The Kommersant got acquainted with the draft convention on combating cybercrime, recently submitted by Russia to the UN. The document, covering 23 types of cybercrimes, spells out the procedure for interaction between states in the extradition of cybercriminals and the provision of legal assistance in criminal cases, including the identification, arrest, confiscation and recovery of assets. To monitor the implementation of the convention, Russia proposes to create a new mechanism under the auspices of the UN - the International Technical Commission. Experts say that existing legal instruments to combat cybercrime are insufficient and a universal convention is urgently needed. But it will not be easy to achieve its adoption in the existing Russian version.
Cooperation and sovereignty
The full title of the document developed by Russia: United Nations Convention on Countering the Use of Information and Communication Technologies for Criminal Purposes. Its draft was written by a group of experts, which included representatives of the Prosecutor General's Office, Ministry of Foreign Affairs and other relevant departments. On Tuesday, at the UN headquarters in Vienna, an interdepartmental delegation led by Deputy Prosecutor General Petr Gorodov presented the document to the two UN representatives: Dennis Chatchawalit, acting Executive Director of the UN Office on Drugs and Crime, and Fauzia Mebarka, Chairman of the Special Committee on the Drafting of a Convention against the Criminal Use of Information and Communication Technologies (ICT). Prosecutor General's Office of the Russian Federation explained the necessity to adopt now such a convention at the UN due to "the explosive growth of cybercrime in the world."
Government agencies must take measures to counter the threat of using ICT for criminal purposes and create the necessary international legal regime in accordance with the April decree of President Vladimir Putin "On Approval of the Fundamentals of State Policy of the Russian Federation in the Field of International Information Security."
The Kommersant got acquainted with the draft of the Russian convention. The 55-page document begins with a preamble, the first paragraph of which will most likely be signed by most states: "The information space should be built in strict accordance with the basic principles and norms of international law, including the principles of respect for human rights and freedoms and the principles of peaceful settlement of disputes."
But the second preambular paragraph may cause controversy: "Each state has sovereignty and exercises jurisdiction over the information space within its territory in accordance with its national law." Some Western countries are ambivalent about the concept of sovereignty of states in cyberspace, insisting that in this environment there should be no virtual borders and legal regimes established by individual governments. But it is on this concept - "the encouragement of international cooperation while respecting the sovereignty of individual states" - the Russian convention is being built.
Its objectives in the document are indicated in article 1:
· promoting the adoption and strengthening of measures aimed at effectively preventing and combating crimes and other unlawful acts in the field of ICT;
· preventing actions against the confidentiality, integrity and availability of ICTs, and preventing abuse in the use of ICTs;
· improving the efficiency and development of international cooperation, including in the context of training and technical assistance in the prevention and combating of ICT crimes.
This is followed by an article on the protection of sovereignty again: "The participating States shall fulfill their obligations under the convention in accordance with the principles of state sovereignty, the sovereign equality of states and non-interference in the internal affairs of other states." And then it is emphasized that the convention does not endow the competent authorities of its participants with the right to carry out on the territory of other states functions that fall within the competence of the authorities of these other countries (unless the latter themselves are not against such actions). Simply put, we are talking about a ban on cross-border operations carried out in the computer networks of states without the consent of their authorities.
It is because of the clause allowing such cross-border operations that Russia has not joined the main current international treaty on the fight against cybercrime - the 2001 Council of Europe Budapest Convention.
Russia is the only member state of the Council of Europe that has not signed this document, which has already been joined by some countries outside Europe (Argentina, Israel, Japan and a number of others). The Russian authorities believe that providing foreigners with opportunities to conduct unauthorized cross-border cyber operations will threaten the country's security and sovereignty. And although the Council of Europe subsequently issued an addendum designed to allay Russia's concerns, Moscow has not changed its position.
23 types of cybercrimes
However, a possible violation of sovereignty is not the only thing that confuses Russia in the Budapest Convention. Another important drawback: the criminalization of only nine components of cybercrimes, while over the past 20 years, the types of offenses on the Internet have increased significantly. The new Russian convention identifies 23 such categories. Among them:
· illegal access to digital information and its interception;
· disruption of the functioning of networks; creation, use and distribution of malware;
· child pornography;
· inclination to commit suicide;
· incitement to subversive or armed activities;
· crimes related to terrorist and extremist activities;
· drugs spreading;
· illegal arms trafficking; rehabilitation of Nazism;
· distribution of counterfeit medicines and medical devices.
The following is a detailed description of what measures should be taken by the States parties to the convention at the national level to combat the listed crimes. This is followed by a key chapter on international cooperation. The document explains in detail how exactly the interaction between the law enforcement agencies of states should be carried out in matters of extradition of cybercriminals and the provision of legal assistance in criminal cases, including the identification, seizure, confiscation and return of their stolen assets. The convention contains provisions on requests for "emergency mutual assistance", "prompt security of information" and "prompt provision of stored technical parameters of traffic" and other clauses designed to enable law enforcement officers to cooperate in real time. The document also gives them the opportunity to conduct joint investigations.
The convention provides for the creation of a number of new structures and mechanisms. At the national level, these are contact centers operating 24 hours a day, seven days a week. They are designed to “provide prompt assistance in investigating, prosecuting or prosecuting crimes related to computer systems and data, or in collecting digital evidence of crimes”.
At the UN level, it will focus on the Conference of the States Parties, the secretariat and the International Technical Commission on Countering ICT Crime. The Commission should become a permanent body with 23 members. It is proposed to form it as follows: two thirds - representatives of the participating states, one third - representatives of the governing bodies of the International Telecommunication Union (ITU). Supranational mechanisms are designed to monitor the implementation of the convention and help resolve disputes between its parties.
“Food for thought”
Note that Russia has already submitted a similar document to the UN - in 2017. The new convention echoes the old one, but is not a copy of it. The first version of the convention did not receive the resonance and broad support that Moscow desired at the international level. But then, in 2017, there was still no UN special committee to develop a convention against the use of ICT for criminal purposes (headed by Fauzia Mebarki, who was handed a copy of the Russian convention on Tuesday). Russia initiated the creation of such a committee through a resolution of the UN General Assembly and received the support of the majority of its members. The committee held its first organizational session in May. Its members are expected to develop a global convention against the criminal use of information and communication technologies by 2023. The convention presented by Moscow this week is a potential draft.
Thus, we can say that Russia took into account the lessons of 2017, when its achievements, in fact, "went nowhere": since then, it has achieved the creation of a separate platform for discussing such initiatives at the UN and itself began to fill it with "food for thought".
Andrei Krutskikh, special envoy of the President of the Russian Federation for international cooperation in the field of information security, director of the Foreign Ministry department, in an interview with Kommersant, explained that Russia, introducing its draft convention, hopes to "create a framework for discussion" next year so that, there would be already some kind of base, and no need to write a text from scratch by paragraph. “We do not expect that our draft convention will be adopted word for word, that something will probably be added, something will go away. But the existence of such a project, we hope, will speed up the elaboration of a universal convention,” he said. According to the diplomat, Russia hopes that all other participants in the negotiation process, including the United States, will actively participate in the process of drafting a global convention. As a reminder, Moscow is currently conducting an intensive bilateral dialogue with Washington on countering cybercriminals who, according to the United States, are spreading ransomware viruses from the territory of the Russian Federation.
Eugene Kaspersky, founder and CEO of Kaspersky Lab, spoke about the importance of international cooperation in the fight against cyber fraudsters in a recent interview with Kommersant. “The cybercriminal business is profitable and practically unpunished. Only the groups that "bomb" on the territory of their country are calculated and arrested. Those criminals who work from the territories of countries that have complicated political relations are practically unattainable at the moment,” he explained.
In this regard, Dmitry Volkov, CTO and co-founder of Group-IB, which specializes in combating cybercrime, in an interview with Kommersant called the new Russian initiative “a very logical and urgent step.” According to him, the Budapest Convention “has become outdated over time and has ceased to be effective". "Over the past 20 years, there have been great changes: new types of cybercrimes have appeared - mining, encryption of enterprise networks for ransom. New cyber threats have emerged related to cyber espionage and sabotage at critical information infrastructure facilities. Cryptocurrencies are widely used by cybercriminals to withdraw and laundering of stolen funds,” - the expert stated. - We see that the number of cybercrimes and the damage from them is growing from year to year - this applies to both ransomware attacks and fraud using social engineering methods, so the availability of an up-to-date legislative instrument is now more necessary than ever ". At the same time, he noted that the countries that have ratified the Budapest Convention, over the years of its application, have adapted their legislation to this document and it will be difficult for them to immediately abandon it. “The adoption of a new convention is a long way,” Mr. Volkov said.
