Управление ООН по наркотикам и преступности

The Council of Europe Conference on "Cybercrime: A Global Challenge, A Global Response"

Spain, Madrid, 12-13 December 2005

Globalization process in the information sphere has made possible the use of telecommunications networks for criminal purposes as well. Crimes in the telecommunications and computer information sphere continue to grow in number, the share of this type of criminal activity in the general crime picture also increases. Experts say that potential threats to information security will remain a considerable challenge during the next decade. Indeed, much has been said about that at this Conference.

The Council of Europe Convention on Cybercrime of 2001 is now the most important international legal instrument aimed at combating crime against computer security. Its adoption has become a major step in forming a legal basis for suppressing different types of criminal activity in cyberspace. An integrated approach to countering cybercrime used in the Convention is certainly one of its greatest strengths. Once launched, the mechanism of the Convention will provide a good starting point for consolidating States’ efforts against this dangerous phenomenon. However, the Convention can hardly be called a perfect instrument. Some of its provisions, such as Article 32, affect the fundamental principles of international cooperation, making it difficult for States to become full participants to the Convention. The general thrust of the Convention is nevertheless positive, since its entry into force help to unite States in their fight against the newest types of transnational crime, committed in cyberspace. The Convention will soon be signed by the Russian Federation.

The Convention represents one of the first attempts to codify the rules for combating cybercrime, which is an especially dangerous phenomenon owing to its scale and consequences for national and international security as well as its dynamics. I have more than to agree with what was said yesterday by the Minister of Justice of Spain, Mr. Juan Fernando Lopez Aguilar. Indeed that Convention is not a dead letter. The Convention is a living mechanism, which presupposes introduction of necessary changes to respond effectively to the new dynamic challenges. Moreover, in principle one instrument could hardly provide an adequate response to all criminal challenges in the computer sphere.

These dangerous trends include an active and growing use of computer space by terrorists for criminal purposes. The OSCE expert workshop "Combating the Use of the Internet for Terrorist Purposes" held this fall in Vienna noted the use of the World Wide Web to identify and recruit potential members of terrorist groups, collect and transfer funds, organize terrorist acts, including the training of those who commit them, as well as to incite terrorist actions, including through the use of propaganda.

Terrorist attacks against cybersecurity unrelated to the Internet have been reported as well, including the incident at Ignalinskaya nuclear power station in Lithuania in 1994. Members of a criminal group demanded the release of a convict from that country’s Government, threatening to blow up the station in case their demand is not met. No explosive device was found; it was reported, however, that the loading of nuclear fuel into the reactor had been halted due to a failure in the power station’s computer system Titan. The station was stopped. It was found out that a programmer bribed by the terrorists had infected the computer system with a virus that gained control over a station’s reactor and changed the speed parameters for inserting uranium rods into the active zone, which could trigger an uncontrolled nuclear reaction.

In this case, we witnessed preparations for a terrorist act to be committed through a computer system and by computer means.

In 1998, the computer system of the Bhabha Atomic Research Center in India was attacked by terrorists, who explicitly threatened to damage the control system of the reactor, which could lead to the latter’s explosion.

In 1996, the Liberation Tigers of Tamil Eelam carried out a network attack (by e-mailing a computer virus) against the diplomatic missions of Sri Lanka. The embassies’ servers were overwhelmed with thousands of spam messages, which caused a temporary communication blackout.

Experts say that terrorists use e-mail to transmit encrypted instructions, maps, charts and passwords. There were even cases of terrorists’ using sport or sex chat sites to hide the photographs of their future victims. Another terrorist trick is to add encrypted messages or instructions to usual photographs.

Terrorists use the Internet to mastermind their acts, as evidenced by the discovery in Al Qaida laptops found in Afghanistan of electronic models of dams and computerized water supply systems, nuclear power stations and stadiums in the United States and Europe.

Other examples of terrorists using cyberspace might also be found. However, more important is whether States have adequate international legal instruments to respond effectively to these extremely dangerous challenges.

It is hardly possible to give an exhaustive answer to this question in a brief statement. However, I would take this opportunity to make certain comments with a view to facilitate formulation of common approaches to the problem of cyberterrorism.

This type of terrorism could be roughly defined as the intentional use or threat of use of electronic information systems for the perpetration of terrorist acts inspired by certain motives (e.g., political, ideological or religious) with the aim to cause death or serious bodily injury, serious material damage, create a state of fear, compel a government or an international organization to do or to abstain from doing any act.

The questions of whether or not the legal notion of cyberterrorism exists and whether or not it should be established in international law are not purely academic. The answers to them will greatly affect the search for adequate and proactive ways to prevent the use of cyberspace for terrorist purposes.

If the notion of cyberterrorism has the right to exist, then a system of measures to address this dangerous form of contemporary terrorism needs to be set up, together with a corresponding international legal framework. It means a systemic approach, that is, that the fight against cyber manifestations of terrorism should be in line with the whole set of efforts taken by States and be consistent with generally recognized international norms and criteria for fighting terrorism.

For the time being the international law does not provide any systematic response to the new challenge of cyberterrorism. The notion itself has not been codified yet, and its components, in their entirety, have not been criminalized at the international level. It blocks the elaboration of a coordinated international approach to countering cyberterrorism.

Of course, numerous provisions of the Convention on Cybercrime can be applied in this respect. It does not offer, however, any systematic response to the threats of cyberterrorism. This phenomenon as such has not been criminalized; there is no definition of terrorist intentions, without which criminal sanctions would hardly commensurate with the terrorist threat of this criminal act.

The systemic antiterrorist approach provides qualitatively new forms of cooperation, including for the prosecution of cyberterrorists. Convention on Cybercrime does not incorporate, for instance, provisions excluding fully impunity of a person, who has committed an illegal act. However, this is against the basic principle of the fundamental antiterrorist conventions, including those adopted within the Council of Europe, which envisage the rule of "aut dedere aut judicare" with a view to bring an alleged offender to justice. This mechanism prescribed in para 6, Art. 24 of the Convention on Cybercrime in fact has a limited scope. As it is said in the Explanatory Report to the Convention, "if no extradition request has been made, or if extradition has been denied on grounds other than nationality, this paragraph establishes no obligation on the requested Party to submit the case for domestic prosecution". It concerns as well cases of denial to extradite with a reference to a political character of this type of terrorist offences. It is worth reminding that for the purposes of criminal prosecution, antiterrorist treaties, including those of the Council of Europe, traditionally do not regard terrorist offences as ones of a political character. Unfortunately, the Council of Europe Convention on Cybercrime does not include this provision.

Considering the special danger of terrorist use of global cybernets, it would be useful to develop international legal provisions allowing the seizure and confiscation of equipment and other tools with which cyberterror crimes are perpetrated.

Should any decision be made to establish an international legal base to combat cyberterrorism, it would be advisable to develop a single document to avoid duplication as well as the risk of gaps and inconsistencies connected with the regulation of certain aspects of this issue in various international instruments. Arguments such as those that responses to the threat of cyberterrorism could be found through the combined application of the Council of Europe conventions on Cybercrime (2001) and on the Prevention of Terrorism (2005) can hardly be justified. Those treaties advocate not only different legal approaches (including criminal prosecution); they, rather, may also differ as to the range of their Parties.

The above considerations do not in any way prejudge the issue of the development of a new international legal instrument in this area. It is for the States to give a final answer to this question. I hope that an independent expert report which is scheduled to be completed early next year under the auspices of the CDPC would help to achieve balanced decisions in the light of recommendation 1706 (2005) taken by the PACE. In particular, an additional protocol to the Convention on Cybercrime could be developed in this context, or any other international instrument.

At the same time, I would like to express my hope that the above considerations are in favor of establishing a common international legal "denominator" against the use of cyberspace by terrorists, including through closing everywhere the moving web-sites of international terrorist groups.

Creation of a necessary set of international instruments would provide an important step towards implementation of the UN Security Council antiterrorist resolutions, including 1373 (2001), 1566 (2004), and 1624 (2005), aimed at depriving terrorists of material and ideological support, as well as effectively suppressing incitement to terrorism, and its apologie in general.

May I express my hope that our Conference will make a contribution to the implementation of those objectives.

Thank you.