sou · GQB3112 · 2003-01-01 00:00:00 — National laws have gradually been adapted to IT, normally as a re- sult of actions taken by various international organisations. Com- puter-related crime was discussed by an ad hoc who in 1986 suggested a list of acts, which could constitute a common denominator between the different approaches taken by member countries. The work continued within where expert committees elaborated recommendations on computer-related crime (No. R (89) 9) and on problems of criminal procedural law connected with information technology (No. R (95) 13). These reviews of European criminal laws and the rec- ommendations to concerted actions formed the basis for the IT- related amendments in 1986 to the Swedish criminal law provi- sions regarding e.g. fraud, usury, unlawful use and breach of data secrecy (Government 1985/86:65). It is true that similar amendments were introduced in other European countries and resulted in a co-ordination of national penal law concepts, but only a binding international instrument may ensure the efficiency in the fight against these new phenom- ena. Consequently, established a Commit- tee of Experts on Crime in Cyberspace to provide such an in- strument. carried out a comprehensive analysis of cy- ber-space offences and the new dimensions created by IT. The sometimes detailed considerations can be instanced with the spe- cial attention paid to the criminal law aspects of electromagnetic emissions radiating, for example, from monitors. In the outcome of the committees considerations – a Conven- tion on Cybercrime – was opened for signature. It aims at har- monising the domestic criminal law in the area of cyber-crime, providing domestic criminal procedural law powers for the inves- tigation and prosecution of such offences as well as other com- puter-related offences and establishing fast and effective interna- tional co-operation in this field. In the following, some examples will be given of the corresponding domestic debate and the need from a legal perspective for a deep understanding of the prerequisites given by IT. The background is the findings of N a committee, established by the Government, which in issued the report Information and the new InformationTechnology – criminal and procedural legal aspects (SOU 1992:110), and N a commissioner (), appointed by the government to consider the need for IT-related amend- ments in the aforementioned environment (Ju 1997:A), who tabled a memorandum of 17, 1998, Penal law and information technology – a basic inventory of the need for legislation. The aforementioned committee started from a description of data and its character – demonstrating that the difficulty in under- standing the IT-related legal issues is partly due to the fact that we are moving in the borderland between concrete and abstract objects. Some of the self-evident presumptions underlying a tra- ditional viewpoint do not exist in the IT-environment. The com- mittee assigned this digital category the term quasi-material and endeavoured to interpret or suggest amendments to the law, headed to avoid artificial concepts with too attention paid to IT. The commissioner, on the other hand, took his starting point in the traditional physical objects, and was apparently non- committal on the subject of technical IT-related issues. He found no need for any new specific criminal law provisions and recom- mended considering only a few minor amendments to the existing penal law. Other matters were to be solved within current legisla- tion, according to the commissioners findings. None of these approaches have yet been adopted by the Swedish legislature, but most likely it will have to come to a deci- sion as a result of the Convention on Cybercrime, which has been signed by and numerous other states.1 The penalty on falsification of a document is a good ex- ample of an area where the choice of approach to IT will be sig- nificant for future legislation and case law. The definition of document according to Chapter 14, Section 1 of the Swedish Criminal Code includes several concealed demands as a part of the word document. It is an implicit qualification within the document that it shall give self-dependent existence to the infor- mation and via its physical bounds provide a clear distinction from other physical objects. Additional demands to qualify a re- cord as a document are that it must have certain durability and the ability to convince of its authenticity, i.e. to give the reader reason to believe that the document originates from the individ- ual who, according to the document, is seen to be the originator. The need for legal acceptance of signed electronic data formed the basis for the aforementioned committee, which fo- cused on legal protection for the authenticity of electronic substi- tutes for traditional paper based originals. The commissioner, on the contrary, argued that criminal law protection emanating from such IT-routines was unnecessary and that it would be far- fetched to compare electronic signatures with traditional signa- tures. Instead the commissioner recommended an approach based on who could be regarded as issuer of the data . When a record is transmitted, e.g. via electronic mail, the commissioner mentioned, as one possible solution, considering the as is- suer of his hard disk and the addressee as the issuer of his storage medium – he should be regarded as communicator of the infor- mation in its present state on the computer where the received copy is stored. Further, the commissioner stated that electronic mail, deleted after being read by the addressee, has more in common with a conversation over the telephone than with tradi- tional paper documents. However, taking the issuer of the storage medium – fur- nished with numerous (signed) electronic messages – as starting point, would bring back an outdated approach and the penal sanc- tions would probably be fictitious as the user normally does not know on which physical disk the message will be stored, where it is held and who owns or otherwise has right of disposition of the data . The protected interest is the need to be able to trust the statement on the origin of the text, not the genuineness of the disk drive. Many have not fully understood that all information is broken down to ones and zeros and that the unique aspect is re- lated to a unique pattern of data rather than to unique physical examples; c.f. the implicit qualification within the document that it shall be an original. A few years later the committees stress on the protection of data and its authenticity, more or less independently of its stor- age, was given support by the EC-directive (1999/93/EC) of Parliament and frame- work for electronic signatures. Further, a contribution to the legal recognition of electronic documents has been given by the Con- vention on Cybercrime, which imposes an obligation to establish as criminal offence the input, alteration, deletion, or suppression of computer data, resulting in unauthentic data with the intent that it be considered or acted upon for legal purposes as if it were authentic. The focus on the difference between data and the data used to perform processing of the data is already evident from the conventions choice of terms (Art. 1). The principles of how to determine whether a record is au- thentic have for decades been a moot point of legal doctrine. The aforementioned commissioners statement – that it in principle does not matter whether the or receiver of a record should be considered the issuer of the copy stored on the receivers hard disk – is obviously not correct. In Swedish law, very simply, the authenticity of a traditional document is judged by asking who, according to the document, is the guarantor of the original physi- cal example. If this information is true, the document is authentic.2 This physical approach is not compatible with the quasi-material character of data and the of Appeal has recently con- firmed this by rejecting a count on document forgery consisting of issuing unauthentic telefax print-outs or electronic records pro- duced by word processing programs.3 One may compare with German penal law, according to which the judge will have to de- cide who is the issuer of the text, a scheme compatible with IT and adopted for the Swedish laws on (signed) electronic documents for the customs and taxation legislation. Consequently, the difficulty in adapting the legislation to the IT environment partly derives from the need to reconsider tradi- tional legal concepts, debated even before the introduction of computers. 5 Protected electronic places Another area where the approach to establish legal protection in the IT field will be especially decisive for the lawmaker is whether the criminal law protection shall be based on N the existence and location of an electronic substitute of a certain physical place, the integrity of which is reserved for the possessor (spatial integrity) independent of the sen- sitiveness of the stored data, or 2This should not be confused with criminal acts committed by making false statements in an authentic document (cf. false certification, Chapter 15, Section 11 of the Criminal Code). 3Svea Hovrätt sentence of 31 2002, docket number B 5358-01. N the customary limitation in the IT environment to immate- rial information as such independent of its storage space. The difference between rules and regulations applicable to imma- terial information on the one hand and a persons protected cus- tody of digital data and documentary evidence on the other hand seems too have been neglected.4 This distinction, however, is reflected in the Convention on Cybercrime, ordering legislative measures to establish as a criminal offence unauthorised access to the whole or any part of a computer system. The protection of computer data is addressed in other sections of the convention. The survey of countries penal laws, carried out by on Crime in Cyberspace, showed the Swedish choice of a diver- gent approach, namely that of giving legal protection by a penal provision regarding breach of data secrecy, formulated as unlaw- ful access to a recording for automatic data processing. Should this provision be understood as a regulation regarding informa- tion as such or does it make certain methods of obtaining infor- mation a criminal offence?5 Another problem concerns the interpretation of the notion unlawful. Is it meant to exclude liability when consent is given, when there exists a lawful dealing (e.g. statutory handling of protected information) or will this restriction have a bearing on the legal concepts of authority versus competence? Consider the example in chapter of a press reporter who hacks into a com- puter, pleading that the constitution relieves him of criminal li- ability.6 the Swedish constitutional protection apply or will the criminal law protection be valid, regardless of the electronic environment? The aforementioned commissioner has suggested two alter- natives; (1) a criminal law protection of physical objects such as disk drives and (2) the protection of information as such. A re- port recently issued by a tasked with considering the protection of personal data in work- ing life has proposed that, as a general rule, there should be a ban on employers knowingly making themselves acquainted with the contents of an employees private electronic mail.7 However, it is not clear whether the criminal code penalises such an act and to 4See also my other contribution to this anthology, Lawmaking and IT. Reflection on the for New Concepts and Categories of Thought. ibidem, part 2 on Electronic places and digital bearers in the legal system. ibidem, part 3. 7Personlig integritet i arbetslivet, SOU 2002:18. what extent, if any, an enactment of the proposal will have effect on the interpretation of the criminal code. Some employers state that they may read anything stored on their computers. Their ad- versaries refer to the Human Rights Convention and the Swedish constitutional protection from search of letters or other confiden- tial items of mail and from secret wiretapping. The aforementioned committee chose a more complex ap- proach, covering the protection of data , data representing (immaterial) information and the (virtual) custody, analogous to traditional physical places of storage.8 It is necessary to clarify to what extent (virtual) electronic places and electronic instruments are protected by criminal law and to tie the legal protection to the infrastructure in cyberspace. Tech- nical and administrative solutions to these needs are already in place, by way of passwords, cryptographic procedures to furnish with strong authentication of users, advanced electronic signa- tures, digital rights management systems, and the like. The taking of physical objects as a starting point, as sug- gested by the commissioner, will strike a discordant note with the actual usage of IT. The new dimensions created by IT and the virtual substitutes for traditional instruments and closed places of storage need to be taken into consideration by the legislator and in case law, to give legal effect to the borderlines and protecting mechanisms already accepted by the users of IT. See ibidem part 2 on electronic places. The Melting Pot Paradox of Structured 1 A platform for true action Sticking to documents as a basis for a discussion on development trends in information society might be regarded as somewhat old- fashioned. But for all the growing impact of multimedia on the legal domain, the document concept still plays an important role as a basis for legal discussions, above all because law is still pro- duced in the form of text entities commonly referred to as docu- ments. Typical document instances are acts and ordinances, de- cided cases, contracts and , conventions and so forth. Ac- tually, a more appropriate expression in this context would be virtually tangible documents, meaning that these kinds of objects representing law may occur in electronic as well as in paper for- mats. The introduction and application of IT has, furthermore, led to a state of art where the boundaries of legal documents are not necessarily defined beforehand. The Swedish Principle of Publicity, for instance, is characterised by a right of access to dy- namic constellations of data. This presentation sets out to show that structured documents accomplished by means of standardised markup languages ought to be regarded as a highway route on the map of an information security characterised by security. The somewhat obscure title The melting pot paradox of structured documents is chosen in order to capture the embedded and intended contractions in the approach advocated here, viz order achieved by encumbering text with (mainly elements and attributes) and static views of structures as a basis for dynamic actions. The grooves and moves in this context are trusted public and business activities in terms of information retrieval, knowl- edge management, automated decision-making, e-commerce, etc. Trust implies information security conventionally comprising the criteria of availability, confidentiality (secrecy), integrity, ac- is professor at the , Stock- holm University and . She gained her doctorate in 1992 with a thesis on legal automation in the Swedish public sector. She is currently managing a research project that in- vestigates the possibilities of cross-fertilisation of advanced methods for se- curity enhancement and applications of XML in the legal domain. countability and non-repudiation. Clearly, these bricks of security have legal implications both in terms of system design and management as well as regards applicable rules and regula- tions. In the following it will be sufficient to let these concepts serve as a general framework for the discourse. Structured documents, as a tool for legal validity in a security context is the mission. This statement may in itself be regarded as a content-heavy expression that can be the object of an analysis resulting in marked-up elements and attributes. A supporter of standardised markup languages is thus expected to take a dy- namic approach to text, while those not yet informed of the po- tentials of the W3C Recommendation XML (Extensible Markup Language, ) might still be stuck in thinking only about flat representations of key words attached to the beginning of a document or search words inserted in an (in- verted) index file. 3 Why markup languages? It is high time now for a brief explanation of what document markup is all about. An XML document may be well formed or governed by a DTD (Document Type Definition) or schema. A document type definition defines the composition of a set of documents (e.g. laws and court cases). It contains information about document elements, the logical order of these elements and their frequency, etc. A DTD is expressed in XML and may be stored in a data file outside the document. There are different ways of explaining the underlying mean- ing of a DTD. One could focus on the purpose of a DTD as a method of structured information description in context. This implies that a DTD does not necessarily have to be related to a certain type of document but rather to some particular kind of in- formation. A skilfully designed DTD with corresponding markup makes it possible to adjust the use of a particular document to a variety of purposes, i.e. without later having to change the markup. XML then plays the role of an enabling tool, making it possible, for instance, to find information that is of interest on a This is an indication of how important a pre- paratory document analysis is. A schema can be generally described as a specification or formal definition of the constraints on the content of an XML document, aiming at both structure and functionality. One way to specify a schema is to use a DTD, but XML schemas can model other kinds of structured data as well and are in principle more expressive. An important feature of an XML schema is the possi- bility of integrating database functionality and communication between applications. A major purpose of an XML schema is in- deed to make it support data typing (integer, date, etc.) and thereby facilitate XML data interchange with conventional data- base systems. XML schemas are written in XML and have been developed for use on the Internet and are therefore co-ordinated with other W3C specifications. A document instance is the encoded document itself con- taining data (e.g. legal text), markup (document element tags) and a DTD reference (if not present in the document). The markup elements surrounding the text are called tags. In the sim- ple example below the tags are displayed in bold characters. The value of attribute type ID is shown in the article tag. A3-95- 46-EC here stands for Article 3 in the Protection Direc- tive. 'A3-95-46-EC'> Scope Article 3 This Directive shall apply to the processing of personal data or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing sys- tem or are intended to form part of a filing system. In comparison with HTML, the dramatic difference is that while HTML aims at presentation of text on a (computer) screen, a ma- jor purpose of XML is to allow for semantic expressiveness. Fur- thermore, the HTML DTD consists of a predefined tag set whereas an application based on XML is open to any kind of cus- tomised vocabulary. Of utmost importance is the inherent valida- tion component of an XML application governed by a DTD or schema. In practice this means that a marked-up document is validated against the predefined logical constraints (such as de- cided order of elements) and the predefined number of occur- rences of particular elements. 3.2 XML and security So far so good, but is the XML approach secure and what makes it at all worth investigating in terms of legal implications? The purpose here is to convey a strategy for answering this question. The aim is thus not merely to satisfy curiosity but to make the approach serve more practical interests. A legally founded check- list of XML related security-enhancing factors would no doubt enhance the rule of law and thus promote trust in system design based on XML solutions (see further Section 5.3 below). One starting point is that modern document management re- quires co-ordination in order to meet demands for efficient pro- duction, supply and use. Apart from general needs to improve re- call and precision when retrieving information, there is also rea- son to consider, for instance, knowledge management attempts and exchange of business data in networks of various kinds. XML has a potential to function as a lever and a sound basis for all of these developments in modern information society. In this context it should be mentioned that XML also has a profound impact on substantive law itself, in particular in the fields of con- tract law, intellectual property rights and privacy protection. For instance, XML-messaging quite often comprises personal data processing in a legal sense (see the Protection Directive, 95/46/EC). It concerns requirements of consent from data sub- jects to collect, store and disseminate personal data. Furthermore, modern e-business models make it necessary to consider infor- mation duties, e.g. that the identity of a service provider must be clarified according to the EC Directive on E-commerce (2000/31/EC). Liability issues are also relevant in terms of an analysis of who is responsible for damages emerging as a result of the abuse of a transferred authentication. As indicated above, it all boils down to trust in global digital information and a need for legal information security in open as well as in closed computer-based networks. organisation, be it a private enterprise or a public authority, needs to reflect upon the handling of documents governing internal as well as ex- ternal actions. One highly important question, for example, is how far XML may support message authentication and electronic measures to prevent distortion of (document) content. The con- cept of authority here covers a wide variety of actions, e.g. au- thorisations to enter into contract, and law enforcement. Bearing in mind the initially mentioned checklist approach, the group of addressees or who will benefit may be described in the following way. To begin with, secure use of XML is rele- vant for commercial actors as well as for representatives of the This can be instanced with buyers who, in a pro- curement situation, are dependent on clarification of legal condi- tions governing a particular situation. In a perspective, the use of a checklist may be regarded as a business opportunity in terms of a legally founded security branding of offered solutions. Enhancing legal awareness among politicians and public officials for the purpose of efficiency, foreseeability, uniformity, open- ness, etc. is another obvious advantage. 3.3 XML as a tool The expression XML as a tool connotes, to begin with, markup languages in a broad sense, not least including SGML (Standard Generalized Markup Language), considering the impact of this ISO standard, dating back to 1986, on applications which are still running today (ISO 8879:1986). A markup language may be util- ised for representation of structures and contents, styling and communications. This implies that not only the core XML W3C Recommendation is of interest in this context, but also related standardisation initiatives such as XSL (Extensible Stylesheet language), SOAP (Simple Object Access Protocol), etc. Bearing this in mind, XML ought to be regarded as a symbol for a system development approach commonly including data management in terms of text.