Abstract
Communication technologies play an important role in society. Global cybercrime is one of the biggest underworld industries, much of this crime is unreported, new forms of crimes occur. In the light of the new EU Directive (2013/40/EU of the European Parliament and of The Council on attacks against information systems and replacing Council Framework Decision 2005/222/JHA), the authors of the Article discuss if and how the new instrument helps to solve some of the aforementioned problems. The first part of the Article presents systemic and historic evaluation of the EU cybercrime policy in comparison with the Convention on Cybercrime. The second and third parts of the Article focus on two specific issues related to cybercrimes. The second part evaluates changes in the material criminal law introduced by the new Directive and their effectiveness in resolving the issue of harmonization. The last part of the paper is answering if introduced procedural changes are successful in providing framework of law enforcement cooperation and capacity to investigate.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Notes
- 1.
Kaiafa-Gbandi (2012), p. 59.
- 2.
Typical “bot-herders” control tens of thousands and even millions of “zombie” computers. More statistics and data on cyberthreats could be found in Nir Kshetri. See Kshetri (2010).
- 3.
European Union Agency for Network and Information Security, p. 4. https://www.enisa.europa.eu/media/key-documents/cybersecurity-cooperation-defending-the-digital-frontline.
- 4.
The survey done by Ponemon institute indicates that both the cost and frequency of cybercrime have continued to rise for the fourth straight year. According to this study of a benchmark sample of organizations in the USA, the occurrence of cyberattacks has more than doubled during this period, while the financial impact has increased by nearly 78 %. See Ponemon Institute, http://www.hpenterprisesecurity.com/ponemon-study-2013.
- 5.
See Norton Cybercrime Report 2012, http://us.norton.com/cybercrimereport.
- 6.
See Kshetri (2013).
- 7.
One global private sector survey suggests that 80 % of individual victims of core cybercrime do not report the crime to the police. See Expert Group to Conduct a Comprehensive Study on Cybercrime, p. 6. http://www.unodc.org/documents/organized-crime/UNODC_CCPCJ_EG.4_2013/UNODC_CCPCJ_EG4_2013_2_E.pdf.
- 8.
Communication from the Commission to the European Parliament, (COM 2007) 267 final, Sect. 1.2.1.
- 9.
Gabrys (2002), p. 21.
- 10.
See Storm (2013). http://edepot.wur.nl/252016.
- 11.
European Commission (2012), p. 25. http://ec.europa.eu/public_opinion/archives/ebs/ebs_390_en.pdf.
- 12.
Ibid at p. 22.
- 13.
Vasiu and Vasiu (2013), p. 44.
- 14.
Choo and Grabosky (2013), p. 15.
- 15.
Convention on Cybercrime et al. 2001, Budapest, 23.11.2001.
- 16.
Council Framework Decision 2005 2005/222/JHA on attacks against information systems.
- 17.
Directive 2013/40/EU of the European Parliament and of The Council on attacks against information systems and replacing Council Framework Decision 2005/222/JHA.
- 18.
Sommer and Brown (2011), p. 73. http://www.oecd.org/gov/risk/46889922.pdf.
- 19.
The dual criminality requirement continues to be important—but not for the purpose of isolating nation states and not because criminal law should be associated with one fixed cultural environment and for this purpose kept separate from other cultures. Rather, the requirement is significant because it helps to put into practice the rule-of-law concept that each legal system must have for its criminal offenses a kaleidoscope clearly defined by the legislature—and can only provide legal assistance for this defined kaleidoscope of offenses. The rapprochement of the states and the corresponding approximation of their common efforts to carry out law enforcement transnationally, therefore, require substantive scrutiny of existing differences among the various systems of criminal law. It is the dual criminality requirement that demands this examination, and it is the dual criminality requirement that by so doing fosters true harmonization. Capus (2007–2009). http://www.mpicc.de/ww/en/pub/forschung/forschungsarbeit/strafrecht/rechtshilfe.htm.
- 20.
Even if the dual criminality rule is not an aspect of all incidents of mutual assistance, it is often a requirement in cases of search and seizure, which is a particularly important means of assistance where data are concerned. Double criminality, furthermore, is basic to other common cooperation modes, such as extradition, or other schemes for solving jurisdictional conflicts as discussed above. Unless domestic criminal legislation, as it develops, moves beyond expressions of sovereignty to espousing common principles as agreed among nations, conflicts will not be avoided. Efforts by States to harmonize their domestic laws will prevent conflicts of jurisdiction and, at minimum, will lay the basic groundwork for cooperation. See United Nations Manual on the prevention and control of computer-related crime (1990). http://www.uncjin.org/Documents/EighthCongress.html.
- 21.
Ibid.
- 22.
For tracing and identifying suspects, investigators often need access to data that may be deleted shortly after transfer. A very short response time by the investigative authorities is often vital for a successful investigation. See Gercke (2011), p. 139.
- 23.
Directive 2013/40/EU of the European Parliament and of The Council on attacks against information systems and replacing Council Framework Decision 2005/222/JHA.
- 24.
Convention on Cybercrime, Budapest, 23.11.2001.
- 25.
As on 22/1/2014, the Convention on Cybercrime was ratified by 41 State (36 members of European Council) and 11 States who signed convention were not following it by ratifications. Among them are also five EU countries: Greece, Ireland, Luxemburg, Poland, and Sweden. However, five countries, including USA, which are not members of the European Council also ratified this Convention. See Convention on Cybercrime. Explanatory report. ETS 185. http://conventions.coe.int/Treaty/en/Reports/Html/185.htm.
- 26.
Proposal for a Directive of the European Parliament and of the Councilon attacks against information systems and repealing Council Framework Decision 2005/222/JHA (2010). http://ec.europa.eu/dgs/home-affairs/policies/crime/1_en_act_part1_v101.pdf.
- 27.
Especially for the norms taking into account such procedural aspects of cybercrime as the volatility and vulnerability of electronic evidence. Procedda (2011), p. 43. http://ec.europa.eu/idabc/en/document/70.html.
- 28.
Kaiafa-Gbandi (2012), p. 61.
- 29.
Which are either indicated as world leaders in cybercrime. See Jagadeeswara Rao (2011), p. 113.
- 30.
Procedda (2011), p. 43. http://ec.europa.eu/idabc/en/document/70.html.
- 31.
That police might acquire powers to cross national boundaries without consent from the local authorities. Sommer and Brown (2011), p. 71. http://www.oecd.org/gov/risk/46889922.pdf.
- 32.
The author fears that states usually will not refuse to cooperate with other countries in which lower standards for safeguard are applied which means that the data could be transferred without required respect for human rights. Procedda (2011), p. 44. http://ec.europa.eu/idabc/en/document/70.html.
- 33.
By Article 42, states are empowered to make reservations, including dual criminality. Convention on Cybercrime, Budapest, 23.11.2001.
- 34.
Kaiafa-Gbandi (2012), p. 61.
- 35.
Sommer and Brown (2011), p. 71. http://www.oecd.org/gov/risk/46889922.pdf.
- 36.
Naziris (2014), p. 327.
- 37.
Commission of the European Communities, (COM(93) 700, 5 Dec 1993).
- 38.
European Council (1994).
- 39.
Example in eEurope initiative and eEurope Action Plan (1999)—the importance of network security and the fight against cybercrime where already highlighted. Available on Internet http://ec.europa.eu/idabc/en/document/70.html. In Communication of 2000 aimed at Creating a safer information society by improving the security of information infrastructures and combating computer related crime, the Commission established the EU priorities and future steps in both prevention and combating cyber crime naming the basic challenges and peculiarities of these crimes. See Communication from the Commission to the European Parliament, the Council and the Economic and Social Committee and the Committee of the Regions, Creating a safer information society by improving the security of information infrastructures and combating computer-related crime, (COM 2000) 890 final, 26.1.2001). http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=COM:2000:0890:FIN:EN:PDF.
- 40.
Council Framework Decision 2004/68/JHA on combating the sexual exploitation of children and child pornography. (Official Journal L.13, 20.1.2004).
- 41.
Directive 2000/31/EC of the European Parliament and of the Council on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market. (Official Journal L 178,17.7.2000).
- 42.
Directive 2002/58/EC of the European Parliament and of the Council concerning the processing of personal data and the protection of privacy in the electronic communications sector. (Official Journal L 201/37, 31.7.2002); Directive 2006/24/EC of the European Parliament and of the Council on the retention of data generated or processed in connection with the provision of publicly available electronic communication services or of public communications networks and amending Directive 2002/58/EC. (Official Journal L 105, 13.4.2006).
- 43.
Procedda (2011), p. 42. http://ec.europa.eu/idabc/en/document/70.html.
- 44.
Council Framework Decision 2005/222/JHA on attacks against information systems.
- 45.
Five EU countries—Ireland, Greece, Luxembourg, Poland, and Sweden—have not ratified the document even though they also signed the treaty. See Convention on Cybercrime Chart of signatures and ratifications. http://conventions.coe.int/Treaty/Commun/ChercheSig.asp?NT=185&CM=&DF=&CL=ENG.
- 46.
Council Framework Decision 2005/222/JHA on attacks against information systems.
- 47.
Judgement of the Court (2005).
- 48.
Order of the Court (2008).
- 49.
- 50.
Done in accordance with Article 4 of the Framework decision.
- 51.
Report from the Commission to the Council based on Article 12 of the Council Framework Decision of 24 February 2005 on attacks against information systems (COM (2008)448 final, 14.7.2008), p. 6, Sect. 2.5.
- 52.
Protocol (No. 36) On Transitional Provisions, Article 10, establishes that Commission‘s enforcement powers and the powers of the Court of Justice are in force in 5 years after entry into force of the Lisbon Treaty, i.e. from 1 December, 2014. Craig (2010), p. 341.
- 53.
The biggest botnets witnessed have been estimated to have between 40,000 and 100,000 infected computers per period of 24 h. See Proposal for a Directive of the European Parliament and of the Council on attacks against information systems and repealing Council Framework Decision 2005/222/JHA (COM (2010) 517 final, 30.9.2010), p. 3. http://ec.europa.eu/dgs/home-affairs/policies/crime/1_en_act_part1_v101.pdf.
- 54.
Ibid.
- 55.
The Lisbon Treaty (2010).
- 56.
- 57.
Joint Communication To The European Parliament, The Council, The European Economic And Social Committee And The Committee Of The Regions, Cybersecurity Strategy of the European Union: An Open, Safe, and Secure Cyberspace, (JOIN(2013) 1 final, 7.2.2013).
- 58.
Such as achieving cyber resilience; drastically reducing cybercrime; developing cyberdefence policy and capabilities related to the common security and defence policy; develop the industrial and technological resources for cybersecurity; establish a coherent international cyberspace policy for the European Union and promote core EU values. Ibid.
- 59.
Naziris (2014), p. 340.
- 60.
Directive 2013/40/EU of the European Parliament and of The Council on attacks against information systems and replacing Council Framework Decision 2005/222/JHA.
- 61.
Gandhi (2012), p. 1.
- 62.
Ibid.
- 63.
The challenge of borderless cyber-crime 2000. http://legal.un.org/ola/media/info_from_lc/cybercrime.pdf.
- 64.
Hale (2002) Cybercrime: Facts and Figures Concerning this Global Dilemma, Crime & Justice International 18 (65). http://www.cjimagazine.com/archives/cji4411.html?id=37.
- 65.
The terms “cybercrime,” “computer crime”, “Information Technology crime,” and “high-tech crime” are often used inter-changeably to refer to two major categories of offenses: in the first, the computer is the target of the offense; attacks on network confidentiality, integrity and/or availability—i.e. unauthorized access to and illicit tampering with systems, programs or data—all fall into this category; the other category consists of traditional offenses—such as theft, fraud, and forgery—that are committed with the assistance of or by means of computers, computer networks and related information and communications technology. See Goodman and Brenner (2002), p. 9. http://www.lawtechjournal.com/articles/2002/03_020625_goodmanbrenner.pdf.
- 66.
For example, a person who produces USB devices containing malicious software that destroys data on computers when the device is connected commits a crime as defined by Article 4 of the Convention on Cybercrime. However, since the act of deleting data using a physical device to copy malicious code has not been committed through global electronic networks, it would not qualify as cybercrime under the one of the definitions presented. Gercke (2011), p. 28.
- 67.
Expert Group to Conduct a Comprehensive Study on Cybercrime, p. 6. http://www.unodc.org/documents/organized-crime/UNODC_CCPCJ_EG.4_2013/UNODC_CCPCJ_EG4_2013_2_E.pdf.
- 68.
Article 2—Illegal Access, Article 3—Illegal interception, Article 4—Data interference, Article 5—System interference, Article 6—Misuse of devices. See The Convention on Cybercrime, Budapest, 23.11.2001.
- 69.
Article 7—Computer-related forgery, Article 8—Computer-related fraud. See The Convention on Cybercrime, Budapest, 23.11.2001.
- 70.
Article 9—Offences related to child pornography. See The Convention on Cybercrime, Budapest, 23.11.2001.
- 71.
Article 10—Offences related to infringements of copyright and related rights. See The Convention on Cybercrime, Budapest, 23.11.2001.
- 72.
Gercke (2011), p. 30.
- 73.
Nye (2010), p. 16. http://belfercenter.ksg.harvard.edu/files/cyber-power.pdf.
- 74.
Shinder and Cross (2008), p. 11.
- 75.
- 76.
The principle of equivalence means that general legal frameworks should be applied on-line as they are off-line. Actuality of this principle in the criminal law means that it stops people from thinking that the cyberspace is different than the natural space and there are different law standards in it. In the view of the speed at which new technologies are developing, they will strive to frame regulations which are technology-neutral, whilst bearing in mind the need to avoid unnecessary regulation. See Declaration of the European Union Ministers, Global Information Networks: Realising the Potential (July 6–8, 1997, Bonn). http://web.mclink.it/MC8216/netmark/attach/bonn_en.htm#Heading01.
- 77.
The principle of technological neutrality means that the law neither imposes nor discriminates the use of a particular type of technology. See Proposal for a Regulation of the European Parliament and of the Council laying down measures concerning the European single market for electronic communications and to achieve a Connected Continent, and amending Directives 2002/20/EC, 2002/21/EC and 2002/22/EC and Regulations (EC) No 1211/2009 and (EU) No 531/2012. http://eur-lex.europa.eu/smartapi/cgi/sga_doc?smartapi!celexplus!prod!DocNumber&lg=EN&type_doc=COMfinal&an_doc=2013&nu_doc=627. The principle of technological neutrality was also used in various Europe legal documents. For example: The requirement for Member States to ensure that national regulatory authorities take the utmost account of the desirability of making regulation technologically neutral, that is to say that it neither imposes nor discriminates in favour of the use of a particular type of technology. See Directive 2002/21/EC of the European Parliament and of the Council on a common regulatory framework for electronic communications networks and services. (7 Mar 2002). http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0021:en:NOT.
- 78.
In a Memorandum entitled ‘Legislation on the Electronic Highway’ (1998), the Dutch government stated that the same norms have to be applied on-line as are applied offline. See Schellekens (2006), p. 3.
- 79.
For example, DDoS Attack (distributed denial of service attack–is an attempt to make a machine or network resource unavailable to its intended users) does not fit into any of the traditional crimes categories—it is not theft, burglary, or extortion.
- 80.
Reed (2010), p. 264.
- 81.
Ibid.
- 82.
Such position is upheld in the Explanatory Report of the Convention on Cybercrime. For example, it is stated: Articles 7–10 relate to ordinary crimes that are frequently committed through the use of a computer system. Most States already have criminalized these ordinary crimes, and their existing laws may or may not be sufficiently broad to extend to situations involving computer networks (for example, existing child pornography laws of some States may not extend to electronic images). Therefore, in the course of implementing these Articles, States must examine their existing laws to determine whether they apply to situations in which computer systems or networks are involved. If existing offences already cover such conduct, there is no requirement to amend existing offences or enact new ones. See Convention on Cybercrime, Explanatory Report, p. 79. http://conventions.coe.int/Treaty/en/Reports/Html/185.htm.
- 83.
Although the substantive law provisions relate to offences using information technology, the Convention uses technology-neutral language so that the substantive criminal law offences may be applied to both current and future technologies involved. Convention on Cybercrime, Explanatory Report, p. 36. http://conventions.coe.int/Treaty/en/Reports/Html/185.htm.
- 84.
Such a rule might be devised only for online activities and is therefore not necessarily aiming at equivalence online and offline. See Reed (2010), p. 249.
- 85.
It could be stated that criminal laws should avoid references to the concrete crime methods in the cyberspace (e.g. how the connection was made or in what method the damage to the information system was made), but the attention should be made to the result, which originates from such illegal activity (e.g. the activity caused a breach of the confidentiality of the information system or such system became unavailable to the users). See Marcinauskaite (2013), p. 28.
- 86.
The principle of legality is a core value, a human right but also a fundamental defence in criminal law prosecution according to which no crime or punishment can exist without a legal ground. The principle is often associated with the attempts to constrain states, governments, judicial, and legislative bodies from enacting on retroactive legislation, or ex post facto clauses and ensuring that all criminal behaviour is criminalized and all punishments established before the commencement of any criminal prosecution. See Crisan (2010), p. 2.
- 87.
A definition based on functional concepts implies that a definition is drafted in such a way that it describes the use or function of a technology, rather than referring to the technology itself. This way, a definition can “incorporate” the development of new technologies that can be used as substitutes for earlier ones. See van der Haar (2007), p. 23.
- 88.
Marcinauskaite (2013), p. 35.
- 89.
Kaiafa-Gbandi (2012), p. 60.
- 90.
Directive 2013/40/EU of the European Parliament and of The Council on attacks against information systems and replacing Council Framework Decision 2005/222/JHA, par. 9.
- 91.
Kaiafa-Gbandi (2012), p. 69.
- 92.
The Convention on Cybercrime, Article 3.
- 93.
Naziris (2014), p. 340.
- 94.
Kaiafa-Gbandi (2012), p. 65.
- 95.
The Criminal Code of the Republic of Lithuania, Art. 198.
- 96.
Naziris (2014), p. 341.
- 97.
Such a term was in the initial proposal but was not accepted by parties. See Note from Presidency to Council 8795/11. DROIPEN 27- TELECOM 43- CODEC 609, (8 Apr 2011) p. 6. http://db.eurocrim.org/db/en/doc/1512.pdf.
- 98.
See Macmillian dictionary. http://www.macmillandictionary.com/thesaurus/british/device#device_4.
- 99.
Convention on Cybercrime, Explanatory Report, p. 23. http://conventions.coe.int/Treaty/en/Reports/Html/185.htm.
- 100.
Note from Presidency to Council 8795/11. DROIPEN 27- TELECOM 43- CODEC 609, (8 April 2011) p. 2–3. http://db.eurocrim.org/db/en/doc/1512.pdf.
- 101.
- 102.
Note from Presidency to Council 8795/11. DROIPEN 27- TELECOM 43- CODEC 609, (8 April 2011) p. 4. http://db.eurocrim.org/db/en/doc/1512.pdf.
- 103.
Proposal for a Directive of the European Parliament and of the Council on attacks against information systems and repealing Council Framework Decision 2005/222/JHA (COM (2010) 517 final, 30.9.2010), pp. 7–8. http://ec.europa.eu/dgs/home-affairs/policies/crime/1_en_act_part1_v101.pdf.
- 104.
Ruling of Kaunas district court in Case No. 1A-94-175/2012, enacted on 22 Oct 2012.
- 105.
The question of jurisdiction, even though traditionally assigned to the general part of a substantial criminal law is not discussed as this issue is also closely connected with procedural issues.
- 106.
Naziris (2014), p. 341.
- 107.
Article 22 of the Criminal code of Lithuania states that an attempt to commit a criminal act shall be an intentional act or omission which marks the direct commencement of a crime or misdemeanour where the act has not been completed by reason of the circumstances beyond the control the offender. A person shall be held liable for an attempt to commit a criminal act according to paragraph 1 or 2 of this Article and an Article of this Code providing for an appropriate completed crime. A penalty imposed upon such a person may be commuted under Article 62 of this Code. See The Criminal Code of the Republic of Lithuania.
- 108.
States required to lower penalty up to 1 year or to establish alternative, provided in the Framework decision (from 1 up to 3 years of imprisonment). Note from Presidency to Council 8795/11. DROIPEN 27-TELECOM 43-CODEC 609, (8 Apr 2011) p. 3. http://db.eurocrim.org/db/en/doc/1512.pdf.
- 109.
Note from Presidency to Council 8795/11. DROIPEN 27- TELECOM 43- CODEC 609, (8 April 2011) pp. 2–3. http://db.eurocrim.org/db/en/doc/1512.pdf.
- 110.
Council Framework Decision 2005/222/JHA on attacks against information systems, Art. 6.
- 111.
- 112.
Directive 2011/36/Eu Of The European Parliament And Of The Council On preventing and combating trafficking in human beings and protecting its victims, and replacing Council Framework Decision 2002/629/JHA. (OJ L 101/1, 15.4.2011).
- 113.
Ibid., Art. 4.
- 114.
Kaiafa-Gbandi (2012), p. 69.
- 115.
The Criminal Code of the Republic of Lithuania, Art. 197.
- 116.
Kaiafa-Gbandi (2012), p. 71.
- 117.
Proposal for a Directive of the European Parliament and of the Council on attacks against information systems and repealing Council Framework Decision 2005/222/JHA (COM (2010) 517 final, 30.9.2010), p. 7–8. http://ec.europa.eu/dgs/home-affairs/policies/crime/1_en_act_part1_v101.pdf.
- 118.
The use of traditional forms of cooperation predominates for obtaining extra-territorial evidence in cybercrime cases, with over 70 % of countries reporting using formal mutual legal assistance requests for this purpose. Within such formal cooperation, almost 60 % of requests use bilateral instruments as the legal basis. Multilateral instruments are used in 20 % of cases. Response times for formal mechanisms were reported to be of the order of months, for both extradition and mutual legal assistance requests, a timescale which presents challenges to the collection of volatile electronic evidence. … Modes of informal cooperation are possible for around two-thirds of reporting countries, although few countries have a policy for the use of such mechanisms. It was also stated that due to the volatile nature of electronic evidence, international cooperation in criminal matters in the area of cybercrime requires timely responses and the ability to request specialized investigative actions, such as preservation of computer data. See Expert Group to Conduct a Comprehensive Study on Cybercrime, p. 10. http://www.unodc.org/documents/organized-crime/UNODC_CCPCJ_EG.4_2013/UNODC_CCPCJ_EG4_2013_2_E.pdf.
- 119.
Ibid.
- 120.
Convention on Cybercrime, Explanatory Report, p. 133. http://conventions.coe.int/Treaty/en/Reports/Html/185.htm.
- 121.
Council Framework Decision 2005/222/JHA on attacks against information systems; Directive 2013/40/EU of the European Parliament and of The Council on attacks against information systems and replacing Council Framework Decision 2005/222/JHA.
- 122.
Council Framework Decision 2008/978/JHA on the European evidence warrant for the purpose of obtaining objects, documents and data for use in proceedings in criminal matters (OJ L 350, 30.12.2008).
- 123.
Klimek (2012), p. 277.
- 124.
The main task of the European Cybercrime Centre is to disrupt the operations of organised crime networks that commit serious and organised cybercrime. Concretely, the EC3 supports and coordinates operations and investigations conducted by Member States' authorities in several areas. See European Cybercrime Centre. http://europa.eu/rapid/press-release_IP-14-129_en.htm.
- 125.
Media release: International cooperation key to fighting cybercrime, INTERPOL Global Complex for Innovation Director tells security meeting, 03 Apr 2013. http://www.interpol.int/News-and-media/News/2013/PR039.
- 126.
Article 32—Trans-border access to stored computer data with consent or where publicly available.
A. Party may, without the authorisation of another Party:
(a) access publicly available (open source) stored computer data, regardless of where the data is located geographically; or
(b) access or receive, through a computer system in its territory, stored computer data located in another Party, if the Party obtains the lawful and voluntary consent of the person who has the lawful authority to disclose the data to the Party through that computer system. See The Convention on Cybercrime, Budapest, 23.11.2001.
- 127.
The Convention on Cybercrime, Art. 32.
- 128.
The principle of national sovereignty does not generally permit a country to carry out investigations within the territory of another country, without permission from local authorities. Sovereignty is the legal expression of the territorial political community’s presumptive monopoly of the last word on internal public order. This entails more than merely the authority to give or withhold the consent to international legal obligations. Although the point is often misunderstood, sovereign authority continues to exist alongside legal obligation with respect to the very same subject matter. See Roth (2005). http://www.law.uga.edu/intl/roth.pdf.
- 129.
The Convention on Cybercrime, Article 32.
- 130.
Cloud computing and multi-jurisdictional crimes may challenge the traditional way of investigation and prosecution. Data in the “clouds” are data that are constantly being shifted from one server to the another, moving within or access different countries at any time. Also, data in the “clouds” may be mirrored for security and availability reasons, and could therefore be found in multiple locations within a single country or in several countries. Consequently, not even the cloud computing provider may know exactly where the requested data is located. INTERPOL European Working Party on Information Technology Crime (EWPITC)—Project on
cloud computing, 2011 in Schjolberg (2012). http://www.cybercrimelaw.net/documents/ICTC.pdf,p.10.
- 131.
Gercke (2012), p. 84. http://www.scribd.com/doc/206172213/18/Legal-challenges#page=9.
- 132.
Ibid.
- 133.
Expert Group to Conduct a Comprehensive Study on Cybercrime, p. 10. http://www.unodc.org/documents/organized-crime/UNODC_CCPCJ_EG.4_2013/UNODC_CCPCJ_EG4_2013_2_E.pdf.
- 134.
For example, in the Cybercrime Convention, the States had to establish jurisdiction over the crimes which were made in the state territory or by one of its nationals (Art. 22). See The Convention on Cybercrime. The Council Framework decision broadened jurisdiction including situations where the offence was committed for the benefit of a legal person that has its head office in the territory of the State (Art. 10). See Council Framework Decision 2005/222/JHA on attacks against information systems. The Directive corrected the cited Council Framework rule, establishing jurisdiction outside state territory where (a) the offender has his or her habitual residence in its territory; or (b) the offence is committed for the benefit of a legal person established in its territory. (Art. 12). See Directive 2013/40/EU of the European Parliament and of The Council on attacks against information systems and replacing Council Framework Decision 2005/222/JHA.
- 135.
The European Investigation Order (EIO) shall be a judicial decision issued by a competent authority of a Member State (‘the issuing State’) in order to have one or several specific investigative measure(s) carried out in another Member State (‘the executing State’) with a view to gathering evidence within the framework of the proceedings referred to in Article 4. Initiative of the Kingdom of Belgium, the Republic of Bulgaria, the Republic of Estonia, the Kingdom of Spain, the Republic of Austria, the Republic of Slovenia, and the Kingdom of Sweden for a Directive of the European Parliament and of the Council of … regarding the European Investigation Order in criminal matters, Official Journal of the European Union, 2010/C 165/02.
- 136.
Permanent Representatives Committee Confirms Agreement on European Investigation Order in Criminal Matters, 03 Dec 2013. http://www.eu2013.lt/en/news/permanent-representatives-committee-confirms-agreement-on-european-investigation-order-in-criminal-matters.
- 137.
Ibid.
- 138.
- 139.
Schjolberg (2012). http://www.cybercrimelaw.net/documents/ICTC.pdf.
- 140.
- 141.
Schjolberg (2012). http://www.cybercrimelaw.net/documents/ICTC.pdf.
- 142.
References
Books and Articles
Capus, N. (2007–2009). (Head of the research Project), Sovereignty and criminal law: the dual criminality requirement in international mutual legal assistance in criminal matters. Munich: Max Planck institute.
Choo, K.-K. R., & Grabosky, P. (2013). Cyber crime. In L. Paoli (Ed.), Oxford handbook of organized crime (pp. 1–31). Oxford: Oxford University Press.
Craig, P. (2010). The Lisbon treaty. Law, Politics and treaty reform. Oxford: Oxford University Press.
Crisan, I. (2010). The principles of legality “nullum crimen, nulla poena sine lege” and their role. Effectius Newsletter, 5, 1–3.
Gabrys, E. (2002). The international dimension of cyber crime. Part 1. Special issue coverage: Information warfare/cyber crime. Information Systems Security, 11(4), 21–32.
Gercke, M. (2011). Understanding cybercrime: A guide for developing countries. Geneva: International telecommunication union (Draft).
Gercke, M. (2012). Understanding cybercrime: phenomena, challenges and legal response. Geneva: International telecommunications union.
Gandhi, K. (2012). An overview study on cyber crimes in internet. Journal of Information Engineering and Applications, 2(1), 1–5.
Goodman, M. D., & Brenner, S. W. (2002). The emerging consensus on criminal conduct in cyberspace. UCLA Journal of Law and Technology, 6(1), 1–153.
Hale, C. (2002). Cybercrime: facts and figures concerning this global dilemma. Crime and Justice International.18(65).
Rao I. J. (2011). Cyber crimes: issues and concerns. Indian Stream Research Journal, 1(X), 111–115.
Kaiafa-Gbandi, M. (2012). Criminal attacks against information systems in the EU: The anticipated impact of the European legal instruments on the Greek legal order. European Journal of Crime, Criminal Law and Criminal Justice, 20(1), 59–79.
Klimek, L. (2012). Free movement of evidence in criminal matters in the EU. The Lawyer Quarterly, 4, 250–290.
Kshetri, N. (2010). Diffusion and effects of cyber-crime in developing economies. Third World Quarterly, 31(7), 1057–1079.
Kshetri, N. (2013). Cybercrime and cybersecurity in the global south. UK: Palgrave Macmillan.
Marcinauskaite, R. (2013). Criminal offences against the confidentiality of electronic data and information systems (Criminal Code of the Republic of Lithuania articles 198 and 198(1)). Doctoral Dissertation, Vilnius.
Naziris, Y. (2014). ‘A Tale of Two Cities’ in three themes—A critique of the European Union‘s approach to cybercrime from a “power” versus “rights” perspective. European Criminal Law Review, 3(3), 319–354.
Nye J. S., Jr. (2010). Cyber power, belfer center for science and international affairs, Harvard Kennedy School.
Peers, S. (2010). The proposed European investigation order: Assault on human rights and national sovereignty. Statewatch analysis.
Procedda, M. G. (2011). Transatlantic approaches to cybersecurity and cybercrime. In P. Pawlak (Ed.) The EU–US Security and Justice Agenda in Action. Chaillot Papers.
Reed, C. (2010). Online and offline equivalence: Aspiration and achievement. International Journal of Law and Information Technology, 18(3), 248–273.
Roth, B. R. (2005). State sovereignty, international legality, and moral disagreement, Updated Version of Paper Presented at the Panel on “Questioning the Aspiration to Global Justice” Annual Meeting of the American Political Science Association.
Schellekens, M. (2006). What holds off-line, also holds on-line? Starting Points for ICT Regulation, Deconstructing Prevalent Policy One-liners, IT and Law Series, 9, 51–75 (T.M.C. Asser Press: The Hague).
Schjolberg, S. (2012). An International Criminal Tribunal for Cyberspace (ICTC), Recommendations for potential new global legal mechanisms against global cyberattacks and other global cybercrimes. A paper for the East West Institute (EWI) Cybercrime Legal Working Group.
Shinder, D. L., & Cross, M. (2008). Scene of the cybercrime (2nd ed.). USA: Syngress Publishing Inc.
Sommer, P., & Brown, J. (2011). Reducing systemic cybersecurity risk, OECD/IFP Project on Future Global Shocks, Oxford: Oxford University.
Storm, P. (2013). The effect of negative publicity on consumer loyalty. Wageningen: Wageningen University and Research Centre.
Van der Haar, I. M. (2007). Technological neutrality; What does it entail? Tilburg Law and Economics Center (TILEC). Discussion Paper No. 2007-009, pp. 1–28.
Vasiu, I., & Vasiu, L. (2013). The cybercrime challenge: Does the Romanian legislation answer adequately? Law Review III, 2, 42–51.
Wakefield, M. (2012). International criminal tribunal for cybercrime and human rights, human rights brief: The center for human rights and humanitarian law.
Official Material
Commission of the European Communities, Growth, Competitiveness, Employment. (1993). The Challenges and Ways forward into the 21st Century. White Paper, (COM(93) 700, December 5 1993).
Communication from the Commission to the European Parliament, the Council and the Economic and Social Committee and the Committee of the Regions, Creating a safer information society by improving the security of information infrastructures and combating computer related crime, (COM(2000) 890 final, January 26 2001).
Communication from the Commission to the European Parliament, the Council and the Committee of the Regions, Towards a general policy on the fight against cybercrime, (COM (2007) 267 final, May 22 2007).
Convention on Cybercrime, Budapest, November 23 2001.
Convention on Cybercrime. Explanatory report. ETS 185, November 8 2001.
Council Framework Decision 2004/68/JHA on combating the sexual exploitation of children and child pornography. (Official Journal L.13, January 20 2004).
Council Framework Decision 2005/222/JHA on attacks against information systems, (OJ L69, February 24 2005).
Council Framework Decision 2008/978/JHA on the European evidence warrant for the purpose of obtaining objects, documents and data for use in proceedings in criminal matters (OJ L 350, December 30 2008).
Declaration of the European Union Ministers, Global Information Networks: Realising the Potential (July 6–8 1997, Bonn).
Directive 2000/31/EC of the European Parliament and of the Council on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market. (Official Journal L 178, July 17 2000).
Directive 2002/21/EC of the European Parliament and of the Council on a common regulatory framework for electronic communications networks and services. (March 7 2002).
Directive 2002/58/EC of the European Parliament and of the Council concerning the processing of personal data and the protection of privacy in the electronic communications sector. (Official Journal L 201/37, July 31 2002).
Directive 2006/24/EC of the European Parliament and of the Council on the retention of data generated or processed in connection with the provision of publicly available electronic communication services or of public communications networks and amending Directive 2002/58/EC. (Official Journal L 105, April 13 2006).
Directive 2011/36/Eu Of The European Parliament And Of The Council On preventing and combating trafficking in human beings and protecting its victims, and replacing Council Framework Decision 2002/629/JHA. (OJ L 101/1, April 15 2011).
Directive 2013/40/EU of the European Parliament and of The Council on attacks against information systems and replacing Council Framework Decision 2005/222/JHA, (OJ L 218, August 12 2013).
eEurope initiative and eEurope Action Plan (1999).
European Commission, Special Eurobarometer 390, Cyber security Report, (July 2012).
Initiative of the Kingdom of Belgium, the Republic of Bulgaria, the Republic of Estonia, the Kingdom of Spain, the Republic of Austria, the Republic of Slovenia and the Kingdom of Sweden for a Directive of the European Parliament and of the Council of … regarding the European Investigation Order in criminal matters, (Official Journal of the European Union, 2010/C 165/02).
Joint Communication To The European Parliament, The Council, The European Economic And Social Committee And The Committee Of The Regions, Cybersecurity Strategy of the European Union: An Open, Safe and Secure Cyberspace, (JOIN(2013) 1 final, February 7 2013).
Norton Cybercrime Report 2012.
Note from Presidency to Council 8795/11. DROIPEN 27- TELECOM 43- CODEC 609, (April 8 2011).
Ponemon Institute, 2013 Fourth Annual Cost of Cyber Crime Study: Global Proposal for a Directive of the European Parliament and of the Council on attacks against information systems and repealing Council Framework Decision 2005/222/JHA (COM (2010) 517 final, September 30 2010).
Proposal for a Directive of the European Parliament and of the Council concerning measures to ensure a high common level of network and information security across the Union. (COM(2013) 48 final, February 7 2013).
Proposal for a Regulation of the European Parliament and of the Council laying down measures concerning the European single market for electronic communications and to achieve a Connected Continent, and amending Directives 2002/20/EC, 2002/21/EC and 2002/22/EC and Regulations (EC) No. 1211/2009 and (EU) No. 531/2012.
Recommendations to the European Council, Europe and the global information society, The Bangemann Report (May 26 1994).
Report from the Commission to the Council based on Article 12 of the Council Framework Decision of 24 February 2005 on attacks against information systems (COM (2008)448 final, July 14 2008).
Symposium on the occasion of the signing of the United Nations convention against transnational organized crime, panel on “The challenge of borderless cyber-crime”, Palermo, Italy (December 14 2000).
The Lisbon Treaty, (Official Journal C 83, March 30 2010).
United Nations Manual on the prevention and control of computer-related crime (1990), International review of criminal policy.
Case Law: European Court of Justice
Case C-105/03 Criminal proceedings against Maria Pupino. Judgement of the Court (Grand Chamber) (16 June 2005).
Case Law: Kaunas District Court
Ruling of Kaunas district court in Case No. 1A-94-175/2012, enacted on October 22 2012.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2014 Springer International Publishing Switzerland
About this chapter
Cite this chapter
Gruodytė, E., Bilius, M. (2014). Investigating Cybercrimes: Theoretical and Practical Issues. In: Kerikmäe, T. (eds) Regulating eTechnologies in the European Union. Springer, Cham. https://doi.org/10.1007/978-3-319-08117-5_11
Download citation
DOI: https://doi.org/10.1007/978-3-319-08117-5_11
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-08116-8
Online ISBN: 978-3-319-08117-5
eBook Packages: Humanities, Social Sciences and LawLaw and Criminology (R0)