Eight Reasons the International Cybercrime Treaty Should
be Rejected
The International Cybercrime Convention: What It Is
In November 2001, the members of the Council of Europe signed an extraordinarily broad new
treaty to increase cooperation among law enforcement officials of
different nations.Officially, this Cybercrime Convention was drafted by the
43-member Council of Europe, with the U.S., Canada, Japan and other
countries participating as “observers.” In reality, American law
enforcement officials have been among the primary drivers behind the
treaty.
The Cybercrime Convention does three major
things:
- It includes a list of crimes that each member country must have on
its books. The treaty requires criminalization of offenses such as
hacking, the production, sale or distribution of hacking tools, and
child pornography, and an expansion of criminal liability for
intellectual property violations (Articles 2-11).
- It requires each participating nation to grant new powers of search and seizure
to its law enforcement authorities, including the power to force
an ISP (Internet Service Provider) to preserve a citizen's internet usage records or
other data, and the power to monitor a citizen's online activities in
real time (Articles 16-22).
- It requires law enforcement in every participating country to
assist police from other participating countries by cooperating with
"mutual assistance requests" from police in other participating
nations "to the widest extent possible" (Articles 23-35).
The 8 reasons this treaty should be rejected
This is a bad treaty, and
nations should not sign or ratify it. There are 8 main problems with the
agreement:
Reason #1: The treaty lacks privacy and civil liberties
protections
The treaty
lacks meaningful privacy or civil liberties restraints. For
example, unlike other international law enforcement agreements
(including the Interpol, Europol and Schengen agreements), this treaty
includes no provisions to protect citizens' privacy. In fact, the
word "privacy" doesn't appear once in any of the convention's
articles.1 The treaty also requires ISPs to cooperate
with searches and seizures of data without requiring police to reimburse
them for the costs of that cooperation.2 Not only is that an
unfair burden on the ISPs, but by making searches free for the police, it
encourages them to use that power indiscriminately. That undermines one of
the most important checks and balances of a democratic system: the control
over law enforcement that most legislatures maintain through their
budgetary "power of the purse."
Reason #2: The treaty is far too broad
Like a monster, the treaty has vastly outgrown its
original mission of helping coordinate enforcement of cross-border
cybercrimes. Now the treaty covers not only computer-related crimes, but
any crime where the evidence could be in computerized form.3
As computers become more and more intertwined with modern life, this
treaty's problems will apply to a larger and larger proportion of all
crimes. Eventually even muggers will all have Internet-ready handheld computers.
Foreign police can't require law enforcement in most nations to search the
home of someone who hasn't violated any domestic laws; why should they be
able to order a search of his computer records? The Convention's
broad reach means that despite the treaty's name, all its flaws would soon
apply not just to a few specialist hackers, but to the whole fabric of
society.
Reason #3: The treaty lacks a "dual criminality" requirement for
cooperation with the police of other nations
Law
enforcement officials in a particular nation would
be forced under this treaty to cooperate with investigations of behavior that is
illegal in another country but perfectly legal within their borders.
That is because the treaty lacks a "dual criminality" provision
that would require an activity to be a crime in both countries
before one nation could enlist the police in another to help investigate. The
result: law enforcement agencies -- and thus ISPs --
would be forced to cooperate with foreign authorities in conducting
surveillance on citizens in their native country who have committed no
crime under their own laws.
Worse, some of those mutual
assistance requests will come from countries that have minimal civil
liberties protections. The Convention includes not only Council of Europe
members like Ukraine and Bulgaria, but will also over time be opened to
China and other non-democratic nations.
Reason #4: Protection for political activities is too weak
The
absence of a dual criminality requirement will inevitably result in the
treaty being used to force one nation to cooperate in politically
inspired investigations by another. While there are some exceptions
in the treaty, which allow a signatory to refuse to cooperate because the
offense being investigated is "political," these exceptions are far too
limited and won't even apply to many of the most significant
requests. For example, the exemption for offenses that are "political"
in nature was not included in the section requiring real-time data
monitoring.4 That means that law enforcement in, for example, England,
could be required under this treaty to order an ISP to spy on a Ukrainian
political dissenter, a Latin American union organizer, or a U.S. veteran
who sold a Nazi helmet over eBay. In addition, the term "political offenses"
is not defined - a huge omission since an offense that is considered
political in one nation might be a criminal matter in another. Even
worse, official assistance in many cases could be authorized solely by law
enforcement without judicial approval or oversight.5 A law
enforcement agency could decide on its own that an offense isn't
political, and initiate surveillance. And since the treaty doesn't even
have a reporting requirement (requiring instances of cooperation with
other countries on foreign crimes to be made public), law enforcement
decisions on this sensitive issue may never be subject to civilian check
or oversight.
Reason #5: The treaty threatens to further unbalance intellectual
property law
The treaty's
vague and obscure intellectual property provisions would significantly
expand criminal liability for intellectual property violations
and further tilt copyright law away from the
public interest. It also appears to make copyright violations into extradictable
offenses. Intellectual property law in the U.S. and many other
nations is a delicate balance between the rights of intellectual
propertyholders and the rights of the public. But this treaty
declares simply that copyright infringement would be criminalized,6 with
no mention of counterbalancing rights that, for example, permit
copyrighted material to be used for parodies, criticism, and scholarly
analysis.
Reason #6: The treaty would give police invasive new surveillance
powers
The treaty would require signatory nations to authorize the use
of devices like Carnivore, the "Internet-tapping" surveillance system
being used in the United States by the FBI.7 Technologies such as
Carnivore eliminate the phone company as a mediating institution and allow
law enforcement agents direct access to ISPs' entire networks for
surveillance, with only their unsupervised self-restraint preventing them
from inspecting the vast flow of other data in the network. Unfortunately,
the history of government agencies in respecting privacy does not inspire
faith. In the United States, the statutory
authority for Carnivore is unclear, and the treaty's authorization of such
devices would undercut existing law - as well as collide with the U.S.
Constitution's Fourth Amendment, with its guarantee against "unreasonable
searches and seizures" without probable cause.
Reason #7: The treaty contains an overly broad criminalization of
hacking tools
The amorphous ban on tools that were "designed primarily"
for hacking criminalizes the tools rather than the behavior at issue;
after all, even if lock-picking tools were designed for burglars, they
should still be legal for use by a locksmith to help someone locked out of
their car at 2:00 in the morning. This provision would put a damper on
technical experimentation. And it would apply when the tools were
distributed "without right"8 - an undefined, legally mysterious phrase
that makes this article ripe for abuse by under-savvy and over-ambitious
prosecutors.
Reason #8: The treaty was drafted in a closed and
secretive manner
The drafting process was closed, secretive and
undemocratic. The drafting committee was dominated by law enforcement,
while industry and public-interest groups didn't have a seat at the table.
Even after the publication of treaty drafts, the authors made little
effort to incorporate the views and concerns of privacy and civil
liberties groups. The result is a "wish list" for law enforcement that
lacks the balance that other viewpoints would have brought to the treaty -
and that a wise approach to policy would require.
Footnotes:
1 There is one platitude about privacy in the preamble.
2 Article 15.3.
3 Article 23.
4 Article 33.
5 Article 27.2.b.
6 Article 10.1.
7 Articles 20 and 21.
8 Article 6.1.
|