Comprehensive Study on Cybercrime - United Nations …

1 Comprehensive Study on CybercrimeDraft February 2013 Front cover photo credits (left to right): Nations OFFICE ON DRUGS AND CRIMEV iennaComprehensive Study on CybercrimeDraftFebruar y 2013 United NATIONSNew York, 2013 United Nations , February 2013. All rights reserved worldwide. Copyright 2013, United Nations Office on Drugs and Crime ACKNOWLEDGEMENTS This report was prepared for the open-ended intergovernmental expert group on Cybercrime by Conference Support Section, Organized Crime Branch, Division for Treaty Affairs, UNODC, under the supervision of John Sandage (Director, Division for Treaty Affairs), Sara Greenblatt (Chief, Organized Crime Branch), and Gillian Murray (UNODC Senior Focal Point for Cybercrime and Chief, Conference Support Section).

2 Study team: Steven Malby, Robyn Mace, Anika Holterhof, Cameron Brown, Stefan Kascherus, Eva Ignatuschtschenko (UNODC) Consultants: Ulrich Sieber, Tatiana Tropina, Nicolas von zur M hlen (Max Planck Institute for Foreign and International Criminal Law) Ian Brown, Joss Wright (Oxford Internet Institute and Cyber Security Centre, University of Oxford) Roderic Broadhurst (Australian National University) Kristin Kr ger (Brandenburg Institute for Society and Security) DISCLAIMERS This report is a draft prepared for the second meeting of the open-ended intergovernmental expert group on Cybercrime and should not be cited without permission of UNODC.

3 This report has not been formally edited and remains subject to editorial changes. The contents of this report do not necessarily reflect the views or policies of UNODC or contributory organizations and neither do they imply any endorsement. The designations employed and the presentation of material in this report do not imply the expression of any opinion whatsoever on the part of UNODC concerning the legal status of any county, territory or city or its authorities, or concerning the delimitation of its frontiers and boundaries. iii CONTENTS ABBREVIATIONS .. v INTRODUCTION .. ix KEY FINDINGS AND OPTIONS .. xi EXECUTIVE SUMMARY .. xvii CHAPTER ONE: CONNECTIVITY AND Cybercrime .

4 1 The global connectivity 1 Contemporary Cybercrime .. 4 Cybercrime as a growing challenge .. 6 Describing 11 CHAPTER TWO: THE GLOBAL PICTURE .. 23 Measuring Cybercrime .. 23 The global Cybercrime picture .. 25 Cybercrime perpetrators .. 39 CHAPTER THREE: LEGISLATION AND FRAMEWORKS .. 51 Introduction The role of law .. 51 Divergence and harmonization of laws .. 56 Overview of international and regional instruments .. 63 Implementing multilateral instruments at the national level .. 72 CHAPTER FOUR: CRIMINALIZATION .. 77 Criminalization overview .. 77 Analysis of specific offenses.

5 81 International human rights law and criminalization .. 107 iv CHAPTER FIVE: LAW ENFORCEMENT AND INVESTIGATIONS .. 117 Law enforcement and Cybercrime .. 117 Investigative powers overview .. 122 Privacy and investigative measures .. 134 Use of investigative measures in practice .. 142 Investigations and the private sector .. 144 Law enforcement capacity .. 152 CHAPTER SIX: ELECTRONIC EVIDENCE AND CRIMINAL JUSTICE .. 157 Introduction to electronic evidence and digital forensics .. 157 Capacity for digital forensics and electronic evidence handling .. 162 Cybercrime and the criminal justice system .. 168 Criminal justice capacity.

6 172 Capacity building and technical assistance .. 178 CHAPTER SEVEN: INTERNATIONAL COOPERATION .. 183 Sovereignty, jurisdiction and international cooperation .. 183 Jurisdiction .. 189 International cooperation I formal cooperation .. 197 International cooperation II informal cooperation .. 208 Extra-territorial evidence from clouds and service providers .. 216 CHAPTER EIGHT: PREVENTION .. 225 Cybercrime prevention and national strategies .. 225 Cybercrime awareness .. 234 Cybercrime prevention, the private sector and academia .. 239 ANNEX ONE: ACT DESCRIPTIONS .. 257 ANNEX TWO: MEASURING Cybercrime .

7 259 ANNEX THREE: PROVISIONS OF INTERNATIONAL AND REGIONAL INSTRUMENTS .. 267 ANNEX FOUR: THE INTERNET .. 277 ANNEX FIVE: METHODOLOGY .. 283 LIST OF ABBREVIATIONS v LIST OF ABBREVIATIONS Abbreviations CERT Computer Emergency Response Team CSIRT Computer Security Incident Response Team ECHR European Convention for the Protection of Human Rights and Fundamental Freedoms ECtHR European Court of Human Rights EU European Union EUROPOL European Police Office G8 group of Eight GDP Gross domestic product HDI Human Development Index ICCPR International Covenant on Civil and Political Rights ICCPR-OP2 Second

8 Optional Protocol to the International Covenant on Civil and Political Rights, aiming at the abolition of the death penalty ICERD International Convention on the Elimination of All Forms of Racial Discrimination ICESCR International Covenant on Economic, Social and Cultural Rights ICRMW United Nations International Convention on the Protection of the Rights of All Migrant Workers and Members of Their Families ICT Information and communications technology INTERPOL International Criminal Police Organization IP Internet protocol ISP Internet service provider IT Information technology ITU International Telecommunication Union NFC Near field communication OP-CRC-SC Optional Protocol to the Convention on the

9 Rights of the Child on the sale of children, child prostitution and child pornography P2P Peer-to-peer SCO Shanghai Cooperation Organisation SMS Short message service TRIPS Agreement on Trade Related Aspects of Intellectual Property Rights UNESCO United Nations Educational, Scientific and Cultural Organization UNODC United Nations Office on Drugs and Crime UNSC United Nations Security Council URL Uniform Resource Locator USB Universal serial bus VGT Virtual global taskforce WEF World Economic Forum vi List of international and regional instruments and short names African Union, 2012.

10 Draft Convention on the Establishment of a Legal Framework Conductive to Cybersecurity in Africa (Draft African Union Convention). Common Market for Eastern and Southern Africa (COMESA), 2011. Cybersecurity Draft Model Bill. (COMESA Draft Model Bill). The Commonwealth, 2002. (i) Computer and Computer Related Crimes Bill and (ii) Model Law on Electronic Evidence (Commonwealth Model Law). Commonwealth of Independent States, 2001. Agreement on Cooperation in Combating Offences related to Computer Information (Commonwealth of Independent States Agreement). Council of Europe, 2001. Convention on Cybercrime and Additional Protocol to the Convention on Cybercrime , concerning the criminalisation of acts of a racist and xenophobic nature committed through computer systems (Council of Europe Cybercrime Convention/Protocol).