For further information please see the Country profiles on counter-terrorism capacity at www.coe.int/terrorism.
Pour plus de renseignements, veuillez consulter les Profils nationaux sur la capacité de lutte contre le terrorisme: www.coe.int/terrorism.
C
YBERTERRORISM–
THE USE OF THEI
NTERNET FORT
ERRORISTP
URPOSESKapitel 1
GEORGIA
January 2013 www.coe.int/terrorism
A. National policy
1. Is there a national policy regarding the analysis, detection, prosecution and prevention of cybercrime in general and the misuse of cyberspace for terrorist purposes in particular? If yes, please briefly describe it.
Widely publicized cyber-attacks – and, to some expert opinions, cyber war - conducted against Georgia in 2008 put the protection of the critical infrastructure high on agenda of the Government of Georgia. Rapidly growing dependence of the critical infrastructure and government services on the IT increases vulnerability to cybercrime-related incidents. Accordingly, adequate protection of critical infrastructure from cyber threats is one of the priorities of the Government of Georgia.
Voicing these concerns, the National Security Council hosted series of meetings of the special working group comprised of different Government agencies to develop the national Cyber Security Strategy of Georgia throughout 2011, as a part of the National Security Review. Strategy and its implementation Action Plan, presented to the public for discussion in March 2012, is a further testament of the high awareness of the Government of Georgia of information security challenges.
The final version of the Cyber Security Strategy and Action Plan note the following priorities to be implemented in 2012-2015:
Research and analysis: Study of other states' best practices and sharing experience; Research into criteria and standards for identifying objects of critical information systems; Resiliency analysis of critical information systems; Feasibility study for launching the project on establishment of the regional center for cyber security education and research.
New legislative framework: Initiating legislative acts on information security; Developing regulatory framework for identifying critical information systems and actions necessary for ensuring cyber security; Ensuring legal basis for Computer Emergency Response Team operations; Identifying, by legal act, an agency or agencies whose competence includes determination of information security policies and undertaking coordinating functions; Developing cyber security disaster recovery plans and procedures.
Institutional coordination for ensuring cyber security: Further development of the Computer Emergency Response Team (CERT.GOV.GE); Further development of already established 24/7 high-tech crime (cybercrime) international contact point as required by the CoE 2001 Convention against Cybercrime (Budapest Convention); Designation of the expert support team/unit in cybercrime cases; Establishing format and modalities for public-private cooperation.
Public awareness and education: Establishment of public awareness and educational programs on cyber security; Further training of staff and technical personnel of critical information system
subjects and other interested organizations in international and local standards of information security; Specialized training of cybercrime experts in handling electronic evidence (cyber forensics); Supporting scientific and research projects in cyber security; Creation of the research lab.
International cooperation: Strengthening relations in cyber security field with international organizations working in cyber security (OECD, EU, OSCE, NATO, UN, ITU) as well as relevant national authorities; Active participation in international activities related to cyber security and supporting relevant initiatives on a regional scale; Initiating bilateral and multilateral cooperation with national CERTs in the area of cyber security..
В. Legal framework
2. Does your national legislation criminalize the misuse of cyberspace for terrorist purposes, and
a. are these offences specifically defined with regard to terrorist nature or technical means of committing the crime or
b. is the misuse covered by other, non-specific criminal offences?
How are these offences defined and which sanctions (criminal, administrative, civil) are attached?
The Criminal Code of Georgia (hereinafter referred as CCG) penalizes a specific offence of cyber- terrorism (Article 3241) which has been criminalized since 25 July 2006. The terrorist purposes are indicated directly in the text of the Article (“committed for the purpose to intimidate population or/and to put influence on a governmental agency”). The sanctions for this crime are divided into two parts taking into account gravity of the damage caused by cyber terroristic crime. Namely, paragraph I of the article 3241 envisages imprisonment from 10 up to 15 years while the sanction under paragraph II can be 12-20 years and even life imprisonment.
3. Do you plan to introduce new legislation to counter terrorist misuse of cyberspace?
What are the basic concepts of these legislative initiatives?
Georgia will adopt New Cyber Security Strategy that will be the main document defining state policy and establishing basic guiding principles in cyber security field. It should be mentioned that Strategy considers cyber space protection equally important as inviolability of land, air and maritime boundaries. Under the Cyber Security Strategy some new legislative acts and bylaws will be adopted.
In accordance with newly enacted law “On Informational Security”, President of Georgia will issue ordinance under which full list of critical informational infrastructure will be specified.
4. What are the existing national practices in the field of detecting, monitoring and closing down websites used for illicit, in particular, terrorist purposes and what kind of national procedures allow the blocking of access to web sites or pages considered illicit?
No such practices are available in Georgia.
5. What are the existing national practices in the field of interception of, or infiltration to, the electronic correspondence (e.g. e-mail, forum, instantaneous message service, voice over IP-skype, etc).
Article 138 of the Code of Criminal Procedure (CCP) provides that prosecution is authorized to intercept content data of electronic correspondence. As a general rule prosecution needs a court order for content data interception but in urgent cases it can be carried out without court order.
Nevertheless, within 24 hours prosecution is obliged to present reasoning for exigent interception to the relevant court that will confirm or reject prosecutor’s motion within another 24 hours.
6. Does your national legislation provide criteria for establishing jurisdiction over the misuse of cyberspace for terrorist purposes? What are those criteria?
Georgian criminal code establishes jurisdiction over the misuse of cyberspace for terrorist purposes based on general principles laid down in articles 4-5 of the CCG. The principles can be summarized as follows:
Territorial Jurisdiction: According to this principle Georgia can exercise jurisdiction over the offences commenced, continued, suspended or completed on Georgian territory.
Active Personality Jurisdiction: Under this principle Georgia is eligible to establish jurisdiction on the crimes committed abroad by its citizens.
Passive Personality Jurisdiction: A foreigner can be criminally liable if he/she commits a crime against the citizen of Georgia residing abroad.
Protective Jurisdiction: A foreigner will be criminally liable for committing grave and especially grave crime against the interests of Georgia.
7. Does your national legal system establish additional offences related to attempts at, or complicity in, the commission of the misuse of cyberspace for terrorist purposes (ancillary offences)?
Article 19 as well as article 25 of the Criminal code of Georgia (CCG) envisages criminal liability for attempting at and complicity in the all crimes provided by the CCG. Hence, these articles are fully applicable to the crimes of the misuse of cyberspace for terrorist purposes.
8. What kind of national procedures do you have for submitting an application on the activities of Internet-providers and/or hosting companies or other entities, to deprive a user from a domain name or to cancel his/her/its registration or licence?
Unfortunately, no provisions that address such competences or cases can be found in Georgian legislation.
9. What non-legislative measures do you have in your country to prevent and counter terrorist misuse of cyberspace, including self-regulatory measures?
There are no direct regulations against terrorist misuse; however, there are several prevention- based possibilities that address illicit use of cyberspace in general, theoretically covering terrorist misuse as well.
The largest part of regulations and measures related to prevention comes from the recently enacted Law of Georgia on Information Security, which contains a separate Chapter on cyber- security. The central actor in preventing and monitoring the Georgian cyberspace is CERT Georgia, whose legally defined responsibilities include prevention of cyber incidents irrespective of their criminal or non-criminal nature. However, the Law also vests critical infrastructure subjects with their own responsibilities related to prevention, namely, the responsibility to appoint cyber security specialist who has to be available 24/7, obligation to report all cyber incidents (irrespective of nature or damages) to CERT Georgia, as well as options to undertake penetration testing of information systems and to install and manage network sensor (a part of the countrywide network sensor system managed by CERT Georgia).
Regarding self-regulation, one has to mention Cyber Security Forum of Georgia, which was launched with the support of the Data Exchange Agency in September 2012. Being an informal discussion and coordination mechanism, the Forum brings together leading IT experts in the Georgian market – both from public and private sector – to coordinate and network with each other those measures, initiatives and activities that aim to enhance security of Georgian cyberspace.
There is no specific cyber-terrorism related mandate of the Forum, however, better and more coordinated protection of cyberspace minimizes those risks as well.
С. International co-operation
10. Please describe your country’s general framework for international co-operation regarding the misuse of cyberspace for terrorist purposes.
Since October 2012 Georgia is the party of CoE Cybercrime Convention under which specialized Cyber Crime Unit was established within the Central Criminal Police Department of Ministry of Internal Affairs of Georgia (hereinafter referred as MoIA) that performs functions of the 24/7 International Contact Point as well.
Furthermore, Georgia is a party to the 13 UN antiterrorism international conventions, as well as CoE Convention on the Suppression of Terrorism and its amending Protocol.
Within the frames of universal (UN conventions), regional (CoE conventions), sub-regional (GUAM, BSEC) and bilateral international instruments (with Armenia, Austria, Azerbaijan, Belarus, Bulgaria, Egypt, Estonia, France, Hungary, Italy, Kazakhstan, Latvia, Malta, Moldova, Poland, Romania, Turkey, Ukraine, UK, USA and Uzbekistan) or on the basis of reciprocity, the Ministry of Internal Affairs of Georgia closely cooperates with the respective agencies of partner countries to tackle international terrorism.
Moreover, Georgia actively cooperates with international organizations within the framework of certain cybercrime projects. (Cybercrime Project with Estonia, partnership with UK and USA).
11. What are the existing practices and experiences with regard to international co- operation, in particular in relation to the procedures described in question 4?
No such practice is available.
D. Institutional framework
12. Please list the institutions that are competent for countering terrorist misuse of cyberspace.
MoIA Central Criminal Police Department constitutes the central body that investigates cybercrime cases and serves as a 24/7 International Contact Point.
National Data Exchange Agency is the main institution responsible for cyber security in the country. Agency has its own CERT that constantly monitors internet traffic and rapidly responds to all computer incidents.
MoIA Forensic-Criminalistics Main Division provides forensic service in cybercrime affairs.
Furthermore, Forensic Division participates in search and seizure of cybercrime evidences.
MoIA National Central Bureau of INTERPOL coordinates international cooperation for arresting perpetrators of cybercrime wanted by Georgia.
13. In order to counter terrorist misuse of cyberspace are there any partnerships between the public and private sectors or legal obligations for operators of electronic communication (Internet-service providers. hosting companies, etc.) as well as persons providing the public with access to systems which allow on-line communication via access to the network (cyber cafe, WiFi hotspot)?
There is a Memorandum of Understanding between the Law Enforcement Agencies and Internet Service Providers on the Principles of Cybercrime Cooperation. The Memorandum has been concluded in January 2010 with active involvement of the Council of Europe Cybercrime in Georgia Project and provides a formal framework for exchange of information between law enforcement authorities and ISPs on all aspects related to the misuse of cyberspace. The parties undertake an obligation to exchange data on regular and new threats of the misuse of cyberspace, to recognize importance of trainings, to appoint relevant contact point for day-to-day cooperation, to provide information in reasonable time, to respect confidentiality and other matters. The Memorandum is not only a formal engagement but is rather a reflection of successful cooperation between the investigation and the ISPs in a manner that is not prejudicial to the development of the Internet business in Georgia.
14. Are there any hotlines regulated by the public or private sectors permitting denouncement of those web sites which could be of a terrorist character / nature?
There is police special hotline in Georgia through which it is available to denounce information on alleged crimes, including websites of a terrorist character. In this case, call will be addressed to Specialized Unit of MoIA Central Criminal Police Department that will initiate criminal-intelligence procedure against the website of alleged terroristic nature. Police special hotline number in Georgia is 112 that is available for 24/7 from all mobile/telephone operators located in Georgia.
Е. Statistical information
15. Please provide relevant statistics on offences relating to the misuse of cyberspace for terrorist purposes (including possibly: cases recorded, investigated, brought to court, convictions, victims etc.).
No such statistics are available in Georgia.
16. Where possible, please describe briefly the profile of offenders typically involved in the misuse of cyberspace for terrorist purposes (professional background, gender, age, nationality), and possible typical organisational characteristics, including trans-national links and links to other forms of organized crime.
No such profiles are available in Georgia.
