Section III HIPCAR – Cybercrime/e-Crimes Two different cases are mentioned in subparagraph 2, viz. (1) affecting computer systems that are exclusively used for critical infrastructure operations and (2) affecting computer systems that do not exclusively operate critical infrastructure but are among other purposes used for critical infrastructure protection. In the latter case it is necessary to prove that the conduct did take place at a time when the computer system was operating critical infrastructure operations. Section 10: Illegal Devices Paragraph 1(a) identifies both the devices designed to commit and promote cybercrime as well as passwords that enable access to a computer system. The term devices covers hardware and software based solutions that are aimed at committing one of the mentioned offences. Examples of such software are virus programs, or programs designed or adapted to gain access to computer systems. Computer password, access code, or similar data are unlike devices not performing operations but access codes. Examples are published passwords that enable access to paid services and data bases. The publication of system vulnerabilities, that could serve as an instruction how to circumvent protection measures are not covered by the provision as long as they do not contain access codes. Unlike classic access codes system vulnerabilities it does not necessarily enable immediate access to a computer system but enables the offender to make use of the vulnerabilities to successfully attack a computer system. “Production” means any process of creating either a device or password. The production of nonexecutable parts of software shall not be covered. “Sale” describes the activities involved in selling the devices and passwords in return for money or other compensation. “Procurement for use” covers acts related to the active obtaining of passwords and devices. The fact that the act of procuring is linked to the use of such tools in general requires intent of the offender to procure the tools with the objective of using it in a manner that goes beyond “regular” intent and “that it be used for the purpose of committing any of the offences established by part II. “Import” relates to acts of obtaining devices and access codes from foreign countries. As a result, offenders that import such tools for the purpose of selling them can be prosecuted even before they offer the tools for sale. With regard to the fact, that the procurement of such tools is only criminalised if it can be linked to the use it is questionable if the sole import without the intention to sell or use the tools is covered by Section 10. “Export” means an actual shipment, transfer, or transmission of devices or access codes out of a country as well as a transfer of devices or access codes within a country with the knowledge or intent that the devices or access codes will be shipped, transferred, or transmitted outside the country. “Distribution” covers such acts as forwarding devices or passwords to others. Procurement for use covers acts related to the active obtaining of passwords and devices. “Making available” refers to an act that enables other users to obtain access to items. It is also intended to cover the creation or compilation of hyperlinks in order to facilitate access to such service. This provision in general applies not only to devices that are exclusively designed to facilitate the commission of cybercrime but also covers devices that are generally used for legal purposes, where the offenders’ specific intent is to commit cybercrime. The limitation to devices designed solely to commit crimes is too narrow in its extent and can lead to insurmountable difficulties of proof in criminal proceedings, rendering the provision virtually inapplicable or only applicable in rare instances. A clarification that authorized testing shall not be affected was added in subparagraph 3. Section 10 requires that the offender is carrying out the offences intentionally. In addition to the regular intent with regard to the acts covered Section 10 requires an addition special intent that the device is used for the purpose of committing any of the offences established in part II. 36 > Model Policy Guidelines & Legislative Text