International Cooperation on Criminal Justice in Cyberspace: Where we are and where are we heading to?

Event report

This session continued cybercrime discussions at EuroDIG. It discussed the 2022 developments in regulatory efforts to address cybercrime: the second Additional Protocol to the Budapest Convention, the negotiations on a UN treaty on cybercrime, and the European Union AI Act proposal that regulates the use of AI for law enforcement purposes.

The second Additional Protocol to the Budapest Convention

Mr Markko Kunnapu (Member of the Cybercrime Convention Committee; Vice-Chair, Ad Hoc Committee to Elaborate a Comprehensive International Convention on Countering the Use of Information and Communications Technologies for Criminal Purposes) noted that the protocol would not replace the Cybercrime Convention; rather, it would provide some additional tools. 

The Budapest Convention provides for mutual legal assistance, which means that authorities in the requested state, where the service provider and possibly the person whose data is sought reside, are involved in the process and that the process happens according to procedures under the domestic law where the service provider is established. That guarantees that fundamental rights safeguards can be upheld, double criminality checks made, and privileges and immunities (for instance for lawyers and doctors) respected.

The second Additional Protocol makes changes, as Mr Jesper Lund (Chairman IT-Pol Denmark, Member of European Digital Rights (EDRI)) explained. Articles 6 and 7 provide for direct requests from law enforcement authorities to service providers, without involvement of domestic authorities. The EDRI considers this to be a big difference from the mutual legal assistance regime; no checks of fundamental rights or double criminality would occur. Additionally, a production order could be issued in cases where it is not possible under the rules of the domestic law.

Some safeguards are planned. For example, it is possible for states to require notification so they have an opportunity to get involved and possibly refuse some production orders. However, no automatic protocol guarantees that this will happen and it does not necessarily have a suspensive effect. Therefore service providers may respond before domestic authorities have a chance to evaluate the production order from another state.

Lund also noted that while Articles 6 and 7 apply only to subscriber information and domain registry information, revealing this data could be problematic in case of, for example, revealing the identity of an anonymous speaker guilty of political crimes.

Further, data protection service writers can receive production orders from law enforcement authorities in states outside the EU. The protection of data in the case of a third country transfer is tricky in the EU case, as it requires a special legal basis in the GDPR. The signature protocol tries to provide for that with its article 14; however, EDRI  considers it to be a relatively lightweight data protection regime.

The EDRI has called upon the European Parliament to request an opinion from the Court of Justice whether the second Additional Protocol is at all compatible with the primary law of the EU, since:

• no automatic assessment of data protection occurs in third countries that may be parties to the Budapest Convention and the second Additional Protocol 
• data subject rights are dependent on domestic law that may not be essentially equivalent to EU law
• the possibility for data position authorities to suspend transfers to third countries are more limited than we think they should be 

Kunnapu noted that the Council of the European Union has authorised EU member states to sign the protocol. Almost every article and every measure has certain possibilities for reservations and declarations, and in case EU member states wish to ratify the protocol, they must make certain reservations and declarations to ensure that the implementation of the protocol would be in line with EU law. The protocol is not in force yet, Kunappu reminded, as five more ratifications are needed.

UN treaty on cybercrime

A treaty on a global level with 193 member states is a different endeavour than regulating or negotiating a treaty on a regional level: on the regional level more agreement may occur regarding certain jurisdictional questions, whereas on a global level additional questions such as cultural values and certain understandings as to what could be regulated and what should not be regulated must be resolved. Ms Isabelle Brunner (Cybercrime Officer, United Nations Office on Drugs and Crime (UNODC)) pointed out that while divergences remain, the more in-depth discussions take place and in-depth questions are raised, the more convergences arise.

Harmonisation of what would be considered a cybercrime offence, what would be the minimum standards for procedural law, and minimum standards for international cooperation is possible, Kunappu stated. Much flexibility needs to be left up to individual member states as they have to decide on the domestic rules/laws concerning what would be considered as evidence, what are the rules related to admissibility of evidence, what are the practices/rules for digital forensics.

Kunappu and Brunner agreed that even if a global treaty was formed on the basis of a minimum common denominator, the treaty will be valuable because of its global nature. They both confirmed that participating countries will be able to deviate from the common minimum.

Brenner explained that the Ad Hoc Committee allows multistakeholder participation of: UN institutions and intergovernmental bodies, NGOs with economic and social council (ECOSOC) consultative status, and the OP9 category, which is found in paragraph 9 of that resolution. The latter includes all other NGOs that do not have an ECOSOC status, but are interested in participation. NGOs from the OP9 category must register their intent to participate, which is then voted upon in the organisational session of the Ad Hoc Committee. These stakeholders can participate in intersessional multi-stakeholder consultations and explain their views about the process.

No stakeholder who now has an interest in participation can join unless they are either intergovernmental organisations or NGOs with ECOSOC status. However, Brenner invited stakeholders to express their interest in participating at cybercrimehc@un.org, and did not exclude the possibility of opening the call for registration again.

The interplay between the Budapest Convention and the UN treaty

Speaking about the interplay between the Budapest Convention and the new UN treaty, Kuannpu suggested that if a state needs to cooperate with other countries who are not parties to the Budapest Convention then the new UN treaty could be used as the basis of the cooperation. Some elements of the UN convention could overlap or may be similar to the Budapest Convention, but the text would not be identical because the audience, the number of member states, and the views and expectations of UN member states are different. The new UN convention could overlap with the Budapest Convention, Kunappu stated. In his opinion, such an overlap will not pose a problem, but would rather add to the complementarity between the two instruments.

Where are we heading in terms of international cooperation on criminal justice in cyberspace?

While the second Additional Protocol is awaiting new signatures, implementation of the protocol is being analysed, Kunappu stated. It is quite complicated and might require a change in different legislative acts; not only those related to criminal procedure, but those also related to electronic communications, information society services, and other elements. Lund noted that EDRI views the second additional protocol as a test bed of what can be achieved for member states of the EU.

The Ad Hoc Committee has a tight schedule, Kunappu noted, discussions will be quite difficult, and the hardest part is still ahead of us. Brenner noted that we need to be careful to make sure that the UN treaty does not clash with other international provisions, yet at the same time the UN treaty is not likely to go into more detail than already existing conventions.

When we formulate minimum standards on the most important elements such as substantive law, procedure law, conditions, and then safeguards, the whole framework would provide added value and could be used effectively for international cooperation purposes.

By Andrijana Gavrilovic