Jurisdictional issues and international co-operation in

combating cybercrime

Anne FlanaganInstitute for Computer and Communications Law

Centre for Commercial Law Studies, Queen Mary, University of London

Introductory Remarks

Transnational crime– Perpetrators, victims, evidence

e.g. UK airline bombers & Yahoo! emails

Jurisdiction– Material & procedural (whether)– Extra-territorial– Resolving conflicts (which)

‘Double jeopardy’ principle

Co-operation– Formal & informal

Jurisdiction: General principles

Jurisdiction to prescribe, adjudicate & enforce– All based on territorial sovereignty

Where the actus reus completed– Initiatory and terminatory elements

Where the ‘last act’ or ‘substantial part’– civil law principle lex loci delicti commissi

Statutory provision

Content crimes– e.g. hate speech, child pornography, copyright

Jurisdictional conduct: ‘publish’, ‘supply’, ‘make available’..…– e.g. Waddon (2000): “..there can be publication on a Web site abroad,

when images are there uploaded; and there can be further publication when those images are downloaded elsewhere.”

Computer-related crimes– EU Framework Decision ‘combating fraud’ (2001)

“in whole or in part within its territory…”

– instructions ex parte Levin [1996] 4 All ER 350

Statutory provision

Computer integrity crimes– EU Framework Decision ‘attacks against information

systems’ (2001) “in whole or in part within its territory…”

– e.g. Computer Misuse Act 1990: “at least one significant link”

the accused, the computer or the unauthorised modification

– US: ‘protected computer’ (18 U.S.C § 1030(e)(2)(B)) “located outside the United States that is used in a manner that

affects interstate or foreign commerce or communication of the United States”

Extra-territorial application of jurisdiction

Principles– ‘active personality’ principle: the offender is a national of the territory;– ‘passive personality’ principle: the victim is a national of the territory;

– ‘protective' principle’: in order to safeguard the national interest;

– ‘universality’ principle: international crimes

Law– Convention, art. 22(1)(d); Framework Decision, art. 10(1)

(b) “by one of its nationals”

Problems

Jurisdictional conflicts

Convention, art. 22(5): – ‘When more than one Party claims jurisdiction over an alleged

offence….the Parties involved shall, where appropriate, consult with a view to determining the most appropriate jurisdiction for prosecution’

Eurojust Guidelines (2003)– Timing?

As soon as possible!

– Whom? Senior prosecutors

Jurisdictional conflicts

– Criteria? Presumption: majority of criminality occurred or loss sustained Relevant factors

– Location of accused, e.g. possibility of extradition or transfer of proceedings

– Attendance of witnesses

– Impact of delays on fairness of trial

– Interests of victims, e.g. possibility of compensation

– Availability of evidence, e.g. location & admissibility Non-relevant or secondary considerations

– Relative penalties available

– Ability to recover proceeds of crime

Remote investigations

Legality of law enforcement action– exercise of power

e.g. Schengen Convention re: ‘hot surveillance’ e.g. Convention on Mutual Assistance in Criminal Matters (2000)

– ‘remote control’ (art. 19) and ‘spillover’ (art. 20)

– data access & obtaining e.g. United States v. Gorshkov (2001)

Cybercrime Convention– Art. 18: ‘possession or control’– Art. 32: ‘open source’

publicly available (open source) lawful and voluntary consent

International co-operation

Moving evidence: Mutual Legal Assistance– General principles

‘letter rogatory’ in respect of proceedings or an investigation ‘specialty principle’ ‘dual criminality’ principle not applicable, except where it involves the

use of search and seizure powers

– EU Framework Decision (2008) ‘European Evidence Warrant’

– Only for existing data & documents

– Provision in 60 days or less, inc. ‘computer-related crime’ 2005 Proposal: ‘principle of availability’

– Obtaining access to foreign LEA databases

International co-operation

Moving people: Extradition– Lengthy process

e.g. Levin (2 yrs) and McKinnon (since November 2002)

– ‘dual criminality’ principle e.g. Cybercrime Convention: “by deprivation of liberty for a

maximum period of at least one year, or by a more severe penalty.”

Exception for ‘European Arrest Warrant’ countries

– obligation to prosecute: ‘aut dedere aut judicare’ EU Decision, art. 10(3) & Convention, art. 22(3)

LEA co-operation

24/7 networks Legal basis

– Convention, art. 35, EU Framework Decision, art. 11

Institutional basis– G8 (55 countries), Interpol National Central Reference Points

(122 countries)

Features– English-speaking, technically & legally competent

Urgent investigations & preservation of evidence

– Early warning system

Concluding remarks