Underlying differences in laws
In today’s globalized world, the law consists of a multitude of national, regional and international legal systems. Interactions between these systems occur at multiple levels. As a result, provisions sometimes contradict each other, leading to collisions of law, or fail to overlap sufficiently, leaving jurisdictional gaps.16
Cybercrime is by no means the first ‘new’ form of crime to engage multiple jurisdictions and laws. Illicit trafficking flows in drugs, people and weapons, for example, frequently originate and end in different hemispheres, passing through many countries in between. Nonetheless, cybercrime acts can engage legal jurisdictions within the timeframe of milliseconds. Computer content, for
example, can be legally stored on a computer server in one country, but downloaded through the internet in multiple countries, some of which may consider the content to be illegal.17
16 Sieber, U., 2010. Legal Order in a Global World. In: Von Bogdandy, A., Wolfrum, R. (eds.) Max Planck Yearbook of United Nations
Law, 14:1-49.
17 Sieber, U., 2008. Mastering Complexity in the Global Cyberspace. In: Delmas-Marty, M., Pieth, M., and Sieber, U. (eds.) Les chemins
de l’harmonization pénale. Paris, pp.127-202 (192-197).
Key results:
Harmonization of cybercrime laws is essential for, inter alia, the elimination of criminal safe havens, and global evidence collection
Divergences in national cybercrime laws derive from a range of factors, including underlying legal and constitutional differences
The area of cybercrime offence penalties well exemplifies divergences in national approaches to cybercrime acts. Examination of just one crime – illegal access – shows considerable difference in its perceived degree of seriousness
One-third of responding countries report that their legislation is highly, or very highly harmonized with countries viewed as important for the purposes of international cooperation
This varies regionally, however, with higher degrees of harmonization reported by countries in the Americas and Europe
This may be due to the use, in some regions, of multilateral instruments, which are inherently designed to play a role in harmonization
Criminalization differences – Case example
A citizen of a country in Oceania uploaded legal material containing forms of hate speech on a server in his own country. The material was downloaded in a European country. When the individual later travelled to that country in Europe, he was arrested and sentenced to imprisonment for these acts, which had not been criminal in his home country.
The case was appealed. The Federal High Court of the European country upheld the conviction. It argued that although the accused neither acted in the European country nor actively sent his data to this country, he nonetheless threatened the public peace within the territory, as required by the relevant statute The court stressed, however, that the interpretation could not be generalized for other statutes on illegal content.
Source: Judgement of the German Bundesgerichtshof of 1 December 2000 (1 StR 184/00, please see BGH MMR 2001, pp.228 et seqq.)
CHAPTER THREE:LEGISLATION AND FRAMEWORKS
Differing global perspectives on the acceptability of forms of internet content leave a number of theoretical alternatives. States could choose to restrict the scope of their criminal jurisdiction to activities of perpetrators on their own national territory. They could focus on the prosecution of persons within their territory accessing content, irrespective of its source. Or they could attempt extraterritorial action against content producers. Such perspectives illustrate the growing extent of legal differences and approaches in the area of cybercrime. Chapter Four (Criminalization) examines this point in greater depth, including from the perspective of international human rights law.
Some divergences between national laws can be traced back to fundamental differences between
legal families. Major legal families
commonly identified include continental European law,18
common law,19 Islamic law,20 and
mixed law (such as Chinese law).21
Country responses to the Study questionnaire show that a broad range of legal systems are represented.22
Legal families are an important way of characterizing legal
heritage, including where systems share particular features, due for instance to common cultural roots.23 Nonetheless, national laws are not static, and similarities between systems may exist at a
certain point in time, but subsequently vanish.24 As such, historic differences can disappear or lose
their practical relevance.
18 Continental European criminal law is often characterized by abstract normative rules, systematic structures and a strong influence
of academic thinking. Criminal law is usually extensively codified with penal codes also providing for general principles of criminal responsibility applicable to all forms of criminal behaviour. See Zweigert, K., Kötz, H. 1998. Comparative Law. 3rd ed. Oxford/New York: Clarendon Press, p.69. See also Weigend, T. 2011. In: Heller, K.J., Dubber, M.D. (eds.) The Handbook of Comparative Criminal Law, Stanford: Stanford University Press, pp.256 et seq.; Elliott, C., ibid., p.213.; Gómez-Jara Díez, C., Chiesa, L.E., ibid., p.493; Thaman, S.C., ibid., p.416.
19 In contrast, in common law jurisdictions, substantive laws provisions are more usually drafted in descriptive terms, ensuring both
accessibility of law, and reflecting the strong position of lay judges within common law jurisdictions. Judge-made law was long the main source of the substantive criminal law and still remains an important element. Codification, however, is now a widespread norm, albeit sometimes through separate legislative acts rather than one single penal code. See Legeais, R., 2004. Grands systèmes de droit contemporains. Paris: Litec, pp.357, 366; Ashworth, A. (United Kingdom). 2011, p.533, and also Robinson, P. (United States) 2011, p.564. Both in: Heller, K.J., Dubber, M.D. (eds.) The Handbook of Comparative Criminal Law, Stanford: Stanford University Press; Simester, A.P., Spencer, J.R., Sullivan, G.R., Virgo, G.J. 2010. Criminal Law. 4th ed. Oxford/Portland: Hart Publishing, p.46; Ashworth, A. 2009. Principles of Criminal Law. 6th ed. Oxford/New York: Oxford University Press, p.8.
20 Islamic law is characterized by Shari’a, the sacred law of Islam, and fiqh, the jurisprudence of Islamic jurists. Crimes are categorized
according to their legal sources and to punishments provided. A number of core offences are sanctioned by the use of fixed penalties (hudud). Other core offences are punished through legal reasoning based on Ijma and Qiyas. In general, Islamic laws allow for extensive flexibility as regards criminalization, including through the evolution of different theological schools of law. See Tellenbach, S., 2011. In: Heller, K.J., Dubber, M.D. (eds.) The Handbook of Comparative Criminal Law. Stanford: Stanford University Press, p.321.
21 Chinese criminal law has been influenced by a range of legal systems with the judiciary retaining important powers to give binding
judicial interpretations of law. See Luo, W., 2011. In: Heller, K.J., Dubber, M.D. (eds.) The Handbook of Comparative Criminal Law. Stanford: Stanford University Press, p.138; and Bu, Y., 2009. Einführung in das Recht Chinas. Munich: C.H. Beck, p. 20.
22 Study cybercrime questionnaire. Q15.
23 See Ferrante, M., 2011. In: Heller, K.J., Dubber, M.D. (eds.) The Handbook of Comparative Criminal Law. Stanford: Stanford University
Press, p.13.
24 Zweigert, K., Kötz, H. 1998. Comparative Law. 3rd ed. Oxford/New York: Clarendon Press, p.66.
46% 28% 24% 2% Figure 3.2: Classification of national legal system of responding countries Civil law Mixed system Common law Islamic law Study cybercrime questionnaire. Q15. (n=54)
58
When it comes to cybercrime, some remaining historical legal differences in national criminal procedure law certainly persist.25 Nonetheless, differences in the overall content of the
criminal law often depend less on the particular ‘legal family’ – be it civil or common law – and more on prevailing socio-cultural and constitutional orders. The placement of varying emphasis, for example, on values such as freedom of expression and privacy, or on the individual or community, can have a significant influence on policy and criminalization outcomes. In the context of cybercrime, this can lead to different legal results in areas such as regulation of obscene material;26
balances between freedom of speech and unacceptable expression;27 levels of access to internet
content;28 rules and obligations for internet service providers;29 and safeguards and limitations on
intrusive law enforcement investigations.30
In addition to socio-cultural and constitutional effects, the impact on legal drafting processes of simple historical coincidences, the impact of views of individual experts, and differing evaluations of best practice, should not be underestimated. Technical legal differences that arise from such effects, as well as from legal procedural heritages, may be significantly more straightforward to account for and to address, than those that derive from socio-cultural and constitutional orders.
Harmonization of laws
Such differences lead to the question of whether, and if so, how far, national legal differences in cybercrime laws can and should be reduced. In other words, how important is it to harmonize cybercrime laws? This can be undertaken in a number of ways, including through both binding and non-binding international or regional initiatives. The basis of harmonization may be a single national approach (with all others revising their laws in line), or, more often, common legal elements identified in the law of a number of states, or expressed within a multilateral instrument – such as a treaty or non-binding international standard. Indeed, as discussed further below, one of the aims of international law is to achieve harmonization of national laws.
During information gathering for the Study, countries were asked about perceived degrees of harmonization of cybercrime legislation, and about successes and limitations of harmonization, and approaches used to maintain national legal traditions during harmonization processes.31 A
number of countries, in Asia and the Americas in particular, highlighted that while harmonization was important, the process was subject to some important limitations. These included ‘conflict… with
constitutional requirements,’ requirements that harmonization should not be ‘in conflict with Basic Law and Sharia’, needs for ‘contextual application’ of harmonized standards, and issues of the existence of both
federal and state legislation within a country.32 Countries also reported successes in harmonization
of cybercrime legislation. Countries highlighted, for example, that harmonization was part of a ‘comprehensive approach to include substantive and procedural rules of law’, and that national legal traditions
25 On the evolving and heterogeneous nature of procedural law, see Legeais, R., 2004. Grands systèmes de droit contemporains. Paris: Litec,
p.389.
26 See, for instance, Segura-Serrano, A., 2006. Internet Regulation and the Role of International Law. In: Von Bogdandy, A.,
Wolfrum, R. (eds.) Max Planck Yearbook of United Nations Law, 10(2006):191-272; Edick, D.A. 1998. Regulation of Pornography on the Internet in the United States and the United Kingdom: A Comparative Analysis. Boston College International & Comparative. Law Review 21(2):437-460.
27 See Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression. A/67/357, 7 September
2012.
28 Ibid.
29 See Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression. A/HRC/17/27, 16 May
2011.
30 For instance, regarding investigations into computer-related acts in support of terrorism offences, see UNODC. 2012. The use of the
Internet for terrorist purposes. paras 35, 106, 110.
31 Study cybercrime questionnaire. Q16 and Q17. 32 Ibid. Q16.
CHAPTER THREE:LEGISLATION AND FRAMEWORKS
could still be maintained by ‘taking into account the specificity of society in terms of customs, traditions and
usages… [and] pre-existing national legislation.’33
The degree of harmonization of cybercrime laws reported by responding countries varies significantly depending upon region, and upon whether harmonization was considered with respect to: (i) other countries; (ii) within the region; or (iii) the provisions of multilateral instruments. Overall, Figure 3.3 below shows that around one-third of countries reported that their legislation was either ‘very highly’ or ‘highly’ harmonized with other countries. The remainder view their legislation as ‘partially’ or ‘somewhat’ harmonized with other countries. Levels of perceived harmonization tend to be higher in Europe and the Americas, than in Africa, Asia and Oceania. One country in Asia, for example, commented directly that ‘current legislation is not harmonized with countries
that are important… for the purposes of international cooperation.’34 Other countries referred to the global
situation. One country in Europe, for example, noted that ‘at regional level there is a high degree of
harmonization. At global level we are not aware if it is the same. Although no international judicial cooperation request was [yet] refused to us based on the lack of double criminality requirements, it is apparent that different procedural rules… [exist] related to international judicial cooperation.’35
Many countries commented on the utility of international instruments in processes of harmonization. One country, for example, reported finding it useful to have external standards, such as those found in international and regional instruments, ‘against which we could compare the provisions of
our laws.’36 Another noted that international fora seeking consensus on international strategies and
legal measures against cybercrime were important as they represented ‘opportunities to share ideas which
can be taken up by any Member State as useful legislative or practical options for preventing and suppressing crime.’
The same country observed that harmonization processes represented a two-way process, as ‘in some
cases… domestic legislative initiatives or ideas have been the source of elements in international norms, and it other cases, ideas expressed by other Member States have influenced [national] thinking about cybercrime, and have found their way into [national] law as a result.’37 Other countries noted the influence of existing national legislation. One country in Eastern Asia, for example, stated that it had ‘studied foreign
legislation…to establish national legislation.’38 Overall, Figure 3.3 is rather inconclusive as to the impact of
international instruments on harmonization. High levels of perceived harmonization of national
33 Ibid.
34 Study cybercrime questionnaire. Q17. 35 Ibid.
36 Study cybercrime questionnaire. Q16. 37 Study cybercrime questionnaire. Q17. 38 Study cybercrime questionnaire. Q16.
0% 20% 40% 60% 80% 100% International/regional instruments Within region Other countries International/regional instruments Within region Other countries International/regional instruments Within region Other countries International/regional instruments Within region Other countries Af ri ca (n= 6 ) Am e ri ca s (n = 8 ) As ia & Oce an ia (n= 1 2 ) Eu ro p e (n = 1 2 ) Figure 3.3: Degree of harmonization of cybercrime legislation with: (i) other countries important for cooperation, (ii) the Region, and (iii) multilateral instruments Very Highly Highly Partially Somewhat
60
legislation with international instruments for countries in Europe, for example, do not appear to translate directly into high levels of harmonization with countries within the region.
International instruments relevant to cybercrime and their influence on national legislation are examined later in this Chapter. Firstly, however, it is important to examine the reasons and
rationale behind harmonization of cybercrime legislation.
Why harmonize?
To avoid criminal safe havens – In the field of cybercrime, as for all transnational crimes, the
main advantage of harmonizing criminal law lies in the prevention of cybercrime safe havens for perpetrators. As noted by one respondent country to the Study questionnaire, ‘cybercrime is a global
problem, and this makes all countries important to us, in one of several ways… we believe that cooperation with developing countries is important on the basis that cybercrime knows no boundaries.’39 Indeed, out of all
transnational crimes, cybercrime likely offers the most direct risk for use of safe havens.
Thus, if harmful acts involving the internet are criminalized, for example, in State A, but not in State B, a perpetrator in State B can be free to target victims in State A via the internet. In such cases, State A cannot, on its own, effectively protect against effects from such transnational activities. Even where its criminal law allows the assertion of jurisdiction over the perpetrator in State B, it will still require consent or assistance from B – either regarding the gathering of evidence, or the extradition of the identified perpetrator. In order to protect persons within its own jurisdiction, State B is unlikely to assist where the conduct is not also criminalized in its own country. This principle of dual criminality is central to many forms of international cooperation. It can be found, for example, in multilateral and bilateral extradition treaties, as well as national laws.40
Dual criminality also plays a role in mutual legal assistance, such as requests for interviewing of witnesses, or collection of evidence.41 While not all mutual legal assistance agreements between
states include this requirement, many instruments ensure that coercive or intrusive measures, such as search and seizure, or freezing of property, are subject to dual criminality.42 Chapter Seven
(International cooperation) examines this area in greater detail. For the purposes of harmonization of cybercrime criminal laws, however, an important point is that dual criminality does not require that the underlying activity be punished by the same type of legal provision. Thus, if State C uses a cyber- specific offence for particular conduct, while State D uses a general offence, both C and D will be able to engage in international cooperation, provided that the essential constituent elements of the offence are comparable under the laws of both states.43 As discussed in Chapter Seven, where states
achieve a certain degree of harmonization among their national laws (such as in the European
39 Study cybercrime questionnaire. Q17.
40 See, for example, Article 2(1) of the United Nations Model Treaty on Extradition, Article 2(1) of the European Convention on
Extradition, and Article 2 of The London Scheme for Extradition within the Commonwealth. See also Plachta, M., 1989. The role of double criminality in international cooperation in penal matters. In: Agell, A., Bomann, R., and Jareborg, N. (eds.) Double criminality, Studies in international criminal law. Uppsala: Iustus Förlag, p.111, referring to, inter alia, Shearer, I., 1971. Extradition in international law. Manchester, p. 137, and Bassiouni, M.C., 1974. International extradition and world public order. Dordrecht: Kluwer Academic Publishers, p.325.
41 See Capus, N., 2010. Strafrecht und Souveränität: Das Erfordernis der beidseitigen Strafbarkeit in der internationalen Rechtshilfe in Strafsachen.
Bern: Nomos, p.406.
42 See, for example, Article 5(1) of the Council of Europe Convention on Mutual Legal Assistance, and Article 18(1)(f) of the Council
of Europe Convention on Laundering, Search, Seizure, and Confiscation of the Proceeds from Crime. For the exchange of information or other forms of cooperation that do not infringe upon the rights of the person concerned, dual criminality has not been required. See Vermeulen, G., De Bondt, W., Ryckman, C., 2012. Rethinking International Cooperation in Criminal Matters in the EU. Antwerp: Maklu, p.133; and Klip, A., 2012. European Criminal Law. Antwerp: Intersentia, p.345.
43 Plachta, M., 1989. The role of double criminality in international cooperation in penal matters. In: Agell, A., Bomann, R., Jareborg,
N. (eds.). Double criminality, Studies in international criminal law. Uppsala: Iustus Förlag, pp.108-109. See also: Explanatory report to the European Convention on Laundering, Search, Seizure and Confiscation of the Proceeds from Crime, that specifies in the clarification of Art. 18(1)(f) that dual criminality is required in abstract to for the investigative measures meant by Section 2, which includes (but is not limited to) the investigative measures that require coercive action.
CHAPTER THREE:LEGISLATION AND FRAMEWORKS
Union), the principle of dual criminality may come to be replaced by a default presumption of equivalence of laws.44
To enable global evidence collection – The harmonization of procedural law is a second
indispensable requirement for effective international cooperation. In the above example, if State B does not have the necessary procedural power for expedited preservation of computer data, for instance, then State A will not be able to request this facility through mutual legal assistance. In other words, a requested state can only provide assistance within its territory, to the extent that it could do so for an equivalent national investigation.45 Again, as with dual criminality, the legal form of
the procedural power need not be directly equivalent, as long as the investigative measure can be executed in practice. Securing expedited preservation of data, for example, might legitimately be achieved either through a dedicated order, or a general power of search and seizure.
To express ‘seriousness’ and to reduce ‘penalty havens’ – From an international cooperation
perspective, penalties specified for criminal offences do not strictly require harmonization on the same grounds as for substantive criminal law and the coercive powers of criminal procedural law. Dual criminality does not concern the respective sanctions. Nonetheless, there is a special nexus between cooperation and the level of punishment. The penalties assigned to a crime are indicative of the level of seriousness of the offence. At the international level, the Organized Crime Convention, for