CoE "cybercrime" convention: legitimising internet surveillance
01 November 2000
We believe the that the draft [CoE cybercrime] treaty is contrary to well established norms for the protection of the individual, that it improperly extends the police authority of national governments, that it will undermine the development of network security techniques, and that it will reduce government accountability in future law enforcement conduct. Global Internet Liberty Campaign (GLIC)
In April 2000 the Council of Europe (CoE) released its draft convention on "crime in cyberspace", a legally-binding international treaty aimed at harmonising criminal law and procedural aspects of "offending behaviour directed against computer systems, networks or data" and "other similar abuses". Despite widespread criticism by privacy and civil liberties groups, internet security experts, business representatives and the International Group on Data Protection in Telecommunications (comprised of national data protection commissioners), successive drafts of the convention have conceded very little in the face of law enforcement demands.
The CoE Convention can not be considered alone. In the UK, the RIP Bill (see Statewatch vol 10 no 1) paved the way for extensive surveillance of all electronic communications. Then last month, the Home Office announced £37 million funding for the integration of all police computer systems and £25 million to set up a cybercrime unit of 46 officers. This was closely followed by an announcement that the UK intelligence services want to oblige all telecommunications and internet service providers to maintain all their traffic data records (every phone call, fax, telex, page, e-mail or internet connection) for at least seven years (see feature on page 1). Meanwhile, the G8, EU, UN and OECD have provided a discreet range of venues to ensure the fight against cybercrime is coordinated internationally.
The proposed CoE convention
The convention is aimed at "cyber-criminals and cyber-terrorists", "attacks against commercial websites", "hacking", "illegal interception of data", "computer related fraud and forgery", child-pornography and copyright offences. However, what the convention as drafted can achieve in terms of tackling evident cybercrimes such as damaging computer "viruses", child-porn, or (high-profile) hacking has been questioned in some quarters.
Work on the CoE Convention began in 1997 with the accompanying press-release encouraging interested parties to "share their comments with the experts involved in the negotiations before the adoption of the final text". Countries that ratify the convention will have to incorporate its definitions and offences into their domestic criminal law (chapters I and II), and will be bound by mutual legal assistance provisions obliging signatory states to cooperate with one another (chapter III). In June of this year, Justice Ministers from the 41 CoE member-states adopted a resolution to open the convention for world-wide signature.
The draft convention sets out very broad definitions extending its potential scope from internet based "cybercrime" to anything involving a personal computer. A "computer system" means any computer and "computer data" everything that is held on a computer. "Service providers" are "any public or private entity" that provide "the ability to communicate by means of a computer" (covering every system from AoL to an office network). "Traffic data" is an entire chain of communications from any "computer system", including "origin, destination, path or route, time, date, size, duration, or type". "Subscriber information" means any other data relating to "subscribers of its service" (including visitors to a website or users of a network) which can establish their "identity, address, telephone number" or "location". Most of the powers deferred upon the "competent authorities" of states that adopt the convention can be used for the all-embracing and unlimited "purpose of criminal investigations or proceedings".
Cyber-c