jurisdiction, international cooperation and ISP responsibility and liability. The last decade has
seen significant developments in the promulgation of international and regional instruments
aimed at countering cybercrime. These include binding and non-binding instruments. Five
clusters can be identified, consisting of instruments developed in the context of, or inspired by:
(1) the Council of Europe or the European Union, (2) the Commonwealth of Independent States
or the Shanghai Cooperation Organization, (3) intergovernmental African organizations, (4) the
League of Arab States, and (5) the United Nations. A significant amount of cross-fertilization
exists between all instruments, including, in particular, concepts and approaches developed in
the Council of Europe Convention on Cybercrime (the “Budapest Convention”).
There is a risk of partition between cooperating with shared cybercrime procedures and
non-cooperating states (see section 3 A, below): Current international cooperation risks fall
into two country clusters: those states that have implemented reciprocal powers and procedures
to cooperate among themselves, and those that have failed to implement those measures,
are restricted to “traditional” modes of international cooperation that take no account of
the specificities of electronic evidence and the global nature of cybercrime. Such a concern
is particularly true of investigative actions. The lack of a common approach, including within
current multilateral cybercrime instruments, means that even simple requests for actions, such
data preservation, may not be easily fulfilled.
Regulatory frameworks must maintain data integrity while protecting freedoms: Regulatory
frameworks, essential to the fight cybercrime, must be sufficiently bolstered to assure freedom
of speech and access to information. Relatedly, while data protection laws generally require
personal data to be deleted when no longer required, some states have made exceptions for
purposes of criminal investigation, requiring ISPs to store specific types of data for a set period
of time. Many developed countries also have rules requiring organizations to notify individuals
and regulators of data breaches. Also, while it might be technically possible for ISPs to filter
content, any restrictions that they place on internet access are subject to both foreseeability
and proportionality requirements under international human rights law protecting rights to seek,
receive and impart information.
The question of holding ISPs liable: Following directly on from the previous matter is the
question of whether, and to what extent, to hold ISPs liable for objectionable content is a vast
one. In many legal systems, ISPs may be held liable for failing to control or constrain illegal
content or activity crossing their systems. In other systems, however, that liability is limited on
the basis that ISPs are “mere conduits” of data. That said, where liability is limited, it can often
shift to a requirement to take action if an element of content-awareness becomes apparent—for
instance, where the ISP modifies transmitted content or if actual or constructive knowledge of
illegal activity or content is shown.
PPPs are central to cybercrime prevention: PPPs are created as much by informal agreement
as by legal basis. Private sector entities tend to be most frequently involved in partnerships,
followed by academic institutions, and then by international and regional organizations. PPPs
are mostly used to facilitate knowledge sharing, though they have been used, especially by
private-sector entities, to prompt investigation and legal actions. Such actions complement
those of law enforcement and can help mitigate damage to victims. Academic institutions
play a variety of roles in preventing cybercrime, including training, developing law and policy
development, and technical standards setting, as well as housing cybercrime experts, computer
emergency response teams CIRTs and specialized research centers.
Page 26 | Chapter 1 | § B. Phenomenon & Dimensions of Cybercrime
Table of Contents