State of the Practice of Computer Security Incident Response Teams ...

enabling better cooperation and assistance between nations during the course of computer
crime investigations involving systems in different jurisdictions.
On the international front, the Council of Europe 124 worked for over four years to draft a
Convention on Cybercrime (ETS no. 185), 125 which was adopted by the Committee of Ministers
of the Council of Europe and opened for signatures in 2001. Although this Convention
has not yet entered into force as of this writing (it is still awaiting ratification in 2003), this is
the first international treaty focused on computer crimes. The chapters in the Convention on
Cybercrime include measures to be taken at the national level (by each party acceding to the
treaty) on both substantive criminal law (defining certain criminal offenses, to allow national
laws to be harmonized) and procedural law (defining investigation and criminal prosecution
methods appropriate to a computer environment and enabling national criminal procedures to
be brought more closely into line with each other). The criminal offenses defined in the Convention
include
• offences against the confidentiality, integrity and availability of computer data and systems
(illegal access; illegal interception; data interference; system interference; and misuse
of devices)
• computer-related offences (computer-related forgery; and computer-related fraud)
• content-related offences (offences related to child pornography)
• offences related to infringements of copyright and related rights
The CoE Convention on Cybercrime also addresses principles relating to international cooperation
and mutual assistance (including setting up a 24x7 point of contact for facilitating
investigations of computer crimes). In 2003, the first Additional Protocol to the Convention
on Cybercrime (ETS no. 189) 126 was opened for signatures, which would extend the Cybercrime
Convention’s scope to also criminalize acts of a racist or xenophobic nature committed
through computer systems.
The European Union (EU 127 ) has also taken steps to fight high-tech crime and illegal content
on the Internet. 128 In 1999, the EU adopted a four-year funding program, the Safer Internet
Action Plan, or IAP (Decision No. 276/1999/EC 129 ) “on promoting safer use of the Internet
by combating illegal and harmful content on global networks”; an amendment (Decision No.
124
125
126
127
128
129
. The European Union’s three primary decision-making bodies are the European
Parliament, the Council of the European Union, and the European Commission. See The
European Union at a glance , and Institutions of the European
Union .
116 CMU/SEI-2003-TR-001