COMMISSION OF THE EUROPEAN COMMUNITIES Source http://europa.eu.int/ISPO/eif/InternetPoliciesSite/Crime/CrimeCommEN.html

Europe’s transition to an information society is being marked by profound developments in all aspects of human life: in work, education and leisure, in government, industry and trade. The new information and communication technologies are having a revolutionary and fundamental impact on our economies and societies. The success of the information society is important for Europe’s growth, competitiveness and employment opportunities, and has far-reaching economic, social and legal implications.

The Commission launched the eEurope initiative in December 1999 in order to ensure that Europe can reap the benefits of the digital technologies and that the emerging information society is socially inclusive. In June 2000, The Feira European Council adopted a comprehensive eEurope Action Plan and called for its implementation before the end of 2002. The Action Plan highlights the importance of network security and the fight against cybercrime.

Information and communication infrastructures have become a critical part of our economies. Unfortunately, these infrastructures have their own vulnerabilities and offer new opportunities for criminal conduct. These criminal activities may take a large variety of forms and may cross many borders. Although, for a number of reasons, there are no reliable statistics, there is little doubt that these offences constitute a threat to industry investment and assets, and to safety and confidence in the information society. Some recent examples of denial of service and virus attacks have been reported to have caused extensive financial damage.

There is scope for action both in terms of preventing criminal activity by enhancing the security of information infrastructures and by ensuring that the law enforcement authorities have the appropriate means to act, whilst fully respecting the fundamental rights of individuals.

The European Union has already taken a number of steps to fight harmful and illegal content on the Internet, to protect intellectual property and personal data, to promote electronic commerce and the use of electronic signatures and to enhance the security of transactions. In April 1998, the Commission presented to the Council the results of a study on computer-related crime (the so-called ‘COMCRIME’ study). In October 1999, the Tampere Summit of the European Council concluded that high-tech crime should be included in the efforts to agree on common definitions and sanctions. The European Parliament has also called for commonly acceptable definitions of computer-related offences and for effective approximation of legislation, in particular in substantive criminal law. The Council of the European Union has adopted a Common Position on the Council of Europe cybercrime convention negotiations and has adopted a number of initial elements as part of the Union’s strategy against high-tech crime. Some EU Member States have also been at the forefront of relevant G8 activities.

This Communication discusses the need for and possible forms of a comprehensive policy initiative in the context of the broader Information Society and Freedom, Security and Justice objectives for improving the security of information infrastructures and combating cybercrime, in accordance with the commitment of the European Union to respect fundamental human rights.

In the short-term, the Commission believes that there is a clear need for an EU instrument to ensure that Members States have effective sanctions in place to combat child pornography on the Internet. The Commission will introduce later this year a proposal for a Framework Decision which, within the wider context of a package covering issues associated with the sexual exploitation of children and trafficking in human beings, will include provisions for the approximation of laws and sanctions.

In the longer-term, the Commission will bring forward legislative proposals to further approximate substantive criminal law in the area of high-tech crime. In accordance with the conclusions of the European Council in Tampere in October 1999, the Commission will also consider the options for mutual recognition of pre-trial orders associated with cybercrime investigations.

In parallel, the Commission intends to promote the creation of specialised computer-crime police units at the national level, where they do not already exist, support appropriate technical training for law enforcement and encourage European information security actions.

At the technical level and in line with the legal framework, the Commission will promote R&D to understand and reduce vulnerabilities and will stimulate the dissemination of know-how.

The Commission intends also to set up an EU Forum in which law enforcement agencies, Internet Service Providers, telecommunications operators, civil liberties organisations, consumer representatives, data protection authorities and other interested parties will be brought together with the aim of enhancing mutual understanding and co-operation at EU level. The Forum will seek to raise public awareness of the risks posed by criminals on the Internet, to promote best practice for security, to identify effective counter-crime tools and procedures to combat computer-related crime and to encourage further development of early warning and crisis management mechanisms.

infso-jai-cybercrime-comments@cec.eu.int

http://europa.eu.int/ISPO/eif/InternetPoliciesSite/Crime/crime1.html

infso-jai-cybercrime-hearing@cec.eu.int

The increasing affordability and use of the Information Society Technologies (ISTs) and the globalisation of the economy are characteristics of our era. Further technological development and growth in use of open networks, such as the Internet, over the coming years will provide major new opportunities and will pose new challenges.

At the Lisbon Summit of March 2000, the European Council stressed the importance of the transition to a competitive, dynamic and knowledge-based economy, and invited the Council and the Commission to draw up an eEurope Action plan to make most of this opportunity. This Action Plan, prepared by the Commission and the Council, adopted by the Feira Summit of the European Council in June 2000, includes actions to enhance network security and the establishment of a co-ordinated and coherent approach to cybercrime by the end of 2002.

The information infrastructure has become a critical part of the backbone of our economies. Users should be able to rely on the availability of information services and have the confidence that their communications and data are safe from unauthorised access or modification. The take up of electronic commerce and the full realisation of Information Society depend on this.

The new digital and wireless technologies are already all pervasive. They give us the freedom to be mobile and yet always be connected, connected to a myriad of services built upon networks of networks. They give us the possibility to participate; to teach and to learn, to play together and to work together, to get involved in the political process. As societies though become increasingly reliant on these technologies, effective practical and legal means will have to be employed to help manage the associated risks.

Information Society Technologies (ISTs) can be and are being used for perpetrating and facilitating various criminal activities. In the hands of persons acting with bad faith, malice, or grave negligence, these technologies may become tools for activities that endanger or injure, the life, property or dignity of individuals or damage the public interest.

The classical security approach called for strict organisational, geographic and structural compartmentalisation of information according to sensitivity and category. This is no longer really feasible in this digital world since information processing is distributed, services follow mobile users and interoperability of systems is a prerequisite. Innovative solutions relying on emerging technologies are replacing traditional security approaches. These solutions involve the use of encryption and digital signatures, new access control and authentication tools and software filters of all kinds. Ensuring secure and reliable information infrastructures not only requires a range of technologies but also their correct deployment and effective use. Some of these technologies already exist but often users are either not aware of their existence, of the ways to use them, or of the reasons why they may even be necessary.

Computer-related crimes are committed across cyber space and do not stop at the conventional state-borders. They can, in principle, be perpetrated from anywhere and against any computer user in the world. It has been generally recognised that effective action to combat computer-related crime is necessary at both national and international level.

On the national level, comprehensive and internationally oriented answers to the new challenges of network security and computer crime are often still missing. In most countries, reactions to computer crime focus on national law (especially criminal law), neglecting alternative preventive measures.

Despite the efforts of international and supranational organisations, the various national laws world-wide show remarkable differences, especially with respect to the criminal law provisions on hacking, trade secret protection and illegal content. Considerable differences also exist with respect to the coercive powers of investigative agencies (especially with respect to encrypted data and investigations in international networks), the range of jurisdiction in criminal matters, and with respect to the liability of intermediary service providers on the one hand and content providers on the other hand. Directive 2000/31/EC on electronic commerce amends this as regards the liability of intermediary service providers on certain intermediary activities. The Directive also prohibits Member States from imposing such intermediary service providers a general obligation to monitor the information which they transmit or store.

On the international and supranational levels, the need to effectively combat computer-related crime has been broadly recognised and various organisations have been co-ordinating or attempting to harmonise relevant activities. The G8 Justice and Home Affairs Ministers adopted a set of principles and a 10-point action plan in December 1997, which was endorsed by the G8 Birmingham summit in May 1998 and is currently being implemented. The Council of Europe (C.o.E.) started preparing an international convention on cyber-crime in February 1997 and is expected to complete this task in 2001. Combating cybercrime is also on the agenda in bilateral discussions the European Commission has with some governments (apart from the EU). A Joint EC/US Task Force on Critical Infrastructure Protection has been established.

The UN and OECD have also been active in this area, and it is being discussed in international fora such as the Global Business Dialogue and the Trans-Atlantic Business Dialogue.

At the European Union level, until recently, legislative action has mainly taken the form of measures in the fields of copyright, the protection of the fundamental right to privacy and data protection, conditional access services, electronic commerce, electronic signatures and in particular the liberalisation of trade in encryption products, which are indirectly related to computer crime.

A number of important non-legislative measures have also been taken in the last 3-4 years. These include the Action Plan against illegal and harmful content on the Internet which co-finances awareness actions, experiments in rating and filtering of content and hot-lines, and initiatives concerning the protection of minors and human dignity in the information society, child pornography and interception of communications for law-enforcement purposes. The EU has for a long time been supporting R&D Projects which aim at promoting security and trust in information infrastructures and electronic transactions and has recently increased the associated IST Programme budget allocations. Research and operational projects aimed at promoting specialised training of law enforcement personnel as well as co-operation between law enforcement and industry have also been supported in the framework of the Third Pillar Programmes such as STOP, FALCONE, OISIN and GROTIUS.

The Action Plan to combat organised crime, adopted by the JHA Council in May 1997 and endorsed by the European Council of Amsterdam, included a request for a study on computer related crime to be prepared by the Commission by the end of year 1998. This study, the so-called ‘COMCRIME study,’ was presented by the Commission to the Council Multi-Disciplinary Working Group against organised crime in April 1998. This Communication is partly a follow-up to the JHA Council request.

Before drafting this Communication, the Commission considered it appropriate to undertake informal consultations with representatives from Member States law enforcement and data protection supervisory authorities and from the European industry (mostly ISPs and telecommunications operators).

On the basis of the analysis and the recommendations made by the study, the conclusions drawn from the consultation process, the new possibilities provided for by the Treaty of Amsterdam and the work already accomplished in the EU, the G8 and the C.o.E., this Communication will examine various options for further action by the EU against computer-related crime. On the European Union level the chosen solutions should not lead to any impediment for and fragmentation of the Internal Market, nor to measures which undermine the protection of fundamental rights.

In the information society, user-controlled global networks are gradually replacing the older generation of national communication networks. One of the reasons for the success of the Internet is that it has given users access to the very newest technologies. Moore’s Law predicts that computing power doubles every 18 months. Communications technology however is developing at an even faster pace. One result of this is that the volume of data carried over the Internet has been doubling in periods of less than a year.

The classical telephone networks were constructed and operated by national organisations. Its users had little choice of services and no control over the environment. The first data networks that were developed were built on the same philosophy of a centrally controlled environment. Security within these environments reflected this.

The Internet and other new networks are very different, and security needs to be handled accordingly. Intelligence and control in these networks is mostly at the periphery, where the users and services are. The core of the network is simple and efficient, and essentially dedicated to the task of transmitting data. There is limited checking or control of content. It is only at the final destination where the bits become the sound of a voice, the image of an x-ray or the confirmation of a bank transaction. Security is therefore to an important extent a responsibility of the users, as only they can appreciate the value of the bits being sent or received, and can determine the level of protection needed.

The user environment is therefore a key part of the information infrastructure. Security techniques have to be implemented there with the permission and participation of the user and according to his/her needs. This is particularly important when one considers the increasing range of activities that people are carrying out from the same terminal. They work and play, they watch television and authorise bank transfers, all from the same device.

Several security technologies are available and new technologies are being developed. The advantages of open source development in terms of security are becoming clearer. Much work has been done on formal methods and on security evaluation criteria. The use of encryption technologies and electronic signatures are becoming indispensable, particularly with the growth in wireless access. An increasing variety of authentication mechanisms is required to meet our different needs in the environments in which we interact. In some environments, we may need or wish to remain anonymous. In others, we may need to be able to prove a certain characteristic while not revealing our identity, such as being an adult or being an employee or a client of a particular company. In yet other situations, it may be necessary to give proof or our identity. Also software filters are becoming ever more sophisticated, and enable us to protect ourselves or those in our care from data we do not want, such as undesirable content, spam mail, malicious software and other forms of attack. The implementation and management of such security requirements within the Internet and new networks also involve considerable expense to industry and users. Therefore it is important to encourage innovation and commercial use of security technology and services.

Naturally, also the shared infrastructure of communication links and name-servers has its security aspects. Data transmission depends on the physical links whereby data is routed from one computer to another. These links have to be put in place and protected in such a way that transmission remains possible in spite of accidents, attacks and an ever increasing volume of traffic. Communication also depends on critical services such as those provided by the name servers, and in particular on the small number of root name servers, that provide the needed addresses. Each of these components will also need appropriate protection, which will vary according to the part of the name space and the user base that is being served.

Driven by the objective of bringing more flexibility and responsiveness to people’s needs, information infrastructure technologies have become increasingly complex with often insufficient design effort devoted to security. In addition, this complexity involves more and more sophisticated and interconnected software programmes, which sometimes include weaknesses, security holes, that may easily be exploited for attacks. As cyberspace gets more and more complex and its components more and more sophisticated, new and unforeseen vulnerabilities may emerge.

Several technological mechanisms already exist and new ones are being developed to improve security in cyber-space. The response includes measures:

• To secure critical elements of the infrastructure through the deployment of public-key infrastructures (PKI), the development of secure protocols, etc.
• To secure private and public environments through the development of quality software, firewalls, anti-virus programs, electronic rights management systems, encryption, etc.
• To secure authentication of authorised users, use of smart cards, biometric identification, electronic signatures, role-based technologies, etc.

This calls for an increased effort to develop security technologies, involving co-operation in order to achieve a necessary interoperability between solutions through agreements on international standards.

It is important also that any future conceptual framework for security be an integral part of the overall architecture, addressing threats and vulnerabilities from the outset of the design process. This contrasts with traditional add-on approaches, which have necessarily attempted to plug the holes exploited by an increasingly sophisticated criminal community.

The EU Information Society Technologies (IST) Programme, in particular work relating to information-, and network security, and other confidence-building technologies, provides a framework to develop capability and technologies to understand and tackle emerging challenges related to computer crime. These technologies include technical tools to protect against infringement of the fundamental rights to privacy and personal data and other personal rights and to fight computer crime. In addition, in the context of the IST Programme, a dependability initiative has been launched. This initiative will contribute towards trust and confidence in highly inter-linked information infrastructures and in tightly networked embedded systems by promoting dependability awareness and dependability enabling technologies. An integral part of this initiative is international co-operation. The IST Programme has developed working relationships with DARPA and NSF and has established, in collaboration with the US Department of State, a Joint EC/US Task Force on Critical Infrastructure Protection.

Finally, the implementation of security obligations following in particular from the EU Data Protection Directives contributes to enhancing security of the networks and of data processing.

Modern information and communications systems make it possible to perform illegal activities from anywhere to anywhere in the world at any time. There are no reliable statistics available on the full scale of the computer-related crime phenomenon. The number of intrusions detected and reported up to now, probably under-represent the scope of the problem. Because of limited awareness and experience of system administrators and users, many intrusions are not detected. In addition, many companies are not willing to report cases of computer abuse, to avoid bad publicity and exposure to future attacks. Many police forces do not yet keep statistics on the use of computers and communication systems involved in these and other crimes. However, the number of illegal activities can be expected to grow as computer and network use increases. There is a clear need to gather reliable evidence on the significance of computer-related crime.

In this Communication, computer-related crime is addressed in the broadest sense, as any crime that in some way or other involves the use of information technology. However, different views exist on what constitutes "computer-related crime." The terms "computer crime," "computer-related crime," "high-tech crime" and "cybercrime" are often used interchangeably. A difference can be made between computer specific crimes and traditional crimes performed with the aid of computer technology. A topical example of this can be found in the realm of Customs where the Internet proves to be an instrument for committing typical crimes against Customs Law, such as smuggling, counterfeit, etc. Whereas the computer-specific crimes require updates of the definitions of crimes in national criminal codes, the traditional crimes performed with the aid of computers call for improved co-operation and procedural measures.

Yet all of them benefit from the availability of information and communication networks which are borderless and from the circulation of data which is intangible and extremely volatile. These characteristics call for a review of existing measures to address illegal activities performed on or using these networks and systems.

Many countries have passed legislation to address computer-related crime. In European Union Member States, a number of legal instruments have been issued. Other than a Council Decision on child pornography on the Internet, there are no EU legal instruments so far directly addressing computer-related crime, but there are a number of indirectly relevant legal instruments.

The main issues addressed by legislation in relation to computer specific crimes at EU or Member State level are:

Privacy Offences: Various countries have introduced criminal law addressing illegal collection, storage, modification, disclosure or dissemination of personal data. In the European Union, two Directives have been adopted that approximate the national laws on the protection of privacy with regard to the processing of personal data. Article 24 of the Directive 95/46/EC clearly obliges Member States to adopt all suitable measures to ensure the full implementation of the provisions of the Directive, including sanctions to be imposed in case of infringements of the provisions of national laws. The fundamental rights to privacy and data protection are furthermore included in the Charter of Fundamental Rights of the European Union.

Content-related offences: The dissemination, especially via the Internet, of pornography, in particular child pornography, racist statements and information inciting violence raises the question as to what extent these acts could be confronted with the help of criminal law. The Commission has supported the view that what is illegal off-line should also be illegal on-line. The author or the content provider may be liable under criminal law. A Council Decision has been adopted to combat child pornography on the Internet.

The liability of the intermediary service providers, whose networks or servers are used for the transmission or storage of third-party information, has been addressed by the Directive on electronic commerce.

Economic crimes, unauthorised access and sabotage: Many countries have passed laws that address computer-specific economic crime and define new offences related to unauthorised access to computer systems (e.g., hacking, computer sabotage and distribution of viruses, computer espionage, computer forgery, and computer fraud) and new forms of committing offences (e.g., computer manipulations instead of deceiving a human). The object of the crime is often intangible, e.g., money in bank deposits or computer programmes. At present, there are no EU instruments regarding such types of illegal activity. Concerning prevention, the recently adopted revised dual-use goods regulation contributed significantly to liberalise the availability of encryption products.

Intellectual Property Offences: Two Directives have been adopted, on the legal protection of computer programs and of databases, relating directly to the Information Society and providing for sanctions. A Common Position on a proposal for a Directive on copyright and related rights in the Information Society has been adopted by the Council . This is expected to be adopted early 2001. The violation of copyright and related rights as well as the circumvention of technological measures designed to protect these rights are to be sanctioned. As regards counterfeiting and piracy, the Commission will present, before the end of 2000, a Communication taking stock of the consultation process initiated with its 1998 Green Paper and announcing a relevant action plan. As the Internet becomes more and more important commercially, we are beginning to see new disputes around domain names related to cybersquatting, warehousing and reverse hijacking, and, naturally, there are also calls for rules and procedures to help deal with these problems.

Enforcement of taxation obligations also needs to be addressed. In the case of commercial transactions where the recipient of on-line supply of an electronic service is located in the EU, this will in most cases give rise to tax obligations in the jurisdiction where consumption of such a service is deemed to take place. Failure to comply with tax obligations exposes an operator to civil (and in some cases criminal) sanctions which may include seizure of bank accounts or other assets. Although voluntary compliance is always the preferred option, such obligations must ultimately be enforceable.

Co-operation between tax administrations is a key element in achieving this objective. Giving the possibility to some people to protect their lawful transactions will also give the same means to criminals to protect their unlawful transactions. The tools that give us secure e-commerce can also be used to support drug trafficking. Priorities will need to be identified and choices will need to be made.

Protecting the victims of computer-related crime also needs to cover issues of liability, redress and compensation which arise when computer-related crimes do occur. Confidence depends not only on appropriate technology being used, but also on the accompanying legal and economic guarantees. These questions will need to be examined across the range of computer-related crimes.

There is a need for effective substantive and procedural law instruments approximated at global, or at least at European level, to protect the victims of computer-related crime and to bring the perpetrators to justice. At the same time, personal communications, privacy and data protection, access to and dissemination of information, are fundamental rights in modern democracies. This is why the availability and use of effective prevention measures are desirable so to reduce the need to apply enforcement measures. Any legislative measures that might be necessary to tackle computer-related crime need to strike the right balance between these important interests.

Approximation of substantive law in the area of high tech crime will ensure a minimum level of protection for victims of cybercrime (for example, victims of child pornography), will help to meet the requirement that an activity must be an offence in both countries before mutual legal assistance can be provided to assist a criminal investigation (the dual criminality requirement), and will provide greater clarity for industry (for example, on what constitutes illegal content).

In fact, an EU legislative instrument approximating substantive criminal law in the field of computer-related crime has been on the EU agenda following the Tampere Summit of the European Council in October 1999. The Summit included high-tech crime in a limited list of areas where efforts should be made to agree on common definitions, incriminations and sanctions. This is included in Recommendation 7 of the European Union strategy for the new Millennium on the prevention and control of organised crime adopted by the JHA Council in March 2000. It is also part of the Commission Work Programme for the Year 2000 and the Scoreboard for the establishment of an area of Freedom, Security and Justice, produced by the Commission and adopted by the Justice and Home Affairs Council on 27 March 2000.

The Commission has followed the work of the Council of Europe on the Cybercrime Convention. Four categories of criminal offences are listed in the current draft C.o.E. Cybercrime Convention: 1) Offences against the confidentiality, integrity and availability of computer data and systems; 2) Computer-related offences; 3) Content-related offences; 4) Offences related to infringements of copyright and related rights.

EU approximation could go further than the C.o.E. Convention, which will represent a minimum of international approximation. It could be operational within a shorter period of time than the entry into force of the C.o.E. Convention. It would bring computer crime within the realms of EU law and introduce EU enforcement mechanisms.

The Commission attaches great importance to ensuring that the European Union is able to take effective action in particular against child pornography on the Internet. The Commission welcomes the Council Decision on combating child pornography on the Internet, but shares the view of the European Parliament that further action is required to approximate national laws. The Commission intends to introduce later this year a proposal for a Council Framework Decision that will include provisions for the approximation of laws and sanctions on child pornography on the Internet.

In accordance with the Tampere conclusions, the Commission will bring forward a legislative proposal under Title VI of the TEU to approximate high tech crime offences. This will build on the progress made at the Council of Europe, and will address in particular the need to approximate legislation relating to hacking and denial of service attacks. The proposal will include standard definitions for the European Union in this area. This could also go further than the draft Council of Europe Convention by ensuring that serious cases of hacking and denial of service attacks are punishable by a minimum penalty in all Member States.

Furthermore, the Commission will examine the scope for action against racism and xenophobia on the Internet with a view to bringing forward a proposal for a Council Framework Decision under Title VI of the TEU covering both off-line and on-line racist and xenophobic activity. This will take account of the forthcoming evaluation of the implementation by Member States of the Joint Action of 15 July 1996 concerning action to combat racism and xenophobia. The Joint Action was a first step towards approximation of criminal offences relating to racism and xenophobia, but there is a need for further approximation within the European Union. The importance and sensitivity of this issue has been highlighted by the decision of a French court on 20 November 2000 requiring Yahoo to block French users from accessing sites selling Nazi memorabilia.

Finally, the Commission will consider how to improve the effectiveness of efforts against the illicit drugs trade on the Internet, the importance of which is recognised in the European Union Drugs Strategy 2000-2004 endorsed at the European Council in Helsinki.

The very nature of computer-related criminal offences brings procedural issues to the forefront of national and international attention as different sovereignties, jurisdictions and laws come into play. More than in any other transnational crime, the speed, mobility and flexibility of computer crime challenge the existing rules of criminal procedural law.

Approximation of procedural law powers will improve the protection of victims by ensuring that law enforcement agencies have the powers they need to investigate offences on their own territory, and will ensure that they are able to respond quickly and effectively to requests from other countries for co-operation.

It is also important to ensure that measures taken on the basis of criminal law, which generally falls with the competence of Member States and Title VI of the TEU, are in accordance with Community law requirements. In particular, the Court of Justice has consistently held that such legislative provisions may not discriminate against persons to whom Community law gives the right to equal treatment or restrict the fundamental freedoms guaranteed by Community law.Any new powers for law enforcement need to be assessed against Community law and their impact to privacy.

In the European Union, there is a general principle of confidentiality of communications (and related traffic data). Interceptions are illegal unless they are authorised by law when necessary in specific cases for limited purposes. This follows from Article 8 of the European Convention of Human Rights, referred to in Article 6 of the TEU and more particularly from Directives 95/46/EC and 97/66/EC.

All Member States have a legal framework in place to allow law enforcement to obtain judicial orders (or, in the case of two Member States, a warrant personally authorised by a senior Minister) for the interception of communications on the public telecommunications network. This legislation, which has to be in line with Community law to the extent that it applies, contains safeguards protecting individuals’ fundamental right to privacy, such as limiting the use of interception to investigations of serious crimes, requiring that interception in individual investigations should be necessary and proportionate, or ensuring that the individual is informed about the interception as soon as it will no longer hamper the investigation. In many Member States, interception legislation contains obligations for (public service) telecommunications operators to provide for interception capabilities. A 1995 Council Resolution was aimed at co-ordinating interception requirements.

Traditional network operators, in particular those offering voice services, have in the past established working relations with law enforcement to facilitate lawful interception of communications. Telecommunications liberalisation and the explosion of Internet use have attracted many entrants to the marketplace, who have been confronted afresh with interception requirements. Questions on regulations, technical feasibility, allocation of costs and commercial impact will need to be discussed in government-industry dialogues together with all other parties concerned including data protection supervisory authorities.

New technologies make it essential that Member States work together if they are to maintain their capabilities for lawful interception of communications. Where Member States introduce new technical interception requirements on telecommunications operators and Internet service providers, the Commission believes these standards should be co-ordinated internationally to prevent distortion of the Single Market, to minimise the costs for industry and to respect privacy and data protection requirements. The standards should be public and open where possible and should not introduce weaknesses into the communications infrastructure.

In the context of the EU Convention on Mutual Assistance in Criminal Matters, an approach has been agreed to facilitate co-operation on legal interception. The Convention contains provisions on the interception of satellite telephone communication, and on interception of communications of a person on the territory of another Member State. The Commission believes that the interception rules in the Mutual Legal Assistance Convention constitute the maximum possible at the current stage. The text of the Convention is technology neutral; it will have to be tested how it will work in practice before any improvements can be considered. The Commission will review its implementation with Member States, industry, users and data protection supervisory authorities to ensure that relevant initiatives are effective, transparent and well balanced.

Abusive, indiscriminate use of interception capabilities, particularly internationally, will raise human rights questions and will undermine citizens’ trust in the Information Society. The Commission has seen with grave concern reports on alleged abuses of interception capabilities.

To investigate and prosecute crimes involving the use of the communications networks, including the Internet, law enforcement authorities frequently use traffic data when they are stored by service providers for billing purposes. As the price charged for a communication is becoming less and less dependent on distance and destination, and service providers move towards flat rate billing, there will no longer be any need to store traffic data for billing purposes. Law enforcement authorities fear that this will reduce potential material for criminal investigations and therefore advocate that service providers keep certain traffic data for at least a minimum period of time so that these data may be used for law enforcement purposes.

In accordance with the EU personal Data Protection Directives, both the general purpose-limitation principles of Directive 95/46/EC and the more specific provisions of Directive 97/66/EC, traffic data must be erased or made anonymous immediately after the telecommunications service is provided, unless they are necessary for billing purposes. For flat rate or free-of-charge access to telecommunications services, service providers are in principle not allowed to preserve traffic data.

Under the EU Data Protection Directives, Member States may adopt legislative measures to restrict the scope of the obligation to erase traffic data when this constitutes a necessary measure for, amongst others, the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the telecommunications system.

However, any legislative measure at national level that may provide for the retention of traffic data for law enforcement purposes would need to fulfil certain conditions: the proposed measures need to be appropriate, necessary and proportionate, as required by Community law and international law, including Directive 97/66/EC and 95/46/EC, the European Convention for the Protection of Human Rights of 4 November 1950 and the Council of Europe Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data of 28 January 1981. This is particularly relevant for measures that would involve the routine retention of data on a large part of the population.

Some Member States are taking legal initiatives requiring or allowing service providers to store certain categories of traffic data, not needed for billing purposes, after the provision of the service but which are considered useful for criminal investigations.

The scope and form of these initiatives varies considerably, but they are all based on the idea that more data should be available for law enforcement authorities than would be the case if service providers only process data which are strictly needed for the provision of the service. The Commission is examining these measures in the light of existing Community law.

The European Parliament is sensitive to privacy issues and generally has taken a stance in favour of strong protection of personal data. However, in discussions on combating child pornography on the Internet, the European Parliament has expressed an opinion favouring a general obligation to preserve traffic data for a period of three months.

This illustrates the importance of the context in which a sensitive topic such as traffic data retention is discussed and the challenge facing policy makers seeking to strike appropriate balances.

The Commission considers that any solution on the complex issue of retention of traffic data should be well founded, proportionate and achieve a fair balance between the different interests at stake. Only an approach that brings together the expertise and capacities of government, industry, data protection supervisory authorities and users will succeed in meeting such goals. A consistent approach in all Member States on this complex issue would be highly desirable, to meet the objectives of both effectiveness and proportionality and to avoid the situation where both law enforcement and the Internet community would have to deal with a patchwork of diverse technical and legal environments.

There are quite different important concerns to be taken into account. On one hand, data protection supervisory authorities have considered that the most effective means to reduce unacceptable risks to privacy while recognising the needs for effective law enforcement is that traffic data should in principle not be kept only for law enforcement purposes. On the other hand, law enforcement authorities have stated that they consider the retention of a minimum amount of traffic data for a minimum period of time necessary to facilitate criminal investigations.

Industry has an interest to co-operate in the fight against crimes like hacking and computer-fraud, but should not be confronted with measures that are unreasonably costly. The economic impact of any measures should be carefully analysed and compared with the effectiveness of such a measure in the fight against cybercrime in order to avoid making the Internet more costly and less affordable for users. Adequate security of any retained traffic data would have to be ensured.

In any case, industry will have a key role to play in contributing, to the process of creating a safer Information Society. Users should have confidence in the safety of the Information Society and feel protected from crime and from infringements of their privacy.

The Commission fully supports and encourages a constructive dialogue between law enforcement, industry, data protection authorities and consumer organisations as well as other parties that might be concerned. Within the framework of the proposed EU Forum (see point 6.4 of this Communication), the Commission will urge all the parties concerned to discuss in-depth, as a matter of priority, the complex issue of retention of traffic data with a view to jointly finding appropriate, balanced and proportionate solutions fully respecting the fundamental rights to privacy and data protection. On the basis of the outcome of this work, the Commission will be able to assess the need for any legislative or non-legislative actions at EU level.

Law enforcement experts have expressed concern that anonymity may result in non-accountability and could seriously impede the possibility to catch certain criminals. Anonymous use of mobile telephony is possible in some countries through pre-pay cards (not in others). Anonymous access to and use of the Internet is offered by some service and access providers, including re-mailers and Internet cafés. A degree of anonymity is also facilitated by the system of dynamic Internet addressing, in which addresses are not allocated to users on a permanent basis but only for the duration of a given session.

In their discussions with the Commission, some representatives from industry have not been in favour of full anonymity, partly for their own security, anti-fraud and network integrity purposes. The London Internet Exchange has pointed to best practice guidelines they had issued which had proved useful in the UK. However, other industry representatives and privacy experts have stated that without anonymity it is not possible to guarantee fundamental rights.

The Art. 29 Data Protection Working Party has issued a Recommendation on the subject of anonymous use of the Internet. It considers the issue of anonymity on the Internet as being at the centre of a dilemma for governments and international organisations. On the one hand the possibility of remaining anonymous is essential if the fundamental rights to privacy and freedom of expression are to be maintained in cyberspace. On the other hand the ability to participate and communicate on-line without revealing one’s identity runs against the grain of initiatives being developed to support other key areas of public policy, such as the fight against illegal and harmful content, financial fraud or copyright infringements. Of course such apparent conflict between different public policy objectives is not new. In the context of the more traditional off-line modes of communication, such as letter and parcel post, the telephone, newspapers, or broadcasting via radio and television, a balance between these objectives has been achieved. The challenge facing policy-makers today is to ensure that this balanced approach, which guarantees basic rights while permitting proportionate restrictions to these rights in limited and specified circumstances, is maintained in the new context of cyberspace. Central to this balance will be the extent of, and limits to, a person’s ability to participate on-line in an anonymous fashion.

In the concluding Declaration of the Ministerial Conference in Bonn on Global Information Networks, 6-8 July 1997, it was stated that the principle should be that where the user can choose to remain anonymous off-line, that choice should also be available on-line. There is a clear consensus therefore that activity on networks should be viewed using the basic legal principles that apply elsewhere. The Internet is not an anarchic ghetto where society’s rules do not apply. Equally, though, the ability of governments and public authorities to restrict the rights of individuals and monitor potentially unlawful behaviour should be no greater on public networks than it is in the outside, off-line world. The requirement that restrictions to fundamental rights and freedoms be properly justified, necessary and proportional in view of other public policy objectives, must also apply in cyberspace.

In the Article 29 Data Protection Working Party recommendation it is indicated in detail how this may be achieved in specific cases (for example concerning e-mail, newsgroups, etc). The Commission shares the views expressed by the Working Party.

In the recent past, world-wide combined law enforcement operations, such as Operations Starburst and Cathedral against paedophile rings, have shown the value of co-ordinated international action by law enforcement and judiciary, both in exchanging information at the preliminary stage and in preventing the tipping off of other ring members when arrests and seizures are made. The Internet has also proved to be a valuable and efficient tool for police and customs investigations where it is used as an instrument for committing traditional crimes, such as counterfeiting and smuggling.On the other hand, these operations have also revealed the major legal and operational difficulties with which law enforcement and judiciary were confronted while managing this action, such as preparation of cross border evidence or commission rogatoire, victim identification, and the role of intergovernmental organisations dealing with police issues (Interpol and Europol in particular).

In the field of practical international co-operation measures international networks for the exchange of information are becoming increasingly important for police and customs authorities.

Within the G8, a 24 hour/7 day information network of law-enforcement points of contact has been established and is already operational. Its main purpose is to receive and respond to urgent requests for co-operation in cases involving electronic evidence. The network has been used successfully in a number of cases. The EU JHA Council on 19 March 1998 endorsed the 10 Principles to combat high-tech crime adopted by the G8 and invited the non-G8 Countries of the Member States of the EU to join the network. These contact points should co-operate directly, supplementing existing structures of mutual assistance and channels for communications.

Creation of such a network is also foreseen by the draft C.o.E. Convention. Reference to a 24h/7d network of points of contact exists also in the Council Decision on combating Child Pornography on the Internet and in the EU Common Position on the draft C.o.E. Convention on cyber-crime and in the Council decision endorsing the G8 action plan, but no concrete EU-specific initiatives have yet been taken.

The Commission considers that given the need for appropriate expertise and expedited action in this field, the Council’s intentions should be implemented without delay. To be successful, however, such a network would require both legally and technically literate staff, which implies appropriate training.

There is a similar need to intensify co-operation and information exchange between customs authorities. Existing forms of co-operation should be enhanced, and new means of managing joint operations and exchanging information should be developed. With due regard to data protection requirements, there is a growing consensus among customs authorities that international information networks should be formed to further facilitate the exchange of information. There is also a need for greater resources to be invested in this area, both regarding the upgrade of computer systems but also in educating personnel, in order for customs authorities to perform their duties more effectively.

At the domestic level, and once the necessary conditions enshrined in law are fulfilled, law-enforcement authorities need to be able to search and seize data stored in computers speedily enough to prevent the destruction of criminal evidence. Law-enforcement authorities consider that they should have sufficient coercive powers to be able, within their jurisdiction, to search computer systems and seize data, order persons to submit specified computer data, order or obtain the expeditious preservation of specific data in accordance with normal legal safeguards and procedures. At present, however, the safeguards and procedures are not approximated.

Questions may arise if, when accessing a computer, law-enforcement authorities find that a number of computers and networks are involved which are located all over the country. Issues become much more complicated if, while searching a computer or simply pursuing an investigation, a law-enforcement authority finds itself accessing or needing to access data located in one or more different countries. Important sovereignty, human rights and law-enforcement interests are at stake and need to be balanced.

Existing legal tools for international co-operation in criminal law matters, i.e., mutual legal assistance, may not be appropriate or sufficient, since their implementation normally takes several days, weeks or months. There is a need for a mechanism by which countries can investigate offences and obtain evidence quickly and efficiently, or at least not lose important evidence in cross-border law-enforcement procedures, in a manner consistent with principles of national sovereignty and constitutional and human rights, including privacy and data protection.

New proposals under consideration in the Council of Europe draft Convention on Cybercrime to address these problems include orders for the preservation of data to assist specific investigations. However, other issues, such as transborder search and seizure, present difficult and as yet unresolved policy questions. More discussion among all parties concerned is clearly required before any concrete initiatives may be envisaged.

The G8 high-tech crime subgroup has discussed the issue of transborder search and seizure and, in anticipation of a subsequent more permanent agreement, has reached consensus on provisional principles. Important questions, however, related in particular to when expedited search and seizure in particular situations is possible prior to informing the searched state, and appropriate safeguards to respect fundamental rights will need to be established. In the EU Common Position relating to the C.o.E. Draft Convention on Cybercrime, the Ministers have adopted an open-ended position.

In transborder computer-related crime cases, it is also important that there are clear rules on which country has jurisdiction for prosecution. In particular it should be avoided that no country has jurisdiction. The main rules proposed by the draft Council of Europe Convention are that jurisdiction be established by a state when the offence is committed in its territory or by one of its nationals. When more than one state claims jurisdiction, the states concerned should consult with a view to determining the most appropriate jurisdiction. However, a lot will depend on effective bilateral or multilateral consultation. The Commission will keep this issue under review to see whether any further action may be required at EU level.

The Commission, having participated in both the C.o.E. and the G8 discussions, recognises the complexity and difficulties associated with procedural law issues. But effective co-operation within the EU to combat cybercrime is an essential element of a safer Information Society and the establishment of an Area of Freedom, Security and Justice.

The Commission intends to continue its consultations with all parties concerned over the coming months with a view to building on this work. This issue will also be considered in the wider context of its work on implementing the conclusions of the European Council in Tampere in October 1999. In particular, the Tampere Summit asked the Council and the Commission to adopt, by December 2000, a programme of measures to implement the principle of mutual recognition of judicial decisions. The Commission has already published a Communication on Mutual Recognition of Final Decisions in Criminal Matters. As part of its contribution to implementing the part of the programme of measures dealing with enforcement of pre-trial orders, the Commission will consider the options for mutual recognition of pre-trial orders associated with cybercrime investigations with a view to bringing forward a legislative proposal under Title VI of the TEU.

Even in cases in which law-enforcement authorities have accessed computer data which seem to be criminal evidence, they need to be able to retrieve and authenticate them for use in criminal investigations and prosecutions. This is not a very easy task given the volatile nature and ease of manipulation, falsification, technological protection or deletion of electronic data. It is addressed by computer forensics, which encompasses the development and use of scientific protocols and procedures for searching computers and analysing and maintaining the authenticity of data that has been retrieved.

At the request of the G8 experts, the International Organisation of Computer Evidence (IOCE) has agreed to develop recommendations for standards, including the definition of common terms, identification methods and techniques to be used and establishment of a common format for forensic requests. The EU should be associated with this work, both at the level of Member States specialised computer-crime investigation bodies and through the R&D supported by the 5^th Framework Programme (IST Programme).

Appropriate legislation at both national and international level is necessary but not in itself sufficient for effectively combating computer-related crime and network misuse. A number of supplementary, non-legislative conditions are also required to complement the legislative measures. Most have been included in the recommendations of the COMCRIME study, the G8 has proposed such in its 10-point action plan and they have received broad support in the informal consultation process that preceded the drafting of this Communication. They include:

• the creation of special computer-crime police units at the national level, where they do not already exist ;
• improved co-operation between law enforcement, industry, consumer organisations and data protection authorities;
• encouraging appropriate industry and community-led initiatives, including on security products.

The issue of encryption is likely to remain important in this context. Encryption is an essential tool to facilitate the implementation and adoption of new services, including electronic commerce, and can make a substantial contribution to the prevention of crime on the Internet. The Commission’s policy on encryption has been laid down in its Communication on trust and confidence in electronic communication of 1997, in which the Commission indicated that it would try to abolish all restrictions on the free circulation of all encryption products at the level of the European Community. The Communication further stated that domestic restrictions on the free circulation of encryption products have to be compatible with Community law and that it will examine whether such national restrictions are justified and proportionate, notably with respect to the free circulation provisions of the Treaty, the case law of the Court of Justice and the requirements of the Data Protection Directives. Nevertheless, the Commission recognises that encryption also presents new and difficult challenges for law enforcement agencies.

The Commission therefore welcomes the recently adopted revised dual-use goods regulation that significantly contributed to liberalise the availability of encryption products, while recognising that this needs to be accompanied by a better dialogue between users, industry and law enforcement. For its part, the Commission intends to promote this dialogue at EU level through the proposed EU Forum. The EU wide availability of security products, including strong encryption products, where appropriate certified to agreed evaluation criteria, would improve both crime prevention possibilities and users’ trust in information society processes.

Given the technical and legal complexity of some of the computer-related criminal acts, the setting up of specialised units at national level is essential. Such specialised units, consisting of knowledgeable, multidisciplinary (law enforcement and judiciary) personnel should be equipped with adequate technical facilities and operate as rapid contact points for the purposes of:

• responding quickly to requests for information on suspected offences. Common formats for the exchange of such information will need to be defined, although discussions at G8 experts level have shown that this may not be an easy task, given differences in national legal cultures;
• acting as the law enforcement-interface nationally and internationally for hotlines receiving complaints about illegal content from Internet users;
• improving and/or developing specialised computer investigation techniques for the purpose of detecting, investigating and prosecuting computer-related crimes;
• acting as a centre of excellence on cyber-crime issues for the purpose of sharing best practices and experience.

Within the EU some Member States have already set up these specialised units dealing specifically with computer-related crimes. The Commission considers that the setting up of such specialised units is a Members State prerogative and strongly encourages Member States to take steps in that direction. Purchasing the latest hardware and software for these units and training their personnel involves substantial cost and presupposes priorities and political decisions at appropriate government levels. The experience of already existing Member States units may be particularly valuable. The Commission will encourage the exchange of such experience.

The Commission also believes that Europol can provide further added value at EU level through co-ordination, analysis and other assistance to the national specialised units. The Commission will therefore support the extension of Europol's remit to cover cybercrime.

A considerable effort is required in the area of continuous, specialised training of both police and judicial staff. Computer-related criminal techniques and capabilities change more rapidly than those in more traditional areas of criminal activity.

Some Member States have been implementing initiatives for the high-tech training of law enforcement staff. They could provide advice and guidance to Member States that have not yet taken similar steps.

Individual projects aiming to achieve this – taking the form of exchanges of experiences, seminars on common challenges faced by the relevant professional categories– have been launched with the support of programmes administered by the Commission (in particular STOP, FALCONE and GROTIUS Programmes). The Commission will propose more activities in this area, including computer and on-line training.

Europol has taken the initiative to host a one-week training session for law-enforcement personnel from the Member States in November 2000, with particular reference to child pornography issues. The scope of such a session could be extended to include computer-related crime in general. Interpol has also been active in this field since a number of years. Its relevant initiatives could be extended to include a larger number of trainees.

The G8 has organised initiatives allowing the exchange of experience amongst law enforcement authorities and the establishment of common investigation techniques on the basis of concrete cases. A further initiative in the field of training is expected to be taken in the second half of year 2001. EU Member States participating in the G8 could share these experiences with the other Member States.

In the specific field of combating child pornography on the Internet, the creation and maintenance of a digital Central Library of child pornography images at an international level (to be made available on the Internet for specialised law enforcement units at national level, with the necessary conditions and limitations as regards access and protection of privacy) would aid the search for victims and perpetrators, help determine the nature of offences and train specialised police officers.

The creation of a harmonised set of rules for police and judicial record-keeping and of the appropriate tools for statistical analysis of computer crime would help law enforcement and judicial authorities to better store, analyse, evaluate the formal information gathered in this still changing area.

Also, from the point of view of the private sector, such statistics are required for a proper assessment of the risks involved, and a cost-benefit analysis of their management. This is important not only for operational reasons (such as deciding on what security measures to take) but also for insurance purposes.

A database on computer crime statutes that was provided as part of the COMCRIME study, is being updated and made accessible to the Commission. The Commission will consider improving the content (include laws, court cases and literature) and usability of the database.

Effective co-operation between government and industry within the legal framework has been considered as an essential element of any public policy to tackle computer-related crimes.Law-enforcement representatives have admitted that they have not always been sufficiently clear and precise on what they need from service providers. Industry representatives have expressed a generally positive attitude towards better co-operation with law enforcement whilst underlining the need for an appropriate balance between the protection of the fundamental rights and freedoms of citizens, in particular their right to privacy, the need of combating crime and the economic burdens placed on providers.

Together, industry and law enforcement can raise public awareness on the risks posed by criminals on the Internet, promote best practices for security, and develop effective counter-crime tools and procedures. There have already been relevant initiatives in a number of Member States of which the UK Internet Crime Forum is probably the oldest and most far-reaching.

The Commission welcomes these initiatives and considers they need to be encouraged in all Member States. The Commission intends to establish an EU Forum in which law enforcement agencies, Internet Service Providers, telecommunications operators, civil liberties organisations, consumer representatives, data protection authorities and other interested parties will be brought together with the aim of fully enhancing co-operation at EU level. At a first stage, this will include public officials to be named by Member States, technology experts, privacy experts to be appointed by the Art. 29 Data Protection Working Party and industry and consumer representatives to be identified in close consultation with industry and consumers associations. At a later stage, this Forum will include representatives from relevant national initiatives.

The EU Forum will be operated in an open and transparent manner, and relevant documents will be published on a website, and comments will be invited from all interested parties.

The EU Forum will be invited to consider in particular the following areas:

• Developing, where appropriate, 24-hours points of contact between government and industry;
• Developing an appropriate standard format for law enforcement requests for information from industry, increasing law enforcement’s use of the Internet when communicating with service providers;
• Encouraging the development and/or implementation of codes of conduct and best practices and the sharing of such codes among industries and governments
• Encouraging the exchange of information on trends in high-tech crime between the various parties, particularly industry and law enforcement agencies;
• Exploring law enforcement concerns in the development of new technologies;

• Encouraging further development of early warning and crisis management mechanisms to prevent, identify and handle threats or disrupting events on information infrastructures;
• Providing, where required, an enhanced expert contribution to work underway within the Council and in other international fora, for example the Council of Europe and G8;
• Encouraging co-operation between interested parties including principles shared by law enforcement, industry and users (e.g., Memorandum of Understanding (MOU), Codes of Practice in line with the legal framework).

To a large extent, combating computer-related crime is in the wider community’s own interest. If consumers are to have confidence in electronic commerce, measures to prevent computer-related crime need to be an accepted element of good business practice. Many industries, e.g. in the banking, electronic communications, credit card and copyright sectors, and their customers are potential victims of computer-related crime. Companies naturally protect their own names and trademarks, and consequently have a role in fraud prevention. Organisations representing the software and audio industries (e.g., British Phonographic Industry - BPI) have teams investigating piracy (including Internet-related piracy). Internet service providers in a number of Member States have set up hot-lines for the reporting of illegal and harmful content.

The Commission has been supporting some of these initiatives by encouraging their participation in the EU R&D Framework Programme, the Internet Action Plan and Title VI Programmes such as STOP and DAPHNE.

Best practice in these areas will be exchanged in the context of the EU Forum.

In the Information Society Technologies (IST) RTD Programme, which is part of the 5^th Framework Programme, 1998 to 2002, emphasis is put on the development and deployment of confidence-building technologies. As such, confidence-building technologies embrace both information and network security technologies as well as technical tools and methods to protect from abuses of the fundamental right to privacy and data protection and other personal rights and to fight computer crime.

The IST Programme, in particular work related to Information and network security and other confidence-building technologies in Key Action 2 - New Methods of Work and Electronic Commerce, provides the framework to develop capability and technologies to understand and tackle the emerging technology challenges related to preventing and combating computer crime and assure that security and privacy requirements can be met at EU level, at the level of virtual communities and at the level of the individual.

In addition, in order to properly deal with the challenges related to trust and confidence, including preventing and investigating computer crime, a dependability initiative has also been launched in the context of the IST Programme. The role of this initiative is to contribute towards raising and assuring trust and confidence in highly inter-linked information infrastructures and in tightly networked, embedded systems by promoting dependability awareness and dependability-enabling technologies. An integral part of this initiative is international co-operation. The IST Programme has developed working relationships with DARPA and NSF and established, in collaboration with the Department of State, the Joint Task Force on the Critical Infrastructure Protection under the auspices of the EC/US Joint Consultative Group of the S&T Co-operation Agreement.

The Commission’s Joint Research Centre (JRC), which has been supporting the dependability initiative in the IST Programme, will focus its efforts on developing appropriate and harmonised measures, indicators and statistics in consultation with other interested parties, including Europol. This will have the aim of developing a proper classification and understanding of illegal activities, their geographical distribution, their rate of increase and the effectiveness of measures taken to counteract them. Where appropriate, the JRC will involve other research groups and integrate their efforts and results. It will maintain an Internet web-site on the issue and report its progress to the EU Forum.

Preventing and effectively combating computer-related crime presupposes the existence of a number of necessary conditions:

• the availability of preventive technologies. This requires an appropriate regulatory environment which gives room and incentives for innovation and research. Public financing can be justified to support the development and deployment of appropriate security technologies.

• the awareness of potential security risks and ways to combat them;

• adequate substantive and procedural legislative provisions, as regards both domestic and transnational criminal activities. National substantive criminal laws should be sufficiently comprehensive and effective in criminalising serious computer-related abuses and provide for dissuasive sanctions, helping to overcome dual criminality problems and facilitating international co-operation. Where there is a well-founded need for action by law enforcement to expeditedly search, seize and securely copy computer data within their national territory in order to be able to investigate a computer related crime, this should be made possible by procedural laws, in conformity with the principles and exceptions provided for by Community law and in accordance with the European Convention on Human Rights.The Commission believes that the agreement reached on the interception provisions in the Convention on Mutual Assistance in Criminal Matters is the maximum possible that is achievable at present. The Commission will keep reviewing its implementation with Member States, industry and users to ensure that relevant initiatives are effective, transparent and well balanced;

• the availability of a sufficient number of well trained and equipped law-enforcement personnel. Close collaboration with Internet service providers and telecommunications operators in the field of training will be further encouraged;
• improved co-operation between all the actors concerned; users and consumers, industry, law enforcement and data protection authorities. This is critical to investigating computer crime and protecting public safety. Industry needs to operate within clear rules and obligations. Governments should recognise that the needs of law enforcement may place burdens on industry and thus take reasonable steps to minimise such burdens. At the same time, industry ought to include public safety considerations in its business practices. Increasingly this will need the active co-operation and support of the individual user and consumer;
• continuous industry and community-led initiatives. Hotlines, already in place for reporting illegal and harmful content cases, may be extended to other types of abuse. Industry self-regulation and a multidisciplinary memorandum of understanding could involve the broadest possible number of interested parties and play a multiple role in helping prevent and combat computer crime and increasing awareness and trust;
• the achievements and potential of R&D should be exploited to the maximum extent possible. The strategic focus will be on bringing together affordable and effective security and other confidence building technology developments and EU policy initiatives.

Any measures to be agreed by the EU, however, should take into account the need to gradually bring the candidate countries into the realms of EU and international co-operation in this field and avoid that they are used as computer crime havens. Involvement of representatives of these countries in some or all of the relevant EU meetings should be considered.

The Commission proposals can be divided into the following areas.

The Commission will bring forward legislative proposals under the Title VI of the TEU:

• to approximate Member States’ laws in the area of child pornography offences. This initiative will be part of a package of proposals which will also cover wider issues associated with the sexual exploitation of children and trafficking in human beings, as announced in the Commission’s Communication on trafficking in human beings of December 1998. Such a proposal will be fully in line with the European Parliament’s attempt to turn the Austrian initiative for a Council Decision on child pornography into a Framework Decision requiring approximation of laws. This is also consistent with the Tampere conclusions and the EU strategy for the new Millennium to combat organised crime. This is already part of the Scoreboard for the establishment of an area of Freedom, Security and Justice.
• to further approximate substantive criminal law in the area of high-tech crime. This will include offences related to hacking and denial of service attacks. The Commission will also examine the scope for action against racism and xenophobia on the Internet with a view to bringing forward a Framework Decision under Title VI of the TEU covering both off-line and on-line racist and xenophobic activity. Finally, the problem of illicit drugs on the Internet will also be examined.

• to apply the principle of mutual recognition to pre-trial orders associated with cybercrime investigations and to facilitate computer-related criminal investigations involving more than one Member State with appropriate safeguards concerning fundamental rights. This proposal is consistent with the outline programme of measures for mutual recognition, which refers to the need to consider proposals on the production and freezing of evidence.

The need to take any measures, in particular of a legislative nature on the question of retention of traffic data will be assessed by the Commission amongst other consultations, on the basis of the outcome of the work that will be done by the proposed EU Forum in this area.

Action is proposed in a number of areas:

• the Commission will establish and chair an EU Forum in which law enforcement agencies, service providers, network operators, consumer groups and data protection authorities will be brought together with the aim of enhancing co-operation at EU level by raising public awareness on the risks posed by criminals on the Internet, promoting best practices for IT security, developing effective counter-crime tools and procedures to combat computer-related crime as well as encouraging further development of early warning and crisis management mechanisms. This would be an EU version of similar successful fora which exist in certain Member States. Where such fora do not exist the Commission would encourage Member States to set them up. Co-operation between these various fora would be encouraged and facilitated through the EU Forum.

• the Commission will continue to promote security and trust in the context of the eEurope initiative, the Internet Action Plan, the IST programme and the next framework programme for RTD. These will include promoting the availability of products and services with an appropriate level of security and encouragement of a more liberalised use of strong encryption through a dialogue amongst all interested parties.
• the Commission will promote further projects under existing programmes to support the training of law enforcement staff on high-tech crime issues and to support research in forensic computing.

• the Commission will consider providing funding for improving the content and usability of the database of Member States’ national laws provided by the COMCRIME study, and will launch a study to obtain a better picture of the nature and extent of computer-related crime in the Member States.

The Commission will continue to play a full role in ensuring co-ordination between Member States in other international fora in which cybercrime is being discussed such as the Council of Europe and G8. The Commission’s initiatives at EU level will take full account of progress in other international fora, while seeking to achieve approximation within the EU.

Footnotes

1. Presidency Conclusions of the Lisbon European Council of 23 and 24 March 2000, available at
   http://ue.eu.int/en/Info/eurocouncil/index.htm.

2. http://europa.eu.int/comm/information_society/eeurope/actionplan/index_en.htm.

3. Information flows are filtered and controlled at all levels; from the firewall that looks at data packets, through the filter that looks for malicious software, the e-mail filter that discretely eliminates spam, to the browser filter that prevents access to harmful material.

4. See, e.g., the e-Europe Action Plan at
   http://europa.eu.int/comm/information_society/eeurope/actionplan/index_en.htm,
   
   and statements of European Commissioner Antõnio Vitorino at
   http://europa.eu.int/comm/commissioners/vitorino/speeches/2000/septembre/2000-19-09-en_brussels.pdf,
   
   and French Prime Minister Lionel Jospin at
   http://www.france.diplomatie.fr/actual/evenements/cybercrim/jospin.gb.html.

5. Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain aspects of Information Society services, in particular electronic commerce, in the Internal Market ("Directive on electronic commerce").

6. The EU JHA Council on 19 March 1998 endorsed the 10 Principles to combat high-tech crime adopted by the G8 and invited the non-G8 Countries Member States of the EU to arrange for to join the network. Available on European Judicial Network website http://ue.eu.int/ejn/index.htm.

7. The Draft text is available on the web, in two languages, in French : http://conventions.coe.int/treaty/fr/projets/cybercrime.htm.
   and in English: http://conventions.coe.int/treaty/en/projets/cybercrime.htm.
   

8. Under the auspices of the Joint Consultative Group of the EC/US Science and Technology Co-operation Agreement.

9. The United Nations produced a comprehensive "Manual on the prevention and control of computer-related crime," which has recently been updated. In 1983, the OECD undertook a study of the possibility of an international application and harmonisation of criminal laws to address the problem of computer crime or abuse. In 1986, it published "Computer-Related Crime: Analysis of Legal Policy," a report that surveyed the existing laws and proposals for reform in a number of Member States and recommended a minimum list of abuses that countries should consider prohibiting and penalising by criminal laws. Finally, in 1992, the OECD developed a set of guidelines for the security of information systems, which is intended to provide a foundation on which States and the private sector could construct a framework for the security of information systems.

10. Council Recommendation 98/560/EC of 24 September 1998 on the development of the competitiveness of the European audiovisual and information services industry by promoting national frameworks aimed at achieving a comparable and effective level of protection of minors and human dignity;
    Green Paper on the Protection of Minors and Human Dignity in Audiovisual and Information Services; COM(96) 483, October 1996, http://europa.eu.int/en/record/green/gp9610/protec.htm;
    Communication from the Commission to the Council, the European Parliament, the Economic and Social Committee and the Committee of the Regions –Illegal and harmful content on the Internet (COM(96) 487 final);
    Resolution on the Commission communication on illegal and harmful content on the Internet (COM(96)487 - C4-0592/96);
    Council Resolution of 17 January 1995 on the lawful interception of telecommunications (OJ C 329, 04.11.1996, pp. 1– 6).

11. http://europa.eu.int/comm/justice_home/jai/prog_en.htm.

12. "Legal Aspects of Computer-related Crime in the Information Society – COMCRIME." The study was prepared by Prof. U. Sieber of the University of Würzburg under contract with the European Commission. The final report is available at: http://europa.eu.int/ISPO/legal/en/crime/crime.html.

13. At EU level, the data protection supervisory authorities constitute the Article 29 Data Protection Working Party, which is the independent EU advisory body on privacy and data protection, see art. 29 and 30 of Directive 95/46/EC.

14. Two meetings with law enforcement took place on 10.12.1999 and 1.3.2000. A meeting with Internet industry representatives took place on 13.3.2000. A meeting with a small number of personal data protection experts took place on 31.3.2000. A final meeting with all the above took place on 17.4.2000. Minutes of the meetings can be obtained by writing to: European Commission, Unit INFSO/A4, or to: European Commission, Unit JAI/B2, Wetstraat/Rue de la Loi 200, 1049 Brussels, Belgium.

15. EU Charter on Fundamental Rights (http://europa.eu.int/comm/justice_home/unit/charte_en.htm), Article 6 of the TEU and jurisprudence of the European Court of Justice.

16. The observation made in 1965 by Gordon Moore, co-founder of Intel, about the speed at which the density of transistors in integrated circuits was increasing. This density is now approximately doubling every 18 months and this has a direct impact on the price and performance of computer chips. Many experts expect this to hold for at least an