Lot of hacking through Otter to make notes. How many days I can keep this up, i don't know, but I will continue running it into Otter. https://joly.substack.com/p/51969f5d-7820-4672-9bec-0df5dd5cf3ef Day 2 had delegates getting into the body of the draft text, discussing some sections that were hopefully just about ready for primetime. Any which didn't gather consensus were 'parked' i.e. punted off to 'informal' sessions.. Also, the Chair introduced a 3 minute timer, after which speaker's microphones would be automatically cut. Before we got into it, Costa Rica got in its 2c on human rights and gender in the preamble. Costa Rica believes that human rights are not simply just rhetoric. It is
not an item of the agenda that can be included or deleted. Human rights are intrinsically related to the dignity of human beings. This is why they are present in a cross kind of way in all international documents. So, taking this into account, we do not see it possible for the preamble of the convention not to have a solid reference to the importance of protecting human rights in cyberspace. Costa Rica strongly believes that all rights are applicable in cyberspace and should be guaranteed in the same way as they are outside of cyberspace. It would not be possible to build an instrument that establishes a commoncriminal policy with the purpose of protecting society from cybercrime, as mentioned in paragraph four in the preamble, without taking into account the protection of human rights, we cannot leave outside a specific mention in paragraph 10, on the importance of incorporating a gender perspective, in all efforts to prevent and combat crime in cyberspace. Because Costa Rica regrets that gender violence online is just as serious as real gender violence, it's very important for this convention to take into account the adverse and diverse differentiated impact of gender violence that also extends to cyberspace. This is why we support the dimensions that included in the preamble should be maintained in the next version of the text. We aspire to a free, open, safe and peaceful cyberspace for all people.
Then we were on to Chapter I - General provisions - Article 1
Article 1. Statement of purpose The purposes of this Convention are to:
(a) Promote and strengthen measures to prevent and combat [cybercrime] [the
use of information and communications technologies for criminal purposes] more efficiently and effectively;
(b) Promote, facilitate and strengthen international cooperation in
preventing and combating [cybercrime] [the use of information and communications technologies for criminal purposes]; and [agreed ad referendum]
(c) Promote, facilitate and support technical assistance and
capacity-building to prevent and combat [cybercrime] [the use of information and communications technologies for criminal purposes], in particular for the benefit of developing countries.
A lot of countries wanted the inclusion of 'technology transfer' in c), however not the U.S, which thought it should go in Article 54, a whole section dedicated to technical assistance. Some countries agreed. This was eventually parked til 54 itself be fully defined. Then, on to Chapter II - Criminalization. This contains articles 6 to 16, much referred to later, which listed criminal behaviors.
Article 6. Illegal access Article 7. Illegal interception Article 8. Interference with [computer data] [digital information] Article 9. Interference with [a computer system] [an information and communications technology device] Article 10. Misuse of devices Article 11. [Computer] [Information and communications technology]-related forgery Article 12. [Computer] [Information and communications technology]-related theft or fraud Article 13. Offences related to online child sexual abuse or child sexual exploitation material Article 14. Solicitation or grooming for the purpose of committing a sexual offence against a child Article 15. Non-consensual dissemination of intimate images Article 16. Laundering of proceeds of crime
The chair asked delegates to be "flexible' Noting that in Article four of this convention, we reiterate the principle
of sovereignty of states, and therefore, no one takes away your right to make laws within your domestic jurisdiction. It will however, be difficult for us to reach consensus if we continue to insist that what is peculiar to us must also be imposed on every other person.
However, many of the articles have the wording:
Each State Party shall adopt such legislative and other measures as may be necessary to establish as criminal offences under its domestic law
The USA noted that Article 16
is drafted can be read to include money laundering offenses that have no connection whatsoever to cybercrime,
so
To remedy this, we would propose a new paragraph three that would make clear that in offense is only considered an offense under the article where the predicate offense is an offense established in accordance with articles six to 15.
They also noted a tautology in the article
Each State Party shall include as predicate offences, relevant offences established in accordance with this Convention;
since article 16 itself is in the Convention! Russia complained about the lack of time spent on preparing these articles, adding
once again, we have to note with great regret the lack in the draft of the convention, articles that we proposed as recognizing as offenses using ICTs, for terrorist purposes, for the proliferation of weapons, drugs, incitement to illegal activities, or other activities. inducement to suicide, rehabilitation of Nazism, justification of genocide and illegal impact on critical infrastructure.
before they were cut off by the timer. The Chair responded suggesting delegates focus on what was in the draft, not what wasn't. Russia got back on the mic and, somewhat grudgingly agreed. Articles 6 & 7 contains the phrase "dishonest intent". Russia wanted it changed to "unlawful aim", Mauritania "illegal intent",. Cameroon "criminal intent". The Chair insisted that states could use whatever language they wanted, but Cameroon responded
Mr. Chairman, what we're doing here, no, don't don't try to present this as kind of light or or inconsequential work, we are expressing positions as sovereign states. So, please let us go to the end of what we're trying to express. You can't just say that afterwards, each state can do as it wishes, no, once we have a convention, if we adopt a convention that each state has already agreed to this, the specific provisions, so Mr. Chairman, I really would like to support your methodology. However, the adaptions of ad referendum, which are increasing in number, will ultimately, could actually, muzzle states. So, we should not in any way restrict the sovereign right of states to to express their views on the wording or the provisions of this convention.
without mention of 6, 7 was parked. On to article 8 - Interference with data, which is
when committed intentionally and without right, the damaging, deletion, deterioration, alteration or suppression of [computer data] [digital information].
Russia wanted "copying," added before "damaging". However the U.S, suggested copying was covered in Article 6 (Access), and other delegates. Russia wouldn't back down. .Parked. On to Article 9 - Interference with a device. No objections. On to Article 10 - Misuse of devices This essentially pertained to hacks aka "devices". Russia objected to
A State Party may require by law that a number of such items be possessed before criminal liability attaches. .
as vague. Parked. On to Article 11 - Forgery
deletion or suppression of [computer data] [digital information] resulting in inauthentic data with the intent that they be considered or acted upon for legal purposes as if they were authentic, regardless of whether or not the data are directly readable and intelligible
One would imagine this would include deep fakes etc, but that is creation rather than "deletion or suppression". Senegal took this up.
We have a proposal for the wording of the criminalization of the use of falsified computer data. We think that there should be a specific offense here through the insertion of a specific text that criminalizes the fact of using computer data that is falsified.
The Chair suggested they draft it as a separate offense, They agreed. Russia wanted to delete para 2
A State Party may require an intent to defraud, or a similar dishonest intent, before criminal liability attaches.
but was laughed off by EU, US, and even Egypt, since "may" indicates the provision is voluntary. No further objections. On to Article 12 - ICT related theft or fraud Again, Russia wanted "dishonest" changed to "illegal", but Australia pushed back.
We believe it's confusing and circular to add an additional unlawful intent element. And that dishonest intent is appropriate here. Dishonest intent provides clear parameters about when conduct will be an offence, where it is done with dishonest intent and not limited only to intentional conduct. So we consider that the existing references to dishonest intent actually enhance the flexibility of the convention, applying to a range of different legal systems.
There was much discussion on 'fraud' vs 'theft'.. Some wanted theft removed, however India, Iran, China and Russia all wanted to retain. At this point the session timed out and Meeting #3 was concluded The afternoon session Meeting #4 started out on Chapter IV - procedural measures and law enforcement,
Article 23. Scope of procedural measures Article 25. Expedited preservation of stored [computer data] [digital information] Article 26. Expedited preservation and partial disclosure of traffic data Article 27. Production order Article 28. Search and seizure of stored [computer data] [digital information] Article 29. Real-time collection of traffic data Article 30. Interception of content data
On Article 23 - scope SIngapore kicked things off by suggesting that the scope be tightened to the offenses define in Articles 6 to 16, A lot of countries supported this. The US had reservations: 1) 6 to 16 still being defined 2) "we don't yet know the fate of article 17" Article 17 reads
Article 17. Offences relating to other international treaties States Parties shall adopt such legislative and other measures as may be necessary to ensure that offences established in accordance with applicable international conventions and protocols also apply when committed through the use of [a computer system] [an information and communications technology device].
CARICOM wanted Article 17 to be moved out of the Criminalization Chapter to elsewhere in the Convention, Iran wondered about the meaning of the word 'specific' in the phrase "specific criminal investigation". Others responded that it was required as a safeguard against creep. Russia opposed Singapore, saying
We do not think that law enforcement bodies at the national level, we don't believe that they shouldn't have the opportunity to use all possible authority and measures to prevent and counter this kind of these kinds of offenses.
They also wanted some mention of 'prevention', and to delete 'specific', suggesting it would lead to "legal uncertainty". However, nobody else supported them. Article 23 was parked. On to Article 25. Expedited preservation of data. This includes the wording
State Party shall adopt such legislative and other measures as may be necessary to oblige that person to preserve and maintain the integrity of [those computer data] [that digital information] for a period of time as long as necessary, up to a maximum of ninety days, to enable the competent authorities to seek its disclosure.
Many countries, led by Russia, wanted 'maximum' changed to 'minimum'. India wanted 'person' changed to 'legal person'. On Article 28 - Production, Austria Before Russia was cut off earlier, they talked about this, and wanted emphasis on "state party's territory" for clarity. It would seem that this clause does not mean that that States are required to produce for external case, however Austria later cautioned
If you say that the competent authorities should search or similarly access in the territory of that state party, that means that the access is going to take place in the territory of the state party, but the data or the computer system might be anywhere else in the world. And I was wondering, those delegations who hold sovereignty aspects very dearly, whether they would want to live with this effect that access is going to take part in Austria, for example, but the data or the computer system would be in Russia or in China. I don't think we want to have that effect. Right? I hope we can all agree to that.
Russia said they would think about that. On articles 29 and 30, the 'snooping' clauses, the EU withdrew it's earlier objections, based on proposed safeguards in Chapter V - International cooperation. Malaysia, Switzerland, Mexico voiced similar concerns. Norway noted that all these articles are dependent on Article 20 - Statute of Limitations as a safeguard, but Article 20 actually calls for extending or even suspending SoL's for 'serious cybercrimes'. Australia argued that determining the "serious' threshold should be left to states, rather that the definition in Article 2 (h)
“Serious crime” shall mean conduct constituting an offence punishable by a maximum deprivation of liberty of at least four years;
Then focus turned to articles 31 to 34
Article 31. Freezing, seizure and confiscation of the proceeds of crime Article 32. Establishment of criminal record Article 33. Protection of witnesses Article 34. Assistance to and protection of victims
Article 31 - Japan regretted that its earlier proposal to limit confiscations to serious crimes had not garnered support, but was trying again. Sweden, Albania, &.Iceland support. EU supports and wants to limit the scope to 6 to 16. Costa Rica, Korea, Vanuatu and Paraguay supportalso for 32, 33. Nigeria, Iran oppose. China opposes as premature / repetitive Russia also opposes saying:
in fact,we don't understand what doubts countries can have the country the reference to to specific articles rather than the scope of the current convention.
Re; "serious" language, presumably in japan's proposalUS notes para 10 wording
Nothing contained in this article shall affect the principle that the measures to which it refers shall be defined and implemented in accordance with the provisions of the domestic law of a State Party.
I guess, agreeing with China & Russia that there is no real reason to be specific, since states can define for themselves. Article 32-33. Singapore wanted scope changed to 6-16. Russia wanted the opposite, 34 too..Australia wanted to delete "in good faith" pertaining to witnesses, for more flexibility. Presumably bad faith witnesses also need protecting? Tanzania wants to change 'domestic law' to 'domestic legal system' and also add the word 'prosecutive' to the existing 'investigative'. Article 34 ( Victims) Egypt wanted to get rid of "with relevant stakeholders', and drop the "particular circumstances' para 8 entirely (gender). Argentina and Tanzania wanted to add "subject to its domestic law." Canada spoke up for gender. USA wanted to limit the scope from "Convention" to Articles 6 to 16, and yay to gender, NZ, Colombia, Iceland, Ecuador, Costa Rica, Panama, Albania also yay to keeping gender in there. Nigeria is non-committal, saying
Nigeria is paying very close attention to the reference to gender in article 34 paragraph four, I understand that different jurisdiction have different understanding of gender, especially in this context. For Nigeria, gender in this context means sex, and if perhaps, it cannot any other meaning other than what is defined in domestic legislation. Perhaps it may be important to further clarify that as we make progress.
Norway said
we have supported at the last session more inclusive language in Article Five, we did agree to delete the language there, but that was really that was really because we saw that it was included other in other places. So deleting it also here would would not be acceptable.
On 33 and 34, Burkina Faso wants to add protection for whistleblowers, experts, and witnesses. Russia, Canada, Mauritania, Nigeria support.. Finally, Yemen argues for applicability to trump scope restrictions
We are now discussing offenses that had to do with information, and if they are serious, and they develop from day to day, and there are new crimes that appear every day. And we are looking here at an expanding in applicability, especially that the crimes referenced from six to 16 are not are not all of the crimes in ICT. So therefore, we were for expanding the applicability and the scope of application in procedural and content as long as the purpose here is to promote cooperation in fighting cyber crimes. So therefore, we believe that combating it, combating these crimes would would include all crimes electronic or content, even at any level or at the minimum level, as we say, and because we discover new crimes and these crimes develop and they they reappear and therefore, if we were to resolve the scope of applicability,
--