecommunications networks is under consideration. Investigative procedure specific to the computer field will entail the co-operation of telecommunications operators and ISPs.

27.       Interestingly, relatively few states have enacted legislation comprehensively criminalising all computer-related offences. Of 52 countries surveyed by a firm of technology policy and management consultants, only ten have revised their legislation, nine have updated it and 33 have not even performed an update. While most experts agree that self-regulation is inadequate and the law must also be brought into play, they stress the need for extreme caution when drafting legislation.

28.        Most observers are quick to point out that creating new criminal offences in order to prosecute those interfering with networks or computers is only part of the solution. As indicated above, the computer industry and national governments must take steps to co-operate on a wider scale by improving network and computer security. In this connection, the industry clearly bears a certain responsibility and takes a share in developing a system of self-regulation.

29.       The draft convention provides that an ISP may be held criminally liable if it can be shown to have been aware that it was hosting information of an illegal nature. Where such evidence is lacking, criminal liability is limited to those service providers and publishers of information, works or data controlling illegal sites or pages. Users too can be held criminally liable for an offence committed on the Internet if they have knowingly preserved data, intellectual property or information which was illegally placed on the Web.

30.       While legal experts and the police are calling for new national and international legislation to bridge the legal gap, businesses are far more wary, believing that it would be a major mistake to put the brakes on technological development. They are openly hostile to the introduction of legislation which would make it difficult or impossible for their customers to use their technologies. They therefore remain in favour of a maximum of freedom on the Web, arguing that governments understand nothing about technological issues. For example, the organisation of “new economy” businesses, the World Information Technology and Services Alliance (WITSA), and associations of ISPs in general decry the fact that Internet operators are obliged to preserve data, given the exorbitant cost of doing so. The committee is outraged that many industry members are insisting on government participation in this expense. Critics of the draft convention consider that measures to intercept data are equally financially unattainable and would lead to bankruptcy for many companies at a time when start-ups are suffering the full force of the market crisis. According to the business sector, the search for solutions to cyber-crime must be guided by the following principles: 1. the protection of individual freedoms and private life, 2. preservation of governments’ ability to fight high-tech crime, 3. provision of appropriate training for all involved, 4. definition of a clear and transparent framework for dealing with cyber-crime and 5. support for codes of conduct and standards voluntarily initiated by the industry.

31.       Dialogue between governments and the private sector is clearly essential, since both sides share an interest in combating the illegal or damaging use of information and communication technologies. Certain solutions rest with the states themselves and would necessitate the adaptation of operational structures, legal systems and international co-operation procedures. Others call for the development of co-operation principles between the private sector and government, and still others invite action from the private sector itself. Companies in the industry often claim that their technological expertise makes them best placed to take on cyber-crime. They fear the enforcement of excessively binding regulations or a constricting relationship with government which would compel their co-operation in cyber-crime investigations.

32.       The draft convention urges parties to afford each other mutual assistance. International mutual assistance in connection with enforcement is limited by the requirement of dual criminal liability (the rule that an offence must be classified identically in both countries), which allows prosecution only of offences classed as crimes in both countries concerned. Consequently, there is a not inconsiderable risk that “electronic havens” will emerge on the existing model of tax havens. The draft convention meets this objection by inviting signatory states to establish standard definitions of offences. It also specifies setting up a network of operational correspondents available 24 hours a day and seven days a week in order to speed up international investigations.

33. The committee favours the following principles: international co-operation guaranteeing privacy and the unconditional rejection of a “cyber-police” operating irrespective of national boundaries and sovereignty. Any idea of a “cyber police force” going beyond the framework of individual nations and their sovereign responsibilities must implicitly be ruled out. In this connection, the Council of Europe’s Director General of Legal Affairs has reassured the committee that the convention is not intended to set up an Orwellian system of electronic control. For example, while any country may conduct an investigation on behalf of another, there can be no transfrontier enquiries or searches. Contrary to the fears that have been expressed, therefore, the draft convention does not contemplate remote searches. This attitude is at variance with that of the United States, which believes that specialist Internet investigators must enjoy freedoms commensurate with the international nature of the World Wide Web. It is on the matter of urgently prosecuting computer piracy that the United States and the European nations disagree - the latter conforming to normal legal channels, which guarantee a high standard of protection for private life.

F.       Content-related offences: existing offences

34.       Copyright is the main right requiring protection, on account of the scope which the Internet offers for infringement. For content to be digitalised and published on an Internet site, the copyright owner’s permission must be granted. Forgery is committed if the authors’ express consent is not given. The distinctive feature of the Internet is that users can visit host sites, consult the various pages or documents, download documents and, if desired, make hard copies of them. The right to visit a site implicitly entails authorisation to copy.

35.       Some people have expressed concern about the very fact of making copyright infringement a criminal offence, in particular where private copying, as this would make all Internet users potential criminals. It has also been argued that excessive protection of copyright on the Internet would spoil the development prospects of less advanced countries. Indeed, the convention’s effects will undoubtedly reach beyond the Council of Europe’s borders.

36.       The scope of the convention regarding copyright and related rights is extremely broad, moving into new territory in relation to the offences covered by the Council of Europe’s Recommendation No. R (89) 9 on computer-related crime. In addition, the criminalisation of offences considerably extends the draft convention’s scope, so that it covers other areas than those previously demarcated by other conventions, such as the WIPO treaties. Regarding the need to harmonise domestic legislation, one speaker at the hearing made clear that an international consensus on intellectual property issues had only partly been achieved, pointing out that copyright protection (for purely economic reasons) appeared to be at odds with the original purpose of copyright, namely to encourage progress. With regard to containment of piracy “on a commercial scale”, whereby according to one expert making private copies would be a criminal offence if they were held to have a commercial impact, the committee will leave it to the Assembly to decide whether it would be advisable to expressly exclude private copies from the scope of the convention.

37.       Computer piracy for commercial purposes remains an endemic problem. The convention breaks new ground by treating infringement of copyright and related intellectual property rights as a criminal offence. The definitions of copyright infringement are those used in the 1971 Paris Act, the 1886 Bern Convention for the Protection of Literary and Artistic Works, the WIPO Copyright Treaty and the 1993 Agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS). What is striking is that aiding and abetting is also covered by the convention. The committee considers this unacceptable in the sense that these legal instruments already provide for extensive protection of rights; the draft convention should instead strictly limit penalties for these offences and should merely call a halt to such activities in order to prevent further offences from being committed. In general, there is a danger that the inclusion of aiding and abetting might lead to persons playing a marginal role in offences being caught in the toils of crime. The committee also regrets that copyright and child pornography have been placed on an equal footing.

38.       The convention gives a definition of child pornography, which will require national laws on on-line child pornography to be brought somewhat closer together. Producing, offering, distributing, transmitting, making available and possessing child pornography are all criminal offences under the convention. In this respect, it is generally felt that the convention has gone as far as it could, and the committee welcomes this. It still needs to be borne in mind that an organisation such as Europol or Interpol might host a hotline for centralising transnational information and passing it on to the judicial authorities of the countries concerned, so that the same offences are not dealt with by different organisations.

39.       However, the determination of the child’s age is problematic; if at all doubtful, investigators might not be able to proceed with their enquiries. In Belgium, the federal police target images of simulated sex acts involving children under sixteen years of age. In some cases, however, it is hard to ascertain how old the children really are. Nevertheless, the minimum age should be eighteen years and not any lower (the convention, however, provides for the possibility of a lower limit). This would make the harmonisation of laws more complete. Besides, offences jeopardising the protection of minors have not been taken into consideration, which makes it all the more advisable to include this age limit.

40.       The latest version of the convention does not cover certain other offences, such as pornography not featuring children, racism, or any other affront to human dignity, including human trafficking; nor is the excessive sending of multiple, unsolicited e-mails (spam) dealt with any more effectively. The inclusion of a substantial article on copyright is debatable; the only possible penalties here should be warnings or very small fines. Extending the list of content-related offences could be another of the committee’s demands (eg incitement to racial hatred, use of the Internet to offend against the dignity of the individual, or use of the Internet for human trafficking purposes).

G.       Content-related offences: the problem of criminalising racist and xenophobic propaganda

41.       The Council of Europe’s Committee of Experts discussed whether the propagation of racial hatred via the Internet should be included. The committee deplores the fact that the Committee of Experts ultimately had “insufficient time” to agree on this issue although, as recent case-law shows, it is of crucial importance. This possibly discloses the overbearing influence of countries traditionally opposed to any restrictions on freedom of expression. The committee is disappointed by the diffidence of the Committee of Experts. Like the European Commission (paragraph 7.1 of its communication), the committee believes that on-line racism should also be a punishable offence. However, unlike the European Commission, which would like to see the inclusion of a reference to racial hatred in the draft convention, the committee would prefer the Committee of Experts to draw up a protocol to the forthcoming convention straight away, so as not to delay its opening for signature.

42.       A European network of hotlines, funded by the European Union, was set up recently. Amongst other things, the network has made it possible to carry out searches and to break up a child pornography ring in Sweden. Use of the hotlines could be extended to crack down on racism on the Internet, as the European Commission suggests in its communication. It must be made clear to everyone that in Europe racism is not an opinion but a crime. Hotlines serve as a contact point for users who come across illegal content on websites. A substantial proportion of such content originates in the United States.

43.       Racist content is very much on the increase. While there was only one racist website in 1995, there were 600 in 1997, 1200 in 1999, and 4000 are now recorded. The Internet can be used to contact a large number of people at very low cost. Unfortunately, the United States has become a “cyber-haven” for racist criminals (no fewer than 2500 racist websites are hosted in the States, while 85% of racist symbols are on American sites).

44.       German right-wing extremists are transferring their websites wholsesale to American ISPs in order to escape the German authorities. According to the Federal Office for the Protection of the Constitution, right-wing extremists have been making intensive use of the Internet as a means of communication since mid-1997 (the radio station NDR has stated that some 90 neo-nazi groups transferred their sites to American servers during August 2000).

45.       The term “racist website” can be taken to mean any picture, text, video, sound or other feature which is designed to promote the superiority of a particular race. The technical problem in this regard is how to focus on a particular geographical area. In the Yahoo! case, an American portal hosted sites promoting Holocaust denial, aimed at French users. The service providers were supposed to comply with the judicial authorities’ requests concerning the identification of the culprit or the removal of certain material. The United States of America has entered a reservation to the United Nations International Convention on the Elimination of All Forms of Racial Discrimination, to the effect that it considers itself exempt from having to adopt any legislative text or other measure that is incompatible with the American constitution. Thus, the USA does not have any legislation providing for criminal sanctions against racist discourse. This state of affairs does not, however, prevent sanctions from being applied where racist sites have been unlawfully transferred abroad, as the above example illustrates. According to one expert, there is currently no evidence that the American courts would grant constitutional protection to racist messages diverted via American servers as a means of circumventing the more stringent regulations in force in another state.

46.       The expert who spoke at the hearing proposed that the forthcoming convention prohibit the dissemination of racist propaganda from computer servers that are based in other countries and host such content unlawfully – in other words, the convention should prevent moves to circumvent national regulations by “unlawful hosting” practices. The concept of “unlawful hosting” should be defined as the hosting, for the purpose of on-line circulation, of sites containing hate messages in the form of texts, images, pictures or other media, with the sole aim of taking advantage of the more lenient regulations in the hosting state in order to evade prosecution in another state. According to the expert, clues pointing to “unlawful hosting” are: sites in a different language from that of the host country, sites where most connections originate from foreign servers, and sites where the content provider’s own address and the contact or payment addresses given are located in a different country from the host country.

H.       Conclusions

47.       Is the digital revolution bringing about a legal revolution? This is a highly topical question: in the past three years, the Web has left the non-commercial sphere behind and fully entered the e-commerce era. This progress has also raised questions concerning network security and, above all, protection of Internet users’ personal data.

48.       The new information technologies are bringing about a revolution for which all the countries of the world are preparing by engaging in cut-throat competition. There is already a danger of a lag in Europe owing to many different factors in “technologically backward” countries, such as shortage of equipment, limited use of computers, failure to capitalise on research, and the brain drain. It is vitally important that less advanced states should have access to the new technologies, with the help of “high-tech” countries, and that countries enjoying this potential do not under-exploit the technology at their disposal.

49.       It is also urgent for European businesses to realise the importance of making the on-line business world more secure and not underestimate the pressing need to involve themselves in developing secure networks and data. In order to reassure them, efforts should be made at national and European level to draw up rules to meet the needs of e-commerce.

50.       Certain solutions to the problems raised by computer crime are set out in the Council of Europe’s draft Convention on Cyber-Crime. The instrument should be supported by national governments. Its success will depend to a large extent on the accession of the non-European countries involved in its negotiation.

51.       Lastly, the Yahoo! case highlighted the differing attitudes between countries. There is no longer the same concept of national boundaries on the Web. Because there is no central Internet agency, it is scarcely conceivable to deny a specific section of the public access to material without having to eliminate it from cyberspace altogether. The draft convention suggests ways of determining which law is applicable and which court has jursidiction. The questions raised by the Yahoo! case provide an opportunity to reflect on the kind of cyberspace that is taking shape. The fact that the French courts challenged Yahoo! practices in the United States reveals the emergence of a code of ethics for the networked society.

APPENDIX

Programme of the hearing on cyber-crime

Paris, 6 March 2001

9 h 30       Introduction

10 h 45       Topic 1:

11 h 30       Topic 2:

12 h 00       Topic 3:

12 h 45       Lunch break

14 h 30       Topic 4:

15 h 15       Topic 5:

16 h 00       Topic 6:

17 h 00       Close of the hearing

Reporting committee: Committee on Legal Affairs and Human Rights

Reference to committee: Doc 8875 and Reference No 2257 of 9 November 2000

Draft opinion adopted unanimously by the committee on 6 April 2001

Members of the committee: Mr Jansson (Chairperson), Mr Magnusson, Mr Frunda, Mrs Gülek (Vice-Chairpersons), Mr Akçali, Mr G. Aliyev, Mr Andreoli, Mrs van Ardenne-van der Hoeven, Mr Attard Montalto (alternate: Mr Asciak), Mr Bartumeu Cassany, Mr Bindig, Mr Bordas, Mr Bruce, Mr Bulavinov, Mr Cilevics, Mr Clerfayt, Mr Contestabile, Mr Demetriou, Mr Dimas, Mr Enright, Mrs Err, Mr Floros, Mrs Frimansdóttir, Mr Fyodorov, Mr Guardans, Mr Gustafsson, Mrs Hadjiyeva, Mr Holovaty, Mr Irtemçelik, Mr Jakic, Mr Jaskiernia, Mr Jurgens, Mr Kelemen, Lord Kirkhill, Mr Kostytsky, Mr S. Kovalev, Mr Kresák (alternate: Mr Tkác), Mr Kroupa, Mrs Krzyzanowska, Mr Lacăo, Mr Lento, Mr Lintner, Mr Lippelt, Mr Loutfi, Mrs Markovic-Dimova, Mr Marty, Mr McNamara, Mr Michel (alternate: Mr Hunault), Mr Moeller, Mrs Nabholz-Haidegger, Mr Olteanu, Mr Pavlov, Mr Pollo, Mrs Pourtaud, Mr Rodeghiero, Mrs Roudy, Mrs Serafini (alternate: Mr Provera), Mr Simonsen, Mr Shaklein, Mr Skrabalo, Mr Solé Tura, Mr Spindelegger, Mr Stankevic, Mr Stoica, Mrs Süssmuth, Mr Svoboda, Mr Symonenko (alternate: Mr Khunov), Mr Tabajdi, Mr Tallo, Mrs Tevdoradze, Mr Uriarte, Mr Vanoost, Mr Vera Jardim, Mr Wilkinson, Mrs Wohlwend, Mr Wojcik, Mrs Wurm (alternate: Mrs Stoisits)

N.B. The names of those members who were present at the meeting are printed in italics.

Secretaries to the committee: Mr Plate, Ms Coin, Ms Kleinsorge, Mr Cupina

1 See Doc. 8875 rev.

2 See Doc. 8875 rev.

3 Recommendation No. R (89) 9 on computer-related crime and Recommendation No. R (95) 13 concerning problems of criminal procedural law connected with information technology.

4 The programme of the hearing is set out in the appendix.