Article
1Terrorism is a global phenomenon that transcends national borders. Computer networks and computer data, which also disregard physical boundaries, create a global cyberspace. In addition, computer networks such as the Internet allow for the development of new forms of technology that enable users to maintain their anonymity, to engage in hidden communication, and to make use of sophisticated encryption programs in the transfer and storage of data. Thus, the global cyber space provides a unique environment in which to carry out cyberterrorism and to pursue other international terrorist goals. [1] 2As a result of these specific features of computer networks, three major areas for terrorist activities on the Internet have opened up : the commission of destructive attacks by means of the Internet; the mass dissemination of illegal content via the Internet; and the use of the Internet for individual communication and for the commission of traditional forms of crime. In the first area, destructive attacks against computer systems carried out by means of the Internet
(cyberterrorism) can lead not only to the destruction, corruption, and rendering inaccessible of intangible computer data, thus blocking production processes, banking systems, or public administration. Internet-based attacks can also damage physical property and human life if, for example, the attacked computer systems are responsible for the administration of nuclear power stations, dams, flight control systems, hospital computers, or military weapon systems. Since many aspects of modern society are highly dependent on computer systems, the risks posed by this type of criminal activity are considerable. However, at this time, very few cases involving these kinds of attacks are known. In contrast, terrorist use of the Internet and other electronic communication systems in the second of these areas – the public dissemination of illegal content – is common. Here, the Internet and other communication systems are exploited by terrorists in order to threaten the commission of terrorist acts; to incite, advertise, and glorify terrorism; to engage in fundraising for and financing of terrorism; to provide training for terrorism; to recruit for terrorism; and to disseminate racist and xenophobic material. As a result, the Internet has become an important tool by means of which terrorists send their messages to a broad audience. Finally, the Internet and other computer systems play a significant role in the third area mentioned above, the logistical preparation of terrorist offences, including internal communication, acquisition of information (e.g., on bomb-building, hostage-taking, or hijacking), analysis of targets, and other forms of information gathering. [2] 3The investigation and prosecution of most of these crimes is complex and challenging due to the technical nature of the Internet. Investigation and prosecution in this area require both adequate substantive criminal law provisions as well as adequate procedural capabilities, such as the authority and the technical ability to identify foreign attackers, preserve stored computer data, issue production orders requiring the submission of specified computer data, engage in search and seizure of computer systems, break encryption, engage in the real time collection of traffic data, and intercept content data. In many cases, these phenomena have an international dimension, which may require concerted investigation in numerous countries. As a consequence, the prosecution and prevention of terrorist activities on the Internet depend to a great extent on the existence of appropriate international conventions and other instruments of international cooperation. These instruments must address the specific legal and forensic challenges posed by the Internet, they must make use of new Internet-based investigation techniques, and, at the same time, they must balance the need for effective prosecution against the obligation to protect citizens’ civil liberties. 4The aim of this analysis s to determine whether existing international conventions and other instruments of legal cooperation are adequate for the containment of cyberterrorism and other use of the Internet for terrorist purposes or whether the instruments should be amended. In light of this aim, the analysis focuses on the questions of whether the computer-specific international instruments are applicable with respect to terrorism and whether the terrorist-specific instruments are applicable in the IT environment. Furthermore, while this report is the result of a limited study and does not reflect a comprehensive evaluation of international instruments in general, it will provide an initial analysis with respect to the question of whether the various international instruments provide adequate coverage of crimes associated with the use of the Internet for terrorist purposes or whether the instruments exhibit gaps or other general problems regarding this kind of criminal activity that should be addressed in the future. [3] The term “gap,” it should be pointed out, is understood broadly : since the effects of the criminal law are felt both in the area of security as well as in the area of liberty, gaps can exist with respect to the effective prosecution of crime and with respect to the effective protection of human rights. [4] 5The method of the study involved the selection and analysis of international instruments. In this process all relevant conventions of the Council of Europe concerning terrorist use of the Internet were included as well as those of other major organisations, such as the United Nations and the European Union. Non-CoE instruments were also examined in the original version of this analysis, which was prepared for the Council of Europe, because the existing instruments of some international institutions (such as the UN) can reduce the need for the Council of Europe to take action, and some other standards (such as standards of the EU) can provide guidance with regard to possibilities for closer cooperation among non-EU Member States. The relevant phenomena – criminal activities associated with terrorist use of the Internet – that should be covered by these conventions were identified in two studies conducted by the Max Planck Institute for Foreign and International Criminal Law on behalf of the Council of Europe. [5] 6The following analysis encompasses all three areas of law that require international legal coordination as a prerequisite for effective transnational prosecution. Thus, the report addresses the development and harmonization of national substantive criminal law (infra II.), national criminal procedure (infra III.), and the law of international cooperation (infra IV.). 7The basic requirement for the prosecution of cyberterrorism and other use of the Internet for terrorist purposes is the existence in all countries of adequate national substantive criminal law provisions that cover the various terrorist acts. Thus, this chapter analyses the relevant international standards that govern the three aforementioned types of exploitation of the Internet for terrorist purposes : (A) destructive attacks on computer systems carried out by means of the Internet, (B) computer-based communication of illegal content to the public, and (C) other computer-based planning and support. 8The analysis of destructive attacks on computer systems carried out by means of the Internet shows a wide variety of possible techniques : terrorists could circumvent the integrity, confidentiality, and availability of computer systems and data either by hacking computers, deceiving victims, or spreading viruses and worms, thus manipulating systems, or by bringing about mass queries and other large scale attacks on the victim’s computer system (such as distributed denial of service attacks using bot nets). [6] If the attacked IT-systems are connected to other critical systems and infrastructures, both the disruption of services as well as physical harm and loss of life could result. Physical damage could be brought about, for example, by attacking the computers of electrical supply systems, hospitals, food production or pharmaceutical companies, air, railroad or other transport control systems, hydroelectric dams, military control systems, or nuclear power stations. [7] Thus, in order to respond to the question of whether international legal instruments have gaps with respect to the coverage of terrorist attacks on computer systems, a wide variety of abuses involving different attack techniques and different results must be considered. 9The national substantive criminal law provisions and the various international standards in question are characterized by descriptions of acts, results, and intents. Thus, the investigation of the applicability of these provisions to terrorist attacks on computer systems carried out by means of the Internet requires a systematic analysis not only of the acts themselves but especially of the various results (actual and intended) of the attacks. This leads to the following pattern, which is valid for the analysis of all destructive attacks on computer systems carried out by means of the Internet :
10The development and use of this analytical pattern for Internetbased attacks on computer systems offers the opportunity to understand better the different approaches and the relationship between the existing regulations that target cybercrime and those that target terrorism : Attacks on computer systems carried out by means of the Internet can be addressed by means of special ITbased statutes that focus on the first “result level” mentioned above, that is, the integrity, availability, and confidentiality of data and computer systems (as does the Cybercrime Convention). In cases of additional (proprietary and especially human) harm, attacks can also be addressed by means of offences that focus on the second “result level,” namely, physical damage (as do the UN conventions on typical terrorist acts), possibly in combination with a specific terrorist intent on the third “result level” (as does the EU Framework Decision). In sum, cyberterrorism can be tackled with a “computer-specific” data approach (focusing on the intangible harm to data) and/or with a “terrorist-specific” tangible damage approach (focusing on the physical harm and – possibly – also on a certain political intent). 11These two possible approaches will be analyzed in more detail on the basis of the relevant international conventions, that is, the Convention on Cybercrime of the Council of Europe, the EU Council Framework Decision on attacks against information systems, the EU Council Framework Decision on combating terrorism, and the various UN conventions that obligate states to enact substantive criminal law provisions. 12The Council of Europe’s Convention on Cybercrime, [9] which takes the data approach described above, is the most comprehensive of the existing international instruments that address computer crime. It includes obligations with respect to substantive criminal law, criminal procedure, and international cooperation. 13In the area of substantive criminal law (Chapter II Section 1), Articles 4 and 5 address the “damaging, deletion, deterioration, alteration or suppression of computer data” and the “serious hindering … of the functioning of a computer system by inputting, transmitting, damaging, deleting, deteriorating, altering or suppressing computer data”: 14Art. 4 : Data interference 151. Each Party shall adopt such legislative and other measures as may be necessary to establish as criminal offences under its domestic law, when committed intentionally, the damaging, deletion, deterioration, alteration or suppression of computer data without right. 162. A Party may reserve the right to require that the conduct described in paragraph 1 result in serious harm. 17Art. 5 : System interference 18Each Party shall adopt such legislative and other measures as may be necessary to establish as criminal offences under its domestic law, when committed intentionally, the serious hindering without right of the functioning of a computer system by inputting, transmitting, damaging, deleting, deteriorating, altering or suppressing computer data. 19Thus, Articles 4 and 5 of the Cybercrime Convention cover all types of interference with data and computer systems that – as shown – are a prerequisite for terrorist attacks on computer systems carried out by means of the Internet. Since Article 4 is not limited to the deletion of data but also encompasses the alteration and suppression of data (and is extended to the hindering of a computer system by Article 5), such interference is not limited to IT-based attacks on computer systems but also occurs in the context of the aforementioned attacks on other infrastructures, on physical property, or on the life or well-being of persons. [10] This consequence of the underlying concept of the Cybercrime Convention on the comprehensive protection of the integrity and availability of computer systems is confirmed in the Explanatory Report of the Convention, which explains that Article 5 is formulated in “a neutral way so that all kinds of functions can be protected by it.” [11] As a result, all types of terrorist attacks against computer systems fall under Articles 4 and 5. 20In addition, Articles 2 and 3 of the Cybercrime Convention cover the intrusion techniques of hacking and interception of computer data (e.g., by means of technical manipulations or by misusing intercepted information), which in many cases must be engaged in order to overcome the security measures in place on the victim’s computer system so that the intruder can interfere with and alter data : 21Art. 2 : Illegal access 22Each Party shall adopt such legislative and other measures as may be necessary to establish as criminal offences under its domestic law, when committed intentionally, the access to the whole or any part of a computer system [12] without right. A Party may require that the offence be committed by infringing security measures, with the intent of obtaining computer data [13] or other dishonest intent, or in relation to a computer system that is connected to another computer system. 23Art. 3 : Illegal interception 24Each Party shall adopt such legislative and other measures as may be necessary to establish as criminal offences under its domestic law, when committed intentionally, the interception without right, made by technical means, of non-public transmissions of computer data to, from or within a computer system, including electromagnetic emissions from a computer system carrying such computer data. A Party may require that the offence be committed with dishonest intent, or in relation to a computer system that is connected to another computer system. 25These provisions are extended in scope by rules on attempt and aiding and abetting (Art. 11) and on corporate liability (Art. 12) and are supported by rules requiring effective, proportionate, and dissuasive sanctions, including the deprivation of liberty (Art. 13). In addition, Article 6 on the “misuse of devices” aims at the criminalization of acts preparatory to intrusion, such as the illegal production, sale, procurement for use, or otherwise making available of “a device, including a computer program, designed or adapted primarily for the purpose of committing any of the offences established in accordance with Articles 2 through 5” or a “computer password, access code, or similar data by which the whole or any part of a computer system is capable of being accessed,” with intent that the device or data be used for the purpose of committing any of the offences established in Articles 2 through 5. Article 6 also targets the possession of these items with intent that the item be used for the purpose of committing any of the offences established in the aforementioned articles. [14] Thus, with respect to terrorist attacks via the Internet, Articles 2,3, and 6 give additional protection, allowing perpetrators to be prosecuted at an early stage. 26As a consequence, the implementing requirements of the Cybercrime Convention in the area of substantive criminal law demand a broad criminalization of IT-based terrorist attacks on computers and all other legal interests that depend on the functioning of computer systems. As shown above, physical harm to property or human life and well-being is not a prerequisite for punishment under the Cybercrime Convention, but leads to the applicability of additional “traditional” offences of national criminal law. Thus, the Cybercrime Convention achieves the criminalization of attacks on computer systems by means of a “data approach” that does not require, consider, or evaluate physical damage or the (political) intent of the perpetrator. 27EU Council Framework Decision on Attacks Against Information Systems 28The EU Council Framework Decision on attacks against information systems [15] is based on the Cybercrime Convention of the Council of Europe and, like the Convention, requires Member States to ensure that illegally accessing information systems (Art. 2), illegally interfering with systems (Art. 3), and illegally interfering with data (Art. 4) are punishable as criminal offences. [16] In addition, it includes requirements concerning the criminalization of instigation, aiding and abetting, and attempt. As a consequence, it can also cover the necessary interference with data in IT-based cyberterrorism attacks. [17] 29EU Council Framework Decision on Combating Terrorism 30Cyberterrorism is also addressed in the EU Council Framework Decision on combating terrorism. [18] n contrast to the aforementioned instruments, this Framework Decision follows a “terrorist-specific,” traditional corporeal damage approach (focusing on the physical or human corporeal harm). Unlike the Cybercrime Convention, the focus of the Framework Decision is not on the interference with data or on the IT-based forms of attack, but on the result of the perpetrator’s action and on his or her intent with respect to the political aim of the attack. Article 1 of the Framework Decision reads as follows (emphasis added): 31
shall be deemed to be terrorist offences : 32… (d) causing extensive destruction to a Government or public facility, a transport system, an infrastructure facility, including, an information system, a fixed platform located on the continental shelf, a public place or private property likely to endanger human life or result in major economic loss … 33… (i) threatening to commit any of the acts listed in (a) to (h). 34Articles 2 and 4 contain additional rules on participation (including supplying information, material resources, or funding) and on attempt. Thus, the Framework Decision applies a “corporeal damage approach” that focuses more specifically on terrorist attacks than do the data and system interference provisions of the Cybercrime Convention. In contrast to the Cybercrime Convention, it takes into consideration the extent of the damage to a computer infrastructure, thus covering serious attacks on infrastructures and against a multitude of computers by large scale virus attacks or DDoS attacks and excluding minor attacks against individual computer systems. In addition, it takes into consideration the “terrorist” intent of the perpetrator, that is, whether he or she pursued specific political aims. As a consequence of these aggravating factors, Article 5 of the Framework Decision requires that such offences be punishable by custodial sentences longer than those that can be imposed under national law for offences committed without special intent. Since the means of attack are not specified, the EU Council Framework Decision on combating terrorism covers both traditional violent attacks as well as IT-based attacks. Thus, there are no gaps in criminalization when the provision is applied to attacks via the Internet. 35UN Conventions and Protocols Against Specific Acts of Terrorism 36The UN has elaborated numerous multilateral conventions and protocols relating to states’ instruments for combating violent acts and terrorism. [19] he focus of these instruments is on the enumeration of dangerous acts and results that are typical of terrorism :
37The enumeration shows that the criminal provisions of the UN conventions follow the traditional “corporeal damage approach” mentioned above (focusing on physical or human corporeal harm) by protecting certain persons (e.g., senior representatives of States) or infrastructures (e.g., air and sea traffic or maritime platforms) or criminalizing certain dangerous acts (e.g., bombing, uncontrolled transfer of nuclear material, and hostage-taking). Concentrating as they do on specific dangerous acts that are punishable per se, they do not contain a subjective requirement of political (“terrorist”) intent. All of them have additional provisions that regulate attempt and participation. 38With respect to cyberterrorism and the use of the Internet for terrorist purposes, it is important to note that all criminal provisions contained in the conventions and protocols discussed above are worded in general terms. They are applicable regardless of how the acts are committed, that is, whether the acts are committed by traditional means or by means of IT-based attacks. For example, the provisions demanded by the aforementioned UN Conventions are applicable if the Internet is used to take control over an airport or a ship navigation system, if a computer network is used to trigger a bomb or an attack on an aircraft, or if computer manipulations are undertaken in order to misroute the transfer of nuclear material. The non-applicability, mentioned above, of the Convention for the Suppression of Terrorist Bombings to “virtual bombs” is not an exception to this rule, but rather a desired result of the legal framework of the UN conventions on terrorism, which are directed at specific, enumerated acts only. Thus, the UN instruments are generally applicable and do not have gaps in criminalization with respect to IT-based attacks. However, due to the system of the UN conventions on terrorism, these conventions do not cover all terrorist acts in a general way. Thus, the evaluation of existing international conventions raises the question of whether a new convention, one that would specifically address terrorist attacks on computer systems or computer infrastructures, is necessary. 39The previous analysis has shown that international instruments promoting the harmonization of criminal law take two complementary approaches to IT-based attacks against computer systems, infrastructures, and other legal interests :
40As a consequence, all serious attacks against computer systems, infrastructures, and other legal interests are covered by the international conventions and instruments discussed above, which require states parties to ensure the existence of criminal law sanctions. 41Thus, the question remains as to whether IT-based terrorist attacks against computer systems and other infrastructures should be addressed by these provisions alone or whether they should also be addressed by a more specific provision that takes into account the fact that destructive attacks are committed against computer systems via the Internet, that destructive attacks are committed with terrorist intent, and/or that destructive attacks against ITsystems, other infrastructures, and other legal interests are potentially extremely dangerous. Technically, such special protection could be achieved by adopting one of the following approaches for the introduction of new criminal offences : 42The practical advantages of such amendments would be relatively small : the new provisions could symbolize the seriousness of attacks on (IT) infrastructures and could provide for more serious sanctions and – possibly – for the exclusion of the political offence exception, a topic discussed in more detail later on in the text. On the other hand, there are substantial arguments against such provisions :
43As a consequence, there is no strong justification for requesting new instruments on the international level to address aggravated IT-based attacks on computer systems. It is sufficient for countries to evaluate existing domestic statutes that address data and system interference and make sure that they provide sanctions appropriate for cases involving terrorist attacks against computer and other essential infrastructures and other legal interests. However, such “effective, proportionate and dissuasive sanctions” are already required by Article 13 of the Cybercrime Convention, and it can be left to the national legislatures to achieve this result by means of sentencing rules, aggravated offences involving data interference, or infrastructure offences. [31] Thus, in the view of the author, the lack of an infrastructure offence is not a serious gap requiring amendments to the existing Council of Europe conventions. 44A serious gap is apparent, however, with respect to the signing, ratification, and implementation of the various instruments : the Cybercrime Convention, for example, currently has only 43 signatures and has been ratified by only 19 states; full implementation is even rarer. [32] As a result, the goal of preventing computer crime havens by coordinating national rules on substantive, procedural, and cooperation law is still far being achieved. Thus, the signing, ratification, and implementation of the Convention should be a top priority, and care should be taken that additional efforts – both within and beyond the scope of the existing conventions – do not hinder or distract from this important process. 45As mentioned above, the second major use of the Internet for terrorist purposes consists in the dissemination of illegal content. In order to spread their messages of fear and terror, perpetrators use all types of media, systems, and content. As a result, websites, video-sharing platforms, and other media have become important tools of an “open university for jihad.” [33] Thus, the identification of possible gaps in international instruments with respect to illegal content requires the identification of the various acts that correspond to the categories of conduct prohibited by the relevant national and international provisions. 46In most national legal systems and in the international instruments under study, the applicability of these legal provisions no longer depends on the type of carrier used to disseminate the illegal content. In other words, the relevant criminal provisions found in international instruments and in most domestic legal orders do not distinguish between data that are distributed by means of traditional carriers (e.g., paper documents for traditional writings), data that are distributed by corporeal electronic data carriers (e.g., CDs), and data that are distributed by incorporeal transmitters such as the Internet, the radio, or television. [34] 47Instead, domestic legal orders and international instruments differentiate with respect to the various kinds of illegal content and the types of harm they may cause to different legal interests. An analysis of terrorist communication leads to the identification of the following typologies and kinds of content :
48A legal assessment of most of these phenomena exposes the difficulty in pinpointing the transition between illegality and legality while balancing underlying interests in security and freedom (especially freedom of the press [36] ). This can be seen, for example, in the gradual transition between inciting, advertising, glorifying, justifying, explaining, and merely reporting terrorist offences (as illustrated by the publication of assassination videos set to music). The same applies to the publication of information on special weaponry : information that could be useful to terrorists but might also be found in common chemistry or physics textbooks. Similar difficulties also arise with respect to fundraising for charitable organisations that are connected to terrorist groups. Thus, it is obvious that not all of the above mentioned phenomena are or should be fully covered by the substantive criminal law provisions in international conventions. 49Due to the difficulty of balancing security and human rights in the context of each of the aforementioned types of content, this analysis cannot judge in detail whether the balancing approach undertaken in international conventions with respect to each of these categories should be approved or reconsidered. Instead, the following sections examine whether the issue was recognized and whether it was taken into account in a reasonable way during the development of the various international instruments. Also with respect to the competent international institutions’ possible chances to reconsider and change existing conventions , the aim of this analysis is not to judge the approach to the balancing of interests taken in the many specific solutions found in the various instruments but to identify gaps – or deficiencies – in the treatment of serious issues (both with respect to criminalization and with respect to the protection of human rights). 50Based on these considerations, the following analysis will be undertaken with respect to threats to commit terrorist offences; incitement, recruitment, and training for terrorism; fundraising for and financing of terrorism as well as dissemination of racist and xenophobic material. In addition, the relationship between these types of content and the liability of media representatives and Internet providers will be addressed. 51UN Conventions and Protocols Against Specific Acts of Terrorism 52Some of the UN conventions against specific terrorist acts described above [37] contain provisions against terrorist threats that are also applicable to terrorist threats disseminated on the Internet : The Convention on the Prevention and Punishment of Crimes Against Internationally Protected Persons overs a threat to commit any of the listed acts against senior representatives of a State (Art. 2). The Convention on the Physical Protection of Nuclear Material refers to a threat “to use nuclear material to cause death or serious injury to any person or substantial property damage” or “to commit an offence described in sub-paragraph (b) in order to compel a natural or legal person, international organisation or State to do or to refrain from doing any act” (Art. 7). The Convention for the Suppression of Unlawful Acts Against the Safety of Maritime Navigation xplicitly includes as separate offences certain threats related to the commission of some (but not all) listed offences against the safety of ships (Art. 3). The Protocol for the Suppression of Unlawful Acts Against the Safety of Fixed Platforms Located on the Continental Shelf explicitly includes as separate offences certain threats related to the commission of some (but not all) listed offences against the safety of fixed platforms (Art. 2). The International Convention for the Suppression of Acts of Nuclear Terrorism (not yet in force) also explicitly includes as an independent offence certain threats related to the commission of some (but not all) of its listed offences (Art. 2). [38] 53In contrast, the Convention for the Suppression of nlawful Seizure of Aircraft, the Convention for the Suppression of Unlawful Acts Against the Safety of Civil Aviation, he International Convention Against the Taking of Hostages and the International Convention for the Suppression of Terrorist Bombings do not have such threat provisions. [39] Thus, there is no common systematic approach to this issue in the various conventions. 54EU Council Framework Decision on Combating Terrorism 55In contrast to the UN Conventions, the EU Council Framework Decision on combating terrorism [40] goes further with respect to the criminalization of terrorist threats. Article 1, a comprehensive general provision dealing with terrorist offences based on objective and subjective criteria, contains a list of acts, such as attacks upon a person’s life, attacks upon the physical integrity of a person, kidnapping or hostage taking, causing extensive destruction to certain infrastructures, attacks on aircrafts, ships or other means of public or goods transport, use of weapons, release of dangerous substances, etc. Article 1 requires that these acts be deemed terrorist offences under national law if they seriously damage a country or an international organisation where committed with the aim of :
56The advantage of this “uniform” approach can be seen with respect to the present question concerning the criminalization of terrorist threats : Article 1 section 1(i) prohibits in a systematic and transparent way “threatening to commit any of the acts listed.” Thus, all serious terrorist threats within the scope of Article 1 are covered, irrespective of whether they are directed at individual persons, at institutions, or at the public. It also does not matter whether the threat is communicated via traditional media or on the Internet. 57CoE Convention on the Prevention of Terrorism 58The Council of Europe Convention on the Prevention of Terrorism [41] s the most specific instrument addressing the harmonization of substantive criminal law in the area of terrorism and with related questions of victims, jurisdiction, international cooperation, etc. According to Article 1, the term “terrorist offence” means any of the offences within the scope of and as defined in one of the treaties listed in the Convention’s appendix, which lists the major UN conventions against terrorism. In the field of substantive criminal law, the Convention requires each state party to adopt such measures as may be necessary to establish as criminal offences the following acts when committed unlawfully : 59Due to these ancillary offences, the limitation of Article 5 to public provocation does not lead to a serious gap in criminalization, as the (non-public) provocation of individual persons to commit a terrorist offence can often be covered by the provisions on participation (instigation, in particular). Glorification and justification of terrorism and terrorist acts are at least partly covered by Article 5 by the vague wording “distribution of a message to the public, with the intent to incite the commission of a terrorist offence, where such conduct, whether or not directly advocating terrorist offences, causes a danger that one or more such offences may be committed.” [42] These provisions do not require that the dissemination of the relevant material take place by means of traditional writings or documents (as was the case with some traditional offences against illegal content in national legislation). [43] Thus, they also apply to the incitement of terrorist offences, to the recruitment for terrorism, and to terrorist training on the Internet and in other electronic communication systems. 60UN Security Council Resolution 1624 61UN Security Council Resolution 1624 [44] deals with the prohibition against incitement to terrorism. In number 1(a) of the Resolution, the Security Council “calls upon all States to adopt such measures as may be necessary and appropriate and in accordance with their obligations under international law to … prohibit by law incitement to commit a terrorist act.” This provision covers both traditional and IT-based incitement. 62UN International Convention for the Suppression of the Financing of Terrorism 63The UN International Convention for the Suppression of the Financing of Terrorism [45] bligates parties to criminalize the financing of terrorism. According to the Convention, a person commits an offence if that person “unlawfully and wilfully, provides or collects funds with the intention that they should be used” in order to carry out an act that constitutes an offence within the scope of the annexed UN conventions “or any other act intended to cause death or serious bodily injury to a civilian … when the purpose of such act … is to intimidate a population, or to compel a government or an international organisation to do or abstain from doing any act.” [46] Attempt as well as various forms of participation, contribution and organisation are also dealt with in the Convention. [47] 64UN Security Council Resolution 1373 65UN Security Council Resolution 1373, which was adopted on 28 September 2001, [48] shortly after the 9/11 attacks, contains a similar obligation. In the area of substantive criminal law, the Security Council decided that “all States shall ... criminalize the wilful provision or collection, by any means, directly or indirectly, of funds by their nationals or in their territories with the intention that the funds should be used, or in the knowledge that they are to be used, in order to carry out terrorist acts.” Furthermore, “all States shall ... ensure that any person who participates in the financing, planning, preparation or perpetration of terrorist acts or in supporting terrorist acts is brought to justice and ensure that, in addition to any other measures against them, such terrorist acts are established as serious criminal offences in domestic laws and regulations and that the punishment duly reflects the seriousness of such terrorist acts.” In contrast to UN Security Council Resolution 1624, which only “calls upon” States, [49] Resolution 1373 is intended to be binding (States “shall” criminalize). Like the other UN instruments, the resolution is applicable to acts involving terrorist motives committed online. 66CoE Convention on Laundering, Search, Seizure and Confiscation of the Proceeds from Crime 67The CoE Convention on Laundering, Search, Seizure and Confiscation of the Proceeds from Crime [50] also contains rules pertaining to the adoption of substantive criminal law provisions. The “laundering offences” defined in Article 6 include the various acts of conversion or transfer of property that is the proceeds of crime, the concealment or disguise of such property’s true nature, the acquisition of such property, and the participation in such acts. However, in contrast to the above UN instruments, the convention does not cover the financing of crimes with legally obtained funds. For that reason, the substantive criminal law provisions of the convention as well as of other UN and EU money laundering instruments are not dealt with in detail here. 68Additional Protocol to the CoE Convention on Cybercrime 69During the process of drafting the Convention on Cybercrime, it was difficult to reach an agreement on the criminalization of acts of a racist and xenophobic nature. [51] Thus, these acts were addressed in a separate additional protocol. [52] According to the Protocol, “each Party shall adopt such legislative and other measures as may be necessary to establish as criminal offences under its domestic law, when committed intentionally and without right, the following conduct”: 70Art. 3 : Dissemination of racist and xenophobic material through computer systems, i.e., “distributing, or otherwise making available, racist and xenophobic material to the public through a computer system.” 71Art. 4 : Racist and xenophobic motivated threat, i.e., “threatening, through a computer system, with the commission of a serious criminal offence, as defined under its domestic law, (i) persons for the reason that they belong to a group distinguished by race, colour, descent or national or ethnic origin, as well as religion, if used as a pretext for any of these factors; or (ii) a group of persons which is distinguished by any of these characteristics.” 72Art. 5 : Racist and xenophobic motivated insult, i.e., “insulting publicly, through a computer system, (i) persons for the reason that they belong to a group distinguished by race, colour, descent or national or ethnic origin, as well as religion, if used as a pretext for any of these factors; or (ii) a group of persons which is distinguished by any of these characteristics.” In addition, Article 6 addresses the denial, gross minimisation, approval, or justification of genocide or crimes against humanity by “distributing or otherwise making available, through a computer system to the public, material which denies, grossly minimises, approves or justifies specific acts constituting genocide or crimes against humanity.” According to Article 7, the substantive law provisions must be accompanied by rules concerning aiding and abetting. 73With respect to terrorism, the provisions of this Protocol are relevant to threats and insults committed with the intent to incite conflicts and violence between groups distinguished by race, colour, or national or ethnic origin. The provisions are directed at IT-based content and are therefore also applicable to the use of the Internet for terrorist purposes. 74European Union Council Framework Decision on combating racism and xenophobia 75A similar proposal of the European Union for a Council Framework Decision on combating racism and xenophobia has not yet been enacted. [53] 76As mentioned above, most of the offences that target illegal content have a critical relationship with freedom of expression, which is a basic element of democratic and pluralistic societies. This is especially important in the present context since the free and unhindered dissemination of information and ideas is a most effective means of promoting understanding and tolerance, which can, in turn, help prevent terrorism. These aspects are addressed by a multitude of international declarations that address the tension between fighting terrorism and protecting human rights. The basic instrument of protection for this aim is the European Convention on Human Rights, [54] which guarantees the right to freedom of expression (Art. 10). This guarantee is taken up in the texts of many of the conventions discussed above, and the relevant case law of the European Court of Human Rights is cited in the Explanatory Report to the Council of Europe Convention on the Prevention of Terrorism. [55] Furthermore, there are other instruments besides the European Convention on Human Rights that deal more specifically with the conflict between preventing terrorism and protecting human rights. [56] In addition, there are special instruments that cover the specific aspect of preventing terrorism and protecting the freedom of the press. The CoE Declaration on freedom of expression and information in the media in the context of the fight against terrorism, [57] for example, calls on public authorities in Member States to refrain from adopting measures equating media reporting on terrorism with support for terrorism, but also recommends that the media be aware of their responsibility not to contribute to the aims of terrorists and to adopt self-regulatory measures. Similar recommendations can be found in the Council of Europe Parliamentary Assembly Recommendation 1706 on “Media and Terrorism,” [58] n Recommendation 1687 on “Combating terrorism through culture,” [59] and in many other international declarations. [60] he OSCE Ministerial Council Decision No.3/04 of 2004 on combating the use of the Internet for terrorist purposes also decided that “States will exchange information on the use of the Internet for terrorist purposes and identify possible strategies to combat this threat, while ensuring respect for international human rights obligations and standards, including those concerning the rights to privacy and freedom of opinion and expression.” [61] These declarations, recommendations, and reports show that the complex problem of balancing freedom and security, especially with respect to press publications on terrorism is discussed on the international level. An assessment of the appropriateness of the approaches taken in all these conventions and instruments is, however, beyond the scope of this report. 77Problems similar to those experienced in the traditional press context arise in the Internet context as well. Internet providers who transmit and store the illegal content of perpetrators – along with huge amounts of legal data –, generally do so without knowledge of the data and, in particular, without knowledge of the legality of the data according to the laws of the countries through which the data are being transmitted. Thus, with respect to the dissemination of illegal content fostering terrorism, the question arises as to the conditions under which host service providers on the Internet (storers of third-party content) as well as access and network providers (transmitters of third-party content) can be held responsible for such data. Similar questions regarding criminal responsibility for third-party content arise with respect to search engines and with respect to liability in general for Internet links. [62] Attempts in many countries to address these problems by means of the general criminal law rules of participation have shown that these rules are inadequate and that special legislation is required in order to ensure legal security. The analysis of the Explanatory Report to the Council of Europe Convention on the Prevention of Terrorism indicates that this central problem was not considered in the drafting process of the Convention. [63] The EC Directive on electronic commerce [64] ddresses these problems. It seeks to contribute to the proper functioning of the European internal market by ensuring the free movement of information society services between Member States : “Member States may not, for reasons falling within the coordinated field, restrict the freedom to provide information society services from another Member state” (Art. 3 Sec. 2). Only in situations covered by Article 3 Secs. 4 to 6 are Member States entitled to take measures in derogation of Article 3 Sec. 2 (e.g., when the measures are necessary for reasons of public policy, in particular the prevention, investigation, detection, and prosecution of criminal offences). Thus, the Directive aims to harmonize the liability of natural and legal persons who provide information society services : In certain cases involving the “mere conduit” of data, access providers are broadly exempt from civil and criminal liability (Art. 15). In certain cases involving the storing of data, host service providers are only liable if they have actual knowledge of illegal activity or information (Art. 14). Similar regulations exist with respect to caching functions of Internet providers (Art. 13). This liability regime is important not only for ensuring free exchange of information and legal certainty for Internet providers, it is also important for the prosecution of past crimes and for the prevention of illegal content in the future as well. It provides the basis for “notice and takedown procedures”, by which host service providers storing illegal content can be forced to erase or block illegal information after they have been given notice concerning the presence of the illegal content on their servers. The existence of “notice and takedown procedures” enables hotlines (services that collect tips from Internet users concerning illegal information from the public) and the police to force host service providers to take down illegal content so that this content can no longer be accessed by the public. [65] Such “notice and takedown procedures,” hotlines, awareness-raising, industry self-regulation, and codes of conduct are the most important tools for the prevention of illegal content on the Internet. 78The analysis undertaken here shows that the dissemination of the various types of illegal terrorist content is addressed by international instruments in an extensive and differentiated manner :
79The international instruments also cover general aspects of these contents, especially with respect to the difficult balancing of freedom and security :
80In all areas covered by these conventions, one might argue either for more far-reaching or for more restrained solutions. However, this is a common situation for an area in which both a difficult balancing of interests and broad international agreement are required. Slightly different policy evaluations alone do not justify a possible revision of the substantive criminal law provisions of international conventions covering illegal content on the Internet. This can be illustrated with respect to glorifying and justifying terrorism and terrorist acts. These acts are only partly covered in Article 5 of the Convention on the Prevention of Terrorism by the vague wording “the distribution of a message to the public, with the intent to incite the commission of a terrorist offence, where such conduct, whether or not directly advocating terrorist offences, causes a danger that one or more such offences may be committed.” However, a more extensive or a more precise wording with respect to glorifying and justifying terrorist acts might conflict with such rights as freedom of expression and freedom of the press. [67] Thus, in the context of this general overview of possible problems, the current regulation on glorifying and justifying terrorism cannot be considered a clear gap, neither with respect to criminalization nor with respect to civil liberties. In addition, on the political level, reopening these issues for discussion only two years after the adoption of the Convention is not a real option as such a discussion would hamper the process of signing and ratifying the Convention. 81The situation of illegal content, however, is different as far as the special problems associated with threatening to commit terrorist offences are concerned. In some of the UN conventions dealing with specific terrorist offences, threatening to commit the described acts is not criminalized. The EU Council Framework Decision of 2002 goes further than the UN conventions in that it covers “threatening to commit any of the acts listed” in its broad catalogue of terrorist offences (including attacks on infrastructures): however, as the threat must be related to one of the specified acts, the Framework Decision does not cover general unspecified threats. The Council of Europe Convention on the Prevention of Terrorism does not contain a general threat provision with respect to terrorist offences, either. The Explanatory Report to the Convention and the underlying expert report do not address the issue of threats to commit terrorist acts. [68] This gap should be a topic for future reform discussions at the CoE or UN level. On the Council of Europe level, a general provision could be included in an additional protocol to the Convention on the Prevention of Terrorism. Another – more systematic – solution would be to create a comprehensive CoE Convention on Terrorism in which the various terrorist offences (including ancillary offences and general rules) would be systematized and consolidated. [69] The problem could also be dealt with on the UN level by systematically analysing the need to amend the specific terrorism conventions that currently do not cover the threat to commit the relevant offence. However, such an offence-specific approach could cause problems in the context of unspecified general threats that do not refer to an act enumerated in one of the UN conventions. In any event, the question of the form and content of threats to be covered would have to be carefully considered and limited, with a focus on destructive attacks and not on the “supporting offences” of glorifying terrorism, training for terrorism, recruiting for terrorism, and fundraising. 82An additional problem arising in this context is due to the fact that the Council of Europe and the UN conventions provide for liability as direct perpetrators and as aiders and abettors. Application of such general rules with respect to the liability of providers does not lead to clear results and legal certainty. In contrast, the EC Directive requires Member States to create provisions that specifically regulate the liability of various types of Internet providers. This is advantageous with respect to legal certainty. In addition, increased specificity and a broader harmonization of rules establishing the responsibility of Internet providers could serve as the basis – at least for the aforementioned harmonized areas of illegal terrorist content – for specific “notice and takedown procedures” [70] on an international level. Such rules could then be the basis for improved practical cooperation and for international public-private partnerships (e.g., hotlines, codes of conducts for providers, joint international efforts to erase, to block, and/or to monitor illegal content). [71] Given the amount of terrorist propaganda on the Internet, this issue is an important one. Open societies should not needlessly leave the Internet and other electronic communication systems vulnerable to abuse at the hands of their adversaries. On the other hand, they should also abstain from ineffective control methods of a purely symbolic nature, especially if these methods infringe information rights, contribute to the development of uncontrollable surveillance systems, and create high costs for the Internet industry. Thus, it is essential to investigate the possibilities, the dangers, and the limits of international efforts to prevent illegal content on the Internet and in other electronic information systems. The Council of Europe, with its long tradition in the development of criminal law and in the protection of civil liberties, would be the ideal institution to coordinate such efforts. 83Furthermore, such rules and procedures are important not only in the context of the dissemination of illegal terrorist content but also with regard to the dissemination of other illegal content, such as child pornography. Thus, it would make sense to develop rules and procedures that would apply both to illegal terrorist content as well as to the many other types of illegal material for which an international consensus can be found. 84Finally, a serious gap can again be identified with respect to the signing, ratification, and implementation of the various instruments : The most important international instrument against the illegal dissemination of illegal terrorist content, the Convention on the Prevention of Terrorism, has 39 signatures and six ratifications. [72] Thus, the goal of preventing safe terrorist harbours by coordinating national rules on substantive criminal law has not yet been achieved. As a consequence, future efforts should concentrate on the signing, ratification, and implementation of the Convention. 85Computer systems and the Internet are also used to support communication relating to planning of terrorist activities as well as to facilitate other preparatory acts for all types of terrorist cases. The perpetrators may send encrypted email or email containing hidden messages; they may acquire information online (e.g., tips on constructing bombs, on hostage-taking, or on hijacking). They may use the Internet to analyze targets by satellite maps available on the Internet, to gather other types of information such as reports of security weaknesses in airports, to pursue logistical planning, to engage in money laundering (e.g., by means of Internet banking), or to make money by selling pirated software and by other crimes using the Internet. The analysis of seized computer systems has confirmed that such acts already play a considerable role in practice. [73] 86The above-mentioned activities are addressed to a certain degree by the aforementioned conventions. As described, the criminal acts dealt with in these conventions are broadly defined and the definitions do not specifically address the question of (traditional or computer-based) means of commission. Most of the provisions in these conventions include adequate rules on participation as well as rules covering preparatory acts and attempt. 87Besides these rules of the general part of criminal law, there are additional statutes in the specific part of criminal law which already cover preparatory acts at an earlier stage and also extend the attribution of these acts to accessories. On the international level such respective rules on “conspiracy” and “participation in criminal organizations” are addressed in the following additional instruments. 88UN Convention Against Transnational Organized Crime 89The UN Convention Against Transnational Organized Crime [74] aims to criminalize participation in an organized criminal group (Art. 5), laundering of proceeds of crime (Art. 6), corruption (Art. 8) and obstruction of justice (Art. 23). Article 5 reads as follows : Art. 5 : Criminalization of participation in an organized criminal group 1. Each State Party shall adopt such legislative and other measures as may be necessary to establish as criminal offences, when committed intentionally : (a) Either or both of the following as criminal offences distinct from those involving the attempt or completion of the criminal activity : (i) Agreeing with one or more other persons to commit a serious crime for a purpose relating directly or indirectly to the obtaining of a financial or other material benefit and, where required by domestic law, involving an act undertaken by one of the participants in furtherance of the agreement or involving an organized criminal group; (ii) Conduct by a person who, with knowledge of either the aim and general criminal activity of an organized criminal group or its intention to commit the crimes in question, takes an active part in : a. Criminal activities of the organized criminal group; b. Other activities of the organized criminal group in the knowledge that his or her participation will contribute to the achievement of the above-described criminal aim. 90Article 2a defines an organized criminal group as “a structured group of three or more persons, existing for a period of time and acting in concert with the aim of committing one or more serious crimes or offences established in accordance with this Convention, in order to obtain, directly or indirectly, a financial or other material benefit.” Thus, Article 5.1 (a) (ii) can be relevant, if terrorist groups, in addition to their destructive activities, commit crimes with a financial or other material benefit in order to finance the costs of their political crimes. However, the requirement of obtaining “a financial or other material benefit” (which is also contained in Article 5.1. (a) (i) offering an alternative “conspiracy approach”) limits the application of the Convention in many cases of terrorism. [75] 91EU Council Framework Decision on Combating Terrorism 92Unlike Article 5.1 (a) of the EU Convention Against Transnational Organized Crime, Article 2 of the EU Council Framework Decision on combating terrorism [76] contains a more specific “offence relating to a terrorist group.” It includes “participating in the activities of a terrorist group, including by supplying information or material resources, or by funding its activities in any way, with knowledge of the fact that such participation will contribute to the criminal activities of the terrorist group.” This wording is not limited to recruiting and training for terrorism but covers broadly all types of IT-based support given to a terrorist group irrespective of its – political or financial – goals. [77] 93The analysis mentioned above shows that no computer-specific problems arise when treating communication activities as participation or when treating advanced planning activities as attempt. Thus, just as the general rules on attempt and participation can be applied to traditional acts outside the IT-area, they can be used when terrorists communicate with each other online or prepare their attacks with the help of computer systems. As a consequence, there is no computer-specific gap with respect to terrorist use of the Internet. [78] 94For that reason, one might only raise the question of whether the criminalization of preparatory acts in support of terrorist organisations should be extended. As shown above, [79] Article 2 of the EU Council Framework Decision on combating terrorism [80] covers all acts of “participating in the activities of a terrorist group. In contrast, Article 5.1 (a) of the UN Convention Against Transnational Organized Crime [81] prohibits taking an active part in the criminal activities of an organized criminal group that – according to Article 2a – must have the aim of committing serious crimes “in order to obtain … a financial or other material benefit.” This difference between the “terrorist specific approach” of the EU (specifically directed at politically motivated terrorist groups) and the “organized crime approach” of the UN (limited to organized groups with serious financial benefit crimes) illustrates the question of whether the broader EU approach of criminalizing support for a terrorist organisation should also be implemented on a more global level in a Convention of the Council of Europe or the UN. 95However, this general question goes beyond the scope of the present analysis, with its focus on cyberterrorism and other terrorist use of the Internet. Dealing with the question of a terrorist specific group offence would cause difficulties relating to defining the respective terrorist act (e.g., by referring to the special UN conventions or by creating a general definition of terrorism) and would have to deal with the question on how legal incertainty, overcriminalisation, and abuse of such a broad “material support provision” could be prevented. In addition, one would have to consider that many preparatory acts (such as public provocation of terrorism, recruitment, training, and financing) are already covered by the above-mentioned specific rules in the CoE Prevention of Terrorism Convention. Similar questions would arise with a possible extension of the “conspiracy approach” of Article 5.1 (a) (i) of the EU Council Framework Decision to the CoE- or UN-level. Thus, analysing all of these general and specific questions would require a specific study and cannot be pursued here. 96New forms of cybercrime as well as the commission of traditional crimes in computer networks pose new, computer-specific problems not only with respect to substantive criminal law but also for the investigation, prosecution, and prevention of crime. These problems stem from a variety of sources : the complex technical environment of computer systems; the multitude and invisibility of computer data; the techniques of encryption and steganography; the difficulty of identifying perpetrators on the Internet; the fact that computer systems can be attacked from a distance; and the global nature of the Internet, which cannot be controlled by purely national measures. Thus, special procedures are essential for investigations of criminal activity on the Internet and in other IT environments. 97Legal rules for these computer-specific investigations can be found on the international level in the CoE Cybercrime Convention. In addition, there are other instruments with special procedural rules addressing problems of international cooperation. In order to systemize the existing international standards, this chapter will analyse the international conventions for (A) computer-specific investigations, (B) financial investigations, and (C) investigations in terrorist and other cases. 98CoE Convention on Cybercrime 99The development of the CoE Convention on Cybercrime [82] was not only a success with respect to substantive criminal law but also a breakthrough in the international development of computer-specific investigations in computerized environments. Besides dealing with substantive criminal law, the Cybercrime Convention obliges parties to adopt a variety of legislative measures for computerspecific investigations. These measures are laid down in Articles 14 through 22 of the Convention. They cover, among other things, the expedited preservation of stored computer data, the expedited preservation and partial disclosure of traffic data (necessary for tracing attacks back to their origin), production orders to submit specified computer data, search and seizure of stored computer data, real-time collection of traffic data, interception of content data, conditions and safeguards for these measures, as well as jurisdictional rules. [83] 100These specific investigation methods are key for successful Internet investigations, both in general and specifically in terrorist cases. This is obvious, for example, if the perpetrators do not attack other computers directly but “jump” via a number of thirdparty computer systems that they hijack, control, and abuse as intermediaries in order to shield the identity of their own system. Using this technique, an attack from country A on country B can proceed via numerous computer systems in many jurisdictions. Since the victim can – at best – identify only the “direct” (ultimate) attacker, the process of tracing and identifying the perpetrator often depends on the analysis of the traffic data of many computer systems in numerous countries. Since these traffic data are often not stored by Internet providers – or not stored for a long period of time – the implementation of common traceback procedures requires rules for “quick freeze procedures” of data that would otherwise be erased and/or obligations on providers to retain traffic data for a certain period of time. The Council of Europe’s Cybercrime Convention concentrates on such specific “quick freeze” provisions (differentiating between a fast “quick freeze” and the later transfer procedure). The corresponding procedure of expedited preservation of data is a completely new measure of criminal law. 101Additional specific rules concern other specialized instruments, for example, with respect to search and seizure in connected computer systems (which might be located in different countries), or production orders to submit specified computer data (which are often difficult for the prosecution to access either due to the encryption of data or due to the technical problems of dealing with IT applications unfamiliar to the investigators). These examples show that the Cybercrime Convention is designed to address the special problems of investigations in the IT-environment and is the central instrument for procedural measures and for international cooperation in the area of cybercrime. 102Consequently, it is necessary to ensure that the specialized procedural provisions of the Cybercrime Convention are applicable in cases involving the use of the Internet for terrorist purposes. The relevant scope of the procedural provisions of the Cybercrime Convention is regulated in Article 14 : “Each Party shall apply the powers and procedures” of section 2 of the Convention (Arts. 14 through 21) to “(a) the criminal offences established in accordance with Articles 2 through 11 of this Convention; (b) other criminal offences committed by means of a computer system; and (c) the collection of evidence in electronic form of a criminal offence.” This leads to a clear result : Subsections (b) and (c) guarantee that – subject to two exceptions – the special investigation methods of the Cybercrime Convention can be applied to all kinds of criminal activities on the Internet. [84] As a consequence, it is safe to say that there are no gaps of coverage regarding the use of existing computer-specific procedural provisions of the Cybercrime Convention to investigate cyberterrorism and other forms of terrorist use of the Internet. Thus, the only question that arises is whether the instruments of the Convention are adequate and uptodate (see infra III.D.). 103EC Directive on Data Retention 104Whereas the goal of the Cybercrime Convention is to address all procedural problems in a computerized environment, the EC Directive on the retention of data of publicly available electronic communication services [85] only deals with a specific issue that could not be agreed upon during the drafting of the Cybercrime Convention : as explained above, successful investigation on the Internet and in other electronic networks depends to a large degree on the ability to trace back perpetrators to their original computer system. Ordinary traceback procedures require that certain traffic data be stored so that they can be used in an investigation that in many cases may not take place until some time after the crime occurs. Thus, the EC Directive on the retention of data of publicly available electronic communication services obligates Member States to adopt measures providing that certain traffic data and location communication services be retained for periods of not less than six months and not more than two years from the date of the communication (with exceptions in Art. 12 of the Directive). 105Such retention of data could be especially useful for the investigation of terrorist activity. It cannot fully be replaced by the “quick freezing” of traffic data provided for by the Cybercrime Convention, since quick freezing of traffic data cannot take place if the data are not stored. However it could allow for a shortening of the retention period, thus reducing the impact on the data protection interests of Internet users. 106Specific investigative mechanisms and other measures beyond those contained in the Cybercrime Convention can be found in the context of special financial investigations with respect to money laundering and the financing of terrorism. Such measures are regulated in the instruments against the laundering of the proceeds from crime and against the financing of terrorism. 107The CoE Convention on Laundering, Search, Seizure and Confiscation of the Proceeds from Crime [86] ontains specific measures on confiscation, investigation, freezing, seizure and confiscation, preventive measures, as well as provisions establishing financial intelligence units (FIUs). According to Article 2 of the Convention, parties must ensure that the provisions are applicable to search, trace, identify, freeze, seize, and confiscate property used for the financing of terrorism or the proceeds of this offence. [87] 108Similar measures are found in the UN International Convention for the Suppression of the Financing of Terrorism [88] or – with respect to organized crime – in the UN Convention against Transnational Organized Crime. [89] The same is true of UN Security Council Resolution 1373, [90] according to which all States must implement a variety of measures against terrorism, such as preventing and suppressing the financing of terrorist acts, freezing financial assets of terrorists, preventing acts of terrorism, affording measures of assistance, providing effective border controls, creating provisions of early warning, exchanging information, identifying the whereabouts and activities of persons, and conducting inquiries with respect to the movements of funds relating to the commission of such offences. 109None of these instruments depends on whether the offences are committed with the assistance of IT-systems. Thus, there are no gaps in these instruments with respect to their applicability in an IT environment. 110Other conventions on terrorism include either specific or general rules on investigation. For example, the Council of Europe Convention on the Prevention of Terrorism [91] not only creates obligations to criminalize illegal content but also contains general procedural provisions with respect to these offences. The same is true for the UN Convention against Transnational Organized Crime. [92] As far as national procedural law is concerned, these obligations include the establishment of certain conditions and safeguards, the protection of victims of terrorism, the establishment of jurisdiction, and the duty to investigate. Additional regulations are contained in general instruments on mutual assistance and extradition, such as the European Convention on Mutual Assistance in Criminal Matters and its two additional protocols [93] as well as in the European Convention on Extradition and its two additional protocols. [94] Since these general rules on investigation are drafted broadly, it is not a problem to apply the provisions to cyberterrorism and to other use of the Internet for terrorist purposes. 111The analysis shows that – like the rules of substantive criminal law – the procedural rules of the Cybercrime Convention are also applicable with respect to all use of the Internet for terrorist purposes and that the main problems of national procedural law with respect to the terrorist use of the Internet are addressed by the Cybercrime Convention. This is primarily due to the fact that the computer-specific investigation measures contained in Article 14 of the Cybercrime Convention apply not only to computerspecific offences defined in the Convention but to all “other criminal offences committed by means of a computer system” and to the “collection of evidence in electronic form of a criminal offence” as well. This includes all types of terrorist use of the Internet and other computer systems. Furthermore, it is not a problem to apply the special investigation methods of the international instruments for financial and terrorist cases to the IT-environment. As a consequence, there are no gaps in the application of the existing international rules on national criminal procedure to cyberterrorism or to other terrorist use of the Internet. 112The only questions that remain open are whether the procedural instruments of the Cybercrime Convention are adequate for the investigation of cases of suspected terrorism and whether they are up-to-date. Despite some criticism concerning the lack of transparency in the historical development of its provisions and a resulting lack of concrete safeguards for the protection of civil liberties, [95] it is widely acknowledged that the investigation methods described in the Cybercrime Convention are well-designed and essential for the efficient investigation of computer systems. In addition, special procedural conditions and safeguards are taken into account by Article 15, which refers to the Council of Europe Convention for the Protection of Human Rights and Fundamental Freedoms. [96] As a consequence, and especially with a view to the difficult process of drafting international conventions, there are no grounds for jeopardizing the signing and ratification of the Convention by reconsidering the regulated issues. Thus, in order to avoid safe havens for cybercriminals and terrorists, there should be a clear message to sign and ratify the Cybercrime Convention. 113However, as the Cybercrime Convention was drafted between 1997 and 2000, as the technical environment and the available forensic investigation tools change rapidly, and as terrorism creates special risks, the necessity and possibility of updating the procedural tools in an additional protocol o the Cybercrime Convention should be explored. Such a protocol might address, for example, the clandestine use of hacking techniques employed by the police when searching computer systems online (so-called “clandestine online searches”): An effective international cooperation under traditional mutual assistance rules requires that all parties have similar provisions in these areas and that these measures also be taken up in the rules on international cooperation. If, for example, state A requests another state to conduct online searches, such measures must be possible in both state A and in the requested state. Similar problems arise with other types of forensic software, for example, the clandestine installation of a key logger program on the computer system of a suspect in order to circumvent his or her encryption (which should be discussed as an alternative to highly problematic solutions such as limitations on encryption or encryption key escrow procedures). Another controversial issue has to do with the period of time for which traffic data should be stored. [97] Even if these questions were discussed by the drafters of the Cybercrime Convention, they should be reconsidered in light of the new criminological, technical, and forensic developments and of the new risks posed by terrorism. Also, if specific solutions are rejected, this should be communicated to Member States so that they can avoid adopting the rejected approaches. 114An additional protocol to the Cybercrime Convention would also be a possibility with respect to preventive measures dealing with the blocking of illegal content. In the context of search and seizure, Article 19 of the Cybercrime Convention not only empowers competent authorities to seize or similarly secure a computer system but also permits the authorities to “render inaccessible or remove those computer data in the accessed computer system.” However, the Convention does not say how this should be done with respect, for example, to data on the Internet, and the search and seizure provision of Article 19 cannot replace a general regulation for blocking Internet data. [98] oreover, the legal, procedural, and technical questions of blocking illegal content on the Internet are highly complex and controversially discussed all over the world. Solution of these questions would require not only the participation of lawyers but also that of specialists in the field of computer systems and networks. Furthermore, the technical problems in this area are exacerbated since a possible control of illegal content cannot be limited to illegal websites on the Internet but should also be extended to content disseminated by other Internet services (such as Internet relay chat) or to media disseminated via mobile phones (such as video uploading). Any approach dealing with illegal content on the Internet will also require a difficult balancing of security interests and human rights, a task for which the Council of Europe, as an international institution, would be ideally suited. 115As far as practical results are concerned, there is the risk that no perfect or even adequate solution can be found for blocking access to illegal content on the Internet in the future because of the extreme difficulty of controlling the Internet and the global cyberspace. However, in this case, even a rejection of possible solutions would be extremely helpful for reasons of legal certainty. [99] Rejection could also help prevent a situation in which states enact control mechanisms that are ineffective and doomed to failure and that create risks for the free flow of information and privacy rights. Thus, working on global solutions for the prevention of illegal content on the Internet could be a promising task for the Council of Europe, an institution dedicated both to the prevention of crime and to the protection of freedom. 116However, an evaluation of the up-to-dateness of the procedural measures of the Cybercrime Convention as well as the development of preventive measures for illegal content is not a problem specific to cyberterrorism and other uses of the Internet by terrorists but rather is an issue that arises in the context of organized crime, economic crime, and all other forms of crime as well. Thus, as indicated above, a broader approach that would go beyond the scope of cyberterrorism and the use of the Internet for terrorist purposes should be considered. 117The special investigation problems encountered in computerized environments, especially in the global cyberspace, require not only computer-specific investigation measures but also require corresponding rules for international legal cooperation when dealing with these measures. Again, the most highly developed regime of rules of international legal cooperation is found in the Cybercrime Convention of the Council of Europe f 2001, specifically in Chapter III of the Convention. [100] Article 24, for example, consists of an extradition provision applicable in cases involving the computer-specific offences established in accordance with Articles 2 through 11, provided that they are punishable under the laws of both parties concerned (double criminality requirement). Chapter III also contains detailed computer-specific provisions for mutual assistance, including cooperation in the areas of expedited preservation of stored computer data, expedited disclosure of preserved traffic data, accessing of stored computer data, real-time collection of traffic data, and interception of content data. It also provides general principles relating to mutual assistance, confidentiality, and limitation on use, and addresses the issue of spontaneous information. [101] Article 27 subsection 4 allows a requested party to refuse assistance if the request concerns an offence that the requested party considers a political offence or if it considers it likely that execution of the request will prejudice its sovereignty, security, ordre public, or other essential interests. 118The Cybercrime Convention also puts great emphasis on practical cooperation. It provides for the organisation of a “24/7 network” with contact available on a twenty-four hour, seven-day-a-week basis. Such contact is extremely important, for example, in cases where traceback procedures based on traffic data and quick freeze operations are required. Article 35 requires each party to designate “a point of contact available on a twenty-four hour, seven-day-a-week basis, in order to ensure the provision of immediate assistance for the purpose of investigations or proceedings concerning criminal offences related to computer systems and data, or for the collection of evidence in electronic form of a criminal offence.” Such assistance includes the provision of technical advice, the preservation of data pursuant to Articles 29 and 30, the collection of evidence, the provision of legal information, and the locating of suspects. [102] 119As in the case of procedural rules, the scope of the provisions on cooperation is broad, covering not only the specific offences of the Convention but all “criminal offences related to computer systems and data, or for the collection of evidence in electronic form of a criminal offence” (Art. 23). The obligation to cooperate as to this broad class of crimes was agreed upon because there is the same need for close international cooperation in all these cases. Only Articles 24 (extradition), 33 (mutual assistance regarding the realtime collection of traffic data), and 34 (mutual assistance regarding the interception of content data) permit the parties to provide for a different scope of application of these measures. [103] Thus, the special cooperation proceedings of the Cybercrime Convention can also be used for cyberterrorism and for all other types of terrorist activity on the Internet. 120The special international instruments against money laundering and the financing of terrorism described above also provide for specific cooperation rules. 121* The CoE Convention on Laundering, Search, Seizure and Confiscation of the Proceeds from Crime [104] contains specific rules of cooperation with respect to investigations of bank data, spontaneous information, provisional measures, confiscation, and cooperation between specialised financial investigation units. The Convention reserves broad grounds for refusal not only with respect to political offences but also with respect to the national ordre public and other reasons. Refusal for political offences is, however, excluded for the financing of terrorism (Art. 28). 122* The UN International Convention for the Suppression of the Financing of Terrorism [105] also fosters international cooperation. According to Article 14, requests for cooperation may not be refused on political grounds. 123UN Security Council Resolution 1373 of 2001 [106] nsures in paragraph 3 (g) that “claims of political motivation are not recognized as grounds for refusing requests for the extradition of alleged terrorists” and decides in paragraph 2 (f) that all States shall “afford one another the greatest measure of assistance in connection with criminal investigations or criminal proceedings relating to the financing or support of terrorist acts.” At the time it adopted Resolution 1373, the Security Council also established the monitoring Counter-Terrorism Committee (CTC). Member States are required to report regularly to the Committee on the measures they have taken to implement Resolution 1373. 124UN Security Council Resolution 1535 [107] creates among other things the Counter-Terrorism Committee Executive Directorate (CTED), which provides the CTC with expert advice on all areas covered by resolution 1373. The CTED was established also with the aim of facilitating technical assistance to countries as well as promoting closer cooperation and coordination both within the UN system of organizations and among regional and intergovernmental bodies. 125The rules in these financial investigation instruments on cooperation apply regardless of whether or not the perpetrators made use of computer systems. 126Rules on cooperation are also provided in the various conventions, protocols, and decisions that address terrorism :
1271. Most other instruments against terrorism also contain general provisions on international cooperation. This is true of the UN conventions and protocols against specific acts of terrorism (such as bombing) discussed above. [111] These conventions each contain a provision according to which the defined offences must be deemed extraditable offences in any existing treaty between States parties. [112] In addition, for purposes of extradition, offences shall be treated as if they had been committed not only in the place where they occurred but also in the territory of the states that have established jurisdiction under that convention. The conventions also contain special provisions that exclude the political offence exception, for example, Article 11 of the Convention for the Suppression of Terrorist Bombings, Article 15 of the Convention for the Suppression of Acts of Nuclear Terrorism, Article 16 No. 14 of the UN Convention Against Transnational Organized Crime, and Article 9 Sec. 1a of the Hostages Convention. 128For these provisions, again, it is irrelevant whether or not the perpetrator committed the defined acts with the support of a computer system. Thus, there are no computer-specific gaps in any of these instruments. 129Particularly in cases where there are no applicable specific cooperation agreements for cybercrime, terrorism, or money laundering, mutual assistance in criminal matters and extradition are regulated by general conventions and protocols. These instruments contain broad grounds for refusals to cooperate, such as for political offences or with respect to the ordre public. This is true of the European Convention on Mutual Assistance in Criminal Matters and its two additional protocols [113] as well as the European Convention on Extradition and its two additional protocols. [114] These conventions are applicable to both computer-specific and non-computer-specific crimes. 130The cooperation agreements that specifically address cybercrime are applicable to all kinds of cyberterrorism and other use of the Internet for terrorist purposes. Thus, the detailed cooperation procedures of the Cybercrime Convention are available in cases of terrorist use of the Internet. These procedures are the most important instruments for the identification and prosecution of terrorism on the Internet. Similarly, the instruments that address international cooperation in financial, terrorist, and other general investigations can be applied in an IT-environment, thereby also enabling investigations of all types of terrorist activities involving the use of computer systems. 131The only question that remains open is whether the existing international instruments of cooperation should be amended or updated. This question is particularly relevant with respect to the fact that – unlike many of the existing conventions on terrorism – the Cybercrime Convention permits a refusal to cooperate for political reasons. Such a result could be changed by the introduction of a special provision on cyberterrorism committed by attacks against computer infrastructures to which the political offence exception would not apply (an option not favoured above). Another option would be to exclude the political offence exception for specific serious acts in the Cybercrime Convention. This would be beneficial to international cooperation. It would also be in accordance with the trend – described above – towards abandoning the political offence exception in serious cases of terrorism. However, even conventions that exclude the political offence exception may allow states party to opt out of the exclusion by means of a reservation (Art. 20 of the CoE Convention on the Prevention of Terrorism, for example). Thus, international efforts with respect to the political offence exception in the Cybercrime Convention and in other conventions are not a priority. However, in the process – recommended above – of evaluating and updating the procedural provisions of the Cybercrime Convention, exclusion of the political offence exception should be considered for certain offences, such as data and system interference, in serious cases. 132A more serious need for improving international cooperation, again, exists with respect to the prevention of illegal content on the Internet. As described above, it is obvious that specific international cooperation mechanisms are necessary for the establishment of the accessory liability of Internet providers, for “notice and takedown” procedures, for the development of new forms of self-regulation, for public-private “co-regulation,” as well as for national instruments for removing and blocking illegal content. These efforts include, but are not limited to, improvements in the sharing of information and allocating of tasks in the control of the global cyberspace. Since purely national control and blocking mechanisms on the Internet are often doomed to failure, effective solutions depend to a great extent on close international cooperation or action on a supranational level. To the extent that the global cooperation of states is essential for such solutions, soft sanctions applicable to non-complying states would be useful, such as those found in the international system of money laundering of the Financial Action Task Force (FATF) of the OECD. Efforts with respect to these issues might lead to an increase in international cooperation with regard to the Internet. A deeper analysis of the new regulatory questions might even lead to the conclusion that the global cyberspace is a common heritage of mankind that – like the high seas – requires new mechanisms of supranational governance implemented by means of new institutions. Thus, in addition to the support for signing, ratification, and implementation of the Cybercrime Convention, these questions merit further efforts with respect to illegal terrorist content as well as other illegal content in a more general context. 133Cyberterrorism against or by means of the Internet poses a significant risk since computer systems today are responsible for carrying out many essential functions of society. Such attacks via the Internet could cause damage not only to the IT-infrastructure and essential electronic communication systems but also to other infrastructures, systems, and legal interests, such as nuclear power stations, electrical supply systems, air control systems, medical computer systems, public administrations, and private companies, all of which depend on the functioning of IT. Interference with many of these systems can also cause harm to the life or well-being of persons. However, at this time, very few cases involving these kinds of attacks are known to the public. 134Instead, a primary use of the Internet and of other electronic communication system consists in the public dissemination of illegal content. The Internet and other communication systems are abused by terrorists in order to threaten the commission of terrorist acts; to incite, advertise, and glorify terrorism; to engage in fundraising for and financing of terrorism; to provide training for terrorism; to recruit for terrorism; and to disseminate racist and xenophobic material. In sum, the Internet has become an important tool by which terrorists send their messages to a broad audience. 135In addition, the Internet and other computer systems play a significant role in the logistical preparation of terrorist offences, including internal communication, acquisition of information (e.g., on bomb-building, hostage-taking, or hijacking), analysis of targets, and other forms of information gathering. 136The existing international conventions and other instruments for the harmonization of national substantive and procedural law and for international cooperation are applicable to the prosecution of cyberterrorism and other use of the Internet for terrorist purposes. The computer-specific provisions of the Council of Europe’s Cybercrime Convention on national substantive law, national procedural law and international cooperation can all be applied to the cases of terrorism analyzed above. For computer-specific reasons, all destructive attacks via the Internet require interference with data, i.e., offences that fall under the substantive law provisions on data and system interference of the Cybercrime Convention. The applicability of the computer-specific procedural rules and the international cooperation law of the Cybercrime Convention to all types of terrorism is due to the fact that the application of the special provisions of the Cybercrime Convention that deal with procedural law and international cooperation law is defined broadly and is not limited to cybercrime. Similarly, the substantive, procedural, and cooperation rules of the international instruments on terrorism, on money laundering, on the financing of terrorism, and on mutual assistance or extradition are also applicable to cyberterrorism since they are worded generally and thus can apply in an IT-environment. 137Consequently, the primary question posed in this report concerning the existence of “terrorist-specific” gaps in “computer-specific” conventions and “computer-specific gaps” in “terrorist-specific conventions” can be answered in the negative as far as the application of the Cybercrime Convention and other instruments is concerned. As a result, only the second question posed remains : whether these instruments have general gaps, i.e., gaps that are not specific for the use of the Internet for terrorist purposes. As explained above, this analysis cannot provide a general “superevaluation” of all relevant international instruments on cybercrime and/or terrorism and their possible gaps with respect to the prosecution of crime and the protection of civil liberties. However, the analysis has analyzed the major problems relevant for both cyberterrorism and for the use of the Internet for terrorist purposes. 1381. The major problem facing all existing international instruments is the lack of signatures, ratifications, and implementations. Broad acceptance is especially important for the Cybercrime Convention as well as for the Convention on the Prevention of Terrorism, which are the most important international instruments for fighting cyberterrorism and other terrorist use of the Internet. The role of the Cybercrime Convention is essential not only for substantive criminal law (with the Convention’s important provisions on data interference and system interference) but also for criminal procedure and the law of international cooperation (with the Convention’s highly specialized investigation and cooperation tools). The Convention on the Prevention of Terrorism is decisive with respect to the creation of adequate substantive criminal law provisions for illegal content. Thus, in the future, serious efforts should be made to promote the process of signing, ratifying, and implementing the Convention. 1392. As a consequence, all additional efforts both within and beyond the present scope of the Cybercrime Convention should be pursued in such a way as not to hinder or distract from signature, ratification, and implementation. 140Thus, the discussion of possible amendments and updates to the Cybercrime Convention in the quickly changing IT-environment should be undertaken only with the aim of a possible additional protocol to the Convention, which would recognize the Convention as its basic mother convention. In such a process, the Cybercrime Convention should be evaluated with regard to its ability to cover newly emerging technical advances, particularly new forensic investigative techniques (such as online searches or the use of key logger software). In the fast-paced technical environment of cybercrime, such evaluations, which frequently lead to revisions and updates, are an absolutely normal process, especially when dealing with high risks such as those posed by terrorism. 141Should a decision be taken to supplement the Cybercrime Convention with a follow-up protocol addressing new investigative techniques, the possibility of excluding the political exception clause for some of its offences – especially in serious cases of data and system interference – could also be considered, thus following the trend of other cooperation instruments, particularly in clearly defined cases of terrorism. 142In addition, the option of adopting a new provision prohibiting serious attacks on IT-based or general infrastructures could be discussed. The advantage of such a provision, however, would be limited and such a provision is not recommended by this report. It is sufficient for countries to evaluate existing domestic statutes on data and system interference and to make sure that they provide sanctions appropriate for cases involving terrorist attacks against computer and other essential infrastructures and other legal interests. However, such “effective, proportionate and dissuasive sanctions” are already required by the Cybercrime Convention, and it can be left to the national legislatures to achieve this result by means of sentencing rules, aggravated offences on data interference, or infrastructure offences. 1433. An additional protocol to the Convention for the Prevention of Terrorism should also be considered in order to achieve full coverage of illegal terrorist content, particularly threats to commit terrorist acts. Currently, such threats are not adequately covered in the relevant Council of Europe conventions, and this deficit is not fully compensated by instruments of other international organisations. Considering the effects of threats to commit terrorist acts, a response is necessary. It would also be possible to cover this issue in a better and more systematic way in the specific UN conventions. However, such an approach would pose problems with respect to unspecified general threats, as it is difficult to deal with such threats by means of the sector-specific approach taken by the UN. [115] Considering possible amendments to the terrorist specific conventions, in a future study one might also analyse whether the EU approach of “participation in a terrorist organization” should be transferred to a wider CoE- or UN level. 144Due to the frequent use of the Internet for the dissemination of illegal terrorist content, additional efforts should be made to develop repressive and preventive measures that are both effective and respectful of civil liberties. This could be done either with special regard to illegal terrorist content or – which is more advisable – in a more general way that would also cover other types of illegal content. 145Effective standards for the prosecution and prevention of illegal content on the Internet could be achieved by means of an additional protocol to the Cybercrime Convention, which could contain new rules for national substantive law, national procedural law, law on international cooperation, soft law, as well as rules establishing public-private partnerships. [116] n the area of substantive law, effective prevention of illegal content not only needs harmonized rules on illegal content in the special part of criminal law (as in the Convention for the Prevention of Terrorism or in the Protocol to the Cybercrime Convention), but also harmonized rules on the responsibility of Internet providers, which could be the basis of international notice and takedown procedures (as in the EC Directive on e-commerce). Such rules would require a difficult balancing of security interests and human rights, especially with respect to freedom of information rights. This is also true for the necessary provisions of procedural law and the law on international cooperation, both of which require specific regulations based on research on technical blocking and control mechanisms on the Internet and must take into consideration the consequences of such measures for the freedom of information. These questions are difficult but essential : Open societies should not leave the Internet and other electronic communication systems vulnerable to the abuse of their adversaries. They should also refrain from enacting ineffective control methods of a purely symbolic nature that seriously infringe freedom of information rights and can lead to the development of uncontrolled surveillance. 146The Council of Europe, with its long tradition in balancing security interests in criminal matters with the protection of human rights, would be an ideal institution to tackle the difficult problems associated with international standards and procedures for illegal content in computer networks. Due to the global nature of the Internet and its strong resistance to national control measures, an initiative in this field could even lead to new forms of cooperation that might recognize the global cyberspace as a common heritage of mankind that requires new mechanisms of supranational governance implemented by new institutions.
|
Computer criminals pose the same risks to investigators when compared to traditional suspects.
Pos Terkait
Copyright © 2024 membukakan Inc.
