Cybercrime
1) Computer assisted crime
2) Computer content crime
3) Computer integrity crime (a newcomer with computers)
one has to be much more precious while investigating cybercrime, otherwise, the criminal doesn’t go to jail. Prosecutor have to show that you have a pretty good idea or you wanted to do this. “Did you really mean to do that?” => need to look for guilty mind/ intention.
Elements have to be proven during procedures. Much less flexibility within laws. If there are too many details, but they would be so useful. Or there would have to be too many laws.
Botnet directive
States of EU has common directive 2013/40/EU
based on cybercrime convention
organized crime
Cybercrime convention
https://moodle.hitsa.ee/pluginfile.php/968253/mod_resource/content/3/CoE-011123-ConventiononCybercrime.pdf
EU, Budapest 2001
61 states involved (also out of Europe, anybody can sign)
other countries are taking it as a draft. Practically, it has a great influence.
National laws have to be based on this convention. Exact implementation s up to the country.
The computer system according to chapter 1, article 1 could be Smartphone, Smart Fridge, IoT teddybear, Parking ticket machine…
For example
Article 2 – Illegal access
Each Party shall adopt such legislative and other measures as may be necessary to establish as criminal offences under its domestic law, when committed intentionally, the access to the whole or any part of a computer system without right. A Party may require that the offence be committed by infringing security measures, with the intent of obtaining computer data or other dishonest intent, or in relation to a computer system that is connected to another computer system.
Article 3 – Illegal interception
Each Party shall adopt such legislative and other measures as may be necessary to
establish as criminal offences under its domestic law, when committed intentionally, the
interception without right, made by technical means, of non-public transmissions of
computer data to, from or within a computer system, including electromagnetic emissions
from a computer system carrying such computer data. A Party may require that the offence
be committed with dishonest intent, or in relation to a computer system that is connected to
another computer system.
BTW no wiki page
the article: THE COUNCIL OF EUROPE CONVENTION ON CYBERCRIME:DEFINING ‘CRIME’ IN A DIGITAL WORLD https://moodle.hitsa.ee/pluginfile.php/2568445/mod_resource/content/2/Cybercrime%20Convention%20_article.pdf descibes what is cybercrime, international cooperation, procedural law the article: The hazards of cyber-vigilantism https://moodle.hitsa.ee/pluginfile.php/2568446/mod_resource/content/2/Cyber%20vigilantism%20article.pdf speaking about anonymous and other groups fighting against cyber criminals and how legal it is.. “cyber-vigilantism can lead to several negativeconsequences” “Courts and policymakers generally disfavour vigilantism” “,because vigilantes operateoutside of the legal system, there is not a “quality control”mechanism to assure a minimum level of preparedness.” ”Although vigilantes may be able to impose their own forms of “justice” more quickly than the government, they often lack the skills of making a full and fair determination about whether their target is actually a bad actor” “Vigilantism also has the potential to escalate tensions andlead to an overall greater amount of violence and criminal activity” “In sum, strong computer hacking laws provide a baselineof expertise and coordination for operations against criminalsand terrorists. Although some vigilantes may be as skilledas government actors, providing a vigilante exception to computerhacking laws could lead to less effective law enforcementby disrupting ongoing government strategies.” “Accordingly, allowing vigilantism by adding an exception to computer hacking laws would increase the likelihood of abuse, and there are no sure-fire safeguards against improper motives” “For instance,China and Russia have long relied on private parties to mountoffensive cyber operations. By allowing similar private sectorvigilantism by domestic actors, the United States, EuropeanUnion member states, and other governments could not aseasily pressure Russia and China to crack down on their owndomestic hackers.5” “As an alternative to cyber-vigilantism, private parties could collaboratewith the government and each other to fight cybercriminals, terrorists, and other bad actors” “Private actors – ranging from large corporations to anonymoushacktivists – often possess a great deal of valuableinformation that helps governments fight cybercrime, terroristpropaganda, and other threats. Policies should ensure thatthese private actors can share the information in the most effectivemanner possible.” “white hat hackers who independently conduct researchwithout the permission of the organizations that ownthe systems or networks that are the subject of the researchmight face prosecution under computer hacking laws” “First, law enforcement officials should clarify the precise authorizationthat ethical hackers must obtain from companiesto prevent the possibility of prosecution under computerhacking laws. Compliance with these guidelines could providehackers with a limited safe harbour from prosecution and civilsuits. This would provide “white-hat” hackers with the certainty that they need to help companies determine their network and system vulnerabilities. Second, governments should consider programs that encourage companies to engage independent security professionals,such as tax incentives. For instance, if a company hiredan outside cybersecurity consultant to assess its network andsystem vulnerabilities, it could receive a dollar-for-dollar taxcredit for those expenses, up to a maximum limit set by statute.The tax credit could be modelled after programs that providesimilar incentives for corporate investments in research anddevelopment. Such a policy would help to encourage companiesto make costly investments that they otherwise would nothave made. Third, governments should more frequently engage whitehat hackers to assess the vulnerability of government networks.To do so, government agencies likely would need toidentify third parties who could obtain the necessary securityclearances, and who would be willing to sign non-disclosureagreements. However, such arrangements could help governmentagencies uncover vulnerabilities that they otherwise wouldnot have identified, preventing incidents such as the 2015 breachof the U.S. Office of Personnel Management, which led to thedisclosure of millions of government employees’ security clearanceapplications.72 Engaging white hat hackers would helpthe government improve security of public sector networks,and it also would encourage private companies to take similarsteps.” vigilant are usuallz faster than governments, thez dont have to obstacle with all permisions and laws “the private and public sectors should continue to develop mechanisms in which they can work together to battle bad actors in cyberspace, with government preserving their law-making, enforcement, and adjudication roles.”
Conclusions Legal tools need to be adopted by all countries Emphasis on harmonization and cooperation Make use of already existing instruments? Should be an integral part of a national cyber sec. strategy. Case studies Case1 bobby as a police oficcer is requesting a data about a car which is standing in front of his house, asking operator about confirmation. Access to computer access (article 2) deals with physical access only, not data! Judge has to decide if that is unauthorised access. We can argue only. Especially about a definition of accessing computer Case 2 keylogger is an interception. Recording Skype is also an interception. The bug is most likely to be an interception, but not necessary under cybercrime convention. Case 3 Comunnication using drafts In Estonia is interception only while email is send. In some countries could be the whole proecess from draft to receiving. Case 4 taking a phone In Estonia it wouldnt be interception, because its stored. In some countries it can be taken as interception of communication process. Case 5 UFO in Russia Illegal interception, illegal access, data interference. He meant to do this. Copying is not part Data interference (article 4). The loss in reputation could arise a cost of damage. Then it would be considered as a serious harm (article 4) and copying data would be Data interference. Case 6 Spambot sending a Malware When u write something on computers hard drive it is an alteration of data already. In criminal law, you can’t punish a person for what he hasn’t done yet. System interference is considering serious hindering, but where is the line? Case 7 spam 7 000 000 mails per hour to server of his previous work. Hindering a data -> system interference. Case 8 his intention was to acces a system, therefore it is not applicable article 5. Case 10 Encryption software is not illegal Case 12 Articel 7 – computer related forgery Case 13 data used only for personal uses, no computer related forgery. Case 14 Intention, what happend Post message = input data. Loss = someone bought shares. Bobby had a profit. This is not computer related fraud. We can’t prove that it was the only reason to increase the stock price. Misuse of devices for penetration testers, it is a criminal offence when there is no authorisation. There is a must to have a contract mentioning this.
the article: THE COUNCIL OF EUROPE CONVENTION ON CYBERCRIME:DEFINING ‘CRIME’ IN A DIGITAL WORLD https://moodle.hitsa.ee/pluginfile.php/2568445/mod_resource/content/2/Cybercrime%20Convention%20_article.pdf descibes what is cybercrime, international cooperation, procedural law the article: The hazards of cyber-vigilantism https://moodle.hitsa.ee/pluginfile.php/2568446/mod_resource/content/2/Cyber%20vigilantism%20article.pdf speaking about anonymous and other groups fighting against cyber criminals and how legal it is.. “cyber-vigilantism can lead to several negativeconsequences” “Courts and policymakers generally disfavour vigilantism” “,because vigilantes operateoutside of the legal system, there is not a “quality control”mechanism to assure a minimum level of preparedness.” ”Although vigilantes may be able to impose their own forms of “justice” more quickly than the government, they often lack the skills of making a full and fair determination about whether their target is actually a bad actor” “Vigilantism also has the potential to escalate tensions andlead to an overall greater amount of violence and criminal activity” “In sum, strong computer hacking laws provide a baselineof expertise and coordination for operations against criminalsand terrorists. Although some vigilantes may be as skilledas government actors, providing a vigilante exception to computerhacking laws could lead to less effective law enforcementby disrupting ongoing government strategies.” “Accordingly, allowing vigilantism by adding an exception to computer hacking laws would increase the likelihood of abuse, and there are no sure-fire safeguards against improper motives” “For instance,China and Russia have long relied on private parties to mountoffensive cyber operations. By allowing similar private sectorvigilantism by domestic actors, the United States, EuropeanUnion member states, and other governments could not aseasily pressure Russia and China to crack down on their owndomestic hackers.5” “As an alternative to cyber-vigilantism, private parties could collaboratewith the government and each other to fight cybercriminals, terrorists, and other bad actors” “Private actors – ranging from large corporations to anonymoushacktivists – often possess a great deal of valuableinformation that helps governments fight cybercrime, terroristpropaganda, and other threats. Policies should ensure thatthese private actors can share the information in the most effectivemanner possible.” “white hat hackers who independently conduct researchwithout the permission of the organizations that ownthe systems or networks that are the subject of the researchmight face prosecution under computer hacking laws” “First, law enforcement officials should clarify the precise authorizationthat ethical hackers must obtain from companiesto prevent the possibility of prosecution under computerhacking laws. Compliance with these guidelines could providehackers with a limited safe harbour from prosecution and civilsuits. This would provide “white-hat” hackers with the certainty that they need to help companies determine their network and system vulnerabilities. Second, governments should consider programs that encourage companies to engage independent security professionals,such as tax incentives. For instance, if a company hiredan outside cybersecurity consultant to assess its network andsystem vulnerabilities, it could receive a dollar-for-dollar taxcredit for those expenses, up to a maximum limit set by statute.The tax credit could be modelled after programs that providesimilar incentives for corporate investments in research anddevelopment. Such a policy would help to encourage companiesto make costly investments that they otherwise would nothave made. Third, governments should more frequently engage whitehat hackers to assess the vulnerability of government networks.To do so, government agencies likely would need toidentify third parties who could obtain the necessary securityclearances, and who would be willing to sign non-disclosureagreements. However, such arrangements could help governmentagencies uncover vulnerabilities that they otherwise wouldnot have identified, preventing incidents such as the 2015 breachof the U.S. Office of Personnel Management, which led to thedisclosure of millions of government employees’ security clearanceapplications.72 Engaging white hat hackers would helpthe government improve security of public sector networks,and it also would encourage private companies to take similarsteps.” vigilant are usuallz faster than governments, thez dont have to obstacle with all permisions and laws “the private and public sectors should continue to develop mechanisms in which they can work together to battle bad actors in cyberspace, with government preserving their law-making, enforcement, and adjudication roles.”
Conclusions Legal tools need to be adopted by all countries Emphasis on harmonization and cooperation Make use of already existing instruments? Should be an integral part of a national cyber sec. strategy. Case studies Case1 bobby as a police oficcer is requesting a data about a car which is standing in front of his house, asking operator about confirmation. Access to computer access (article 2) deals with physical access only, not data! Judge has to decide if that is unauthorised access. We can argue only. Especially about a definition of accessing computer Case 2 keylogger is an interception. Recording Skype is also an interception. The bug is most likely to be an interception, but not necessary under cybercrime convention. Case 3 Comunnication using drafts In Estonia is interception only while email is send. In some countries could be the whole proecess from draft to receiving. Case 4 taking a phone In Estonia it wouldnt be interception, because its stored. In some countries it can be taken as interception of communication process. Case 5 UFO in Russia Illegal interception, illegal access, data interference. He meant to do this. Copying is not part Data interference (article 4). The loss in reputation could arise a cost of damage. Then it would be considered as a serious harm (article 4) and copying data would be Data interference. Case 6 Spambot sending a Malware When u write something on computers hard drive it is an alteration of data already. In criminal law, you can’t punish a person for what he hasn’t done yet. System interference is considering serious hindering, but where is the line? Case 7 spam 7 000 000 mails per hour to server of his previous work. Hindering a data -> system interference. Case 8 his intention was to acces a system, therefore it is not applicable article 5. Case 10 Encryption software is not illegal Case 12 Articel 7 – computer related forgery Case 13 data used only for personal uses, no computer related forgery. Case 14 Intention, what happend Post message = input data. Loss = someone bought shares. Bobby had a profit. This is not computer related fraud. We can’t prove that it was the only reason to increase the stock price. Misuse of devices for penetration testers, it is a criminal offence when there is no authorisation. There is a must to have a contract mentioning this.
