sou · H1B339 · 2013-06-03 00:00:00 — Vi före- slår att avger förbehåll av innehåll att åtgärderna i artikel 20 endast tillämpas på sådana brott avseende vilka hemlig övervakning av elektronisk kommunikation kan användas och att förbehåll avges av innehåll att åtgärderna i artiklarna 20 och 21 inte tillämpas på meddelanden som endast överförs i ett elektroniskt kommunika- tionsnät av mindre betydelse från allmän kommunikationssynpunkt. Behovet av lagändringar mot bakgrund av direktivet Inom EU antogs 2005 ett rambeslut om angrepp mot informations- system. och rådets direktiv om angrepp mot informationssystem och om ersättande av rambeslut /222/RIF syftar till att ytterligare närma medlemsstaternas strafflagstiftning till varandra på området för angrepp mot informationssystem och att ändra och utöka bestämmelserna i rambeslutet. Vidare är avsikten att förbättra samarbetet mellan myndigheter och brottsbekämpan- de organ i medlemsstaterna. Förhandlingarna om direktivet är i allt väsentligt slutförda. Det återstår för EU:s institutioner att formellt anta den text som har godkänts av företrädare för rådet och Europa- parlamentet. Efter att direktivet antas har medlemsstaterna på sig att genomföra det. Tyngdpunkten i direktivet utgörs av materiellt straffrättsliga bestämmelser. Bestämmelserna överensstämmer till stor del med de som finns i konvention om it-relaterad brottslighet. Till skillnad från konventionen ställer direktivet emellertid precisa krav på vilka påföljder som ska kunna dömas ut för vissa av brotten i direktivet. Enligt artikel 9.3 och 9.4 ska brotten olaglig systemstörning och olaglig datastörning i vissa fall vara belagda med ett maximistraff på minst tre respektive fängelse. Svensk rätt uppfyller genom främst dataintrångsbestämmelsen direktivets krav på vilka handlingar som ska vara straffbelagda som olaglig systemstörning och olaglig datastörning. Straffskalan för dataintrång är böter eller fängelse i högst . Vi bedömer därför att straffskalan för dataintrång måste skärpas för att ska kunna genomföra direktivet. Av artikel 9.2 följer vidare att vissa straffbara befattningar med verktyg ska vara belagda med ett maximistraff fängelse. Svensk rätt uppfyller i denna del kravet på straffbarhet genom främst be- stämmelserna om förberedelse till brott, bl.a. förberedelse till data- intrång. För förberedelse till dataintrång är det inte möjligt att döma till fängelse. Det krävs alltså även av detta skäl en skärpning av straffskalan för dataintrång. I övrigt anser vi att svensk rätt redan uppfyller de krav som ställs i direktivet. En särskild straffskala för grovt dataintrång Straffskalan för brytande av post- eller telehemlighet sträcker sig från böter till fängelse . Enligt vår mening är den nuvarande straffskalan alltjämt väl avvägd. Något skäl att skärpa straffet för brytande av post- eller telehemlighet anser vi alltså inte finnas. Även straffskalan för dataintrång sträcker sig från böter till fängelse . Den nuvarande straffskalan för dataintrång ger emel- lertid enligt vår uppfattning inte tillräckligt utrymme för att kunna beakta allvaret i storskaliga angrepp mot informationssystem. Av olika skäl är det inte alltid möjligt att vid sådana angrepp mot infor- mationssystem tillämpa andra straffbestämmelser med högre straff- skalor, såsom bestämmelserna om sabotage, grov skadegörelse och terroristbrott. Enligt vår mening finns det alltså vid sidan av direk- tivet kriminalpolitiska skäl för att skärpa straffskalan för dataintrång. Vi föreslår därför att det införs en särskild straffskala för grovt dataintrång. Straffskalan ska sträcka sig från fängelse till fängelse . Vid bedömande av om ett dataintrång är grovt ska särskilt beaktas om gärningen har orsakat eller kunnat orsaka allvarlig skada eller har avsett ett stort antal uppgifter eller om gär- ningen annars varit av särskilt farlig art. Bestämmelsen om dataintrång ska inte längre vara subsidiär i för- hållande till straffbestämmelserna om brytande av post- eller tele- hemlighet och om intrång i förvar. Försök och förberedelse till grovt dataintrång ska vara straffbart. The Inquiry was tasked with analysing the need and making pro- posals for the legislative amendments required for to be able to accede to on Cyber- crime and its Additional Protocol. In supplementary terms of reference, we were also tasked with analysing the need and making proposals for the legislative amend- ments needed to implement the draft (not yet formally adopted) Directive of Parliament and of against information systems, repealing Council Framework Decision 2005/222/JHA. The remit also included considering the need for tougher penalties for breaches of postal or telecommunication secrecy, or data security, in order to allow greater scope to take more nuanced account of the seriousness of large-scale attacks on information systems. The need for legislative amendments in light of the Convention and Additional Protocol on Cybercrime has three main aims. The first is to bring national penal law provisions concerning certain offences more closely into alignment. The second is to ensure that there are national procedural law provisions that meet the need to investigate and take legal action against the offences dealt with in the Convention and other offences committed using computers, and to be able to utilise evidence in electronic form. The third is to pave the way for rapid and effective international co- operation to combat cybercrime. The Convention was opened for signature on and entered into force on 1 2004. So far, 51 states have signed the Convention and 39 states have ratified it. The majority of the EU Member States have ratified the Convention, along with the other Nordic countries. signed the Convention on the day it was drawn up, but has not yet ratified it. Several issues emerged during work on the Convention that were not settled. These were taken up in an Additional Protocol to the Convention. The Additional Protocol concerns the criminalisation of acts of a racist and xenophobic nature committed through com- puter systems. The Additional Protocol was opened for signature on 28 January 2003 and entered into force on 1 2006. So far, 37 states have signed the Additional Protocol and 20 states have ratified it. signed the Additional Protocol on the day it was drawn up, but has not yet ratified it. In our assessment, Swedish law already fulfils the requirements of both the Convention and the Additional Protocol with regard to penal law provisions, as long as the proposals in Government bill 2012/13:74 Falsification offences and offences against the truth are adopted by the Riksdag, and uses the possibility to set certain additional criminal liability requirements with regard to denial, gross minimisation, approval or justification of genocide or crimes against humanity. With regard to the procedural law provisions of the Convention, to which the Additional Protocol refers, we consider that legisla- tive measures are needed in order for Swedish law to conform to the requirements in Articles 16 and 17 of the Convention. The articles concern expedited preservation of stored computer data and expe- dited preservation and partial disclosure of traffic data. We also consider that there are grounds to consider introducing the kind of possibility to order the disclosure of information as part of a search referred to in Article 19.4 of the Convention, even though, in formal terms, Swedish law can be considered to already fulfil the requirements set. In other respects we consider that Swedish law already fulfils the requirements set, given the possibilities for reser- vations. With regard to the provisions of the Convention concerning international cooperation, to which the Additional Protocol refers in the same way as for the procedural law provisions, we consider that legislative measures are needed in order for Swedish law to conform to the requirements in Articles 29 and 30 of the Conven- tion concerning judicial assistance for the expedited preservation of stored computer data and expedited disclosure of preserved traffic data (which correspond to Articles 16 and 17 in the area of judicial assistance). In other respects we consider that Swedish law already fulfils the requirements set. Implementation of the Convention and Additional Protocol in Swedish law Article 16 of the Convention states that it should be possible to obtain the expeditious preservation of specified computer data. Preservation means that data is stored securely. The term data refers to any kind of data, i.e. traffic data, content data or subscriber information. The basic idea behind the article is that the preser- vation of data should be achieved less intrusively than by search and seizure. Furthermore, the intention is that it should be possible to preserve data from both natural and legal persons, including service providers. It should be applicable both to offences that are punishable under the Convention and other offences committed using a computer system, and generally to the collection of electronic evidence concerning an offence. In order to meet the requirements contained in the article, we propose that a possibility to order a person to preserve electronic data for a given period be introduced into the Swedish Code of Judicial Procedure. Anyone who has certain data stored in electronic form that can reasonably be assumed to be of significance to the investigation of an offence could thereby be ordered to preserve that data. The order should specify how long the data must be pre- served. The time period may not be longer than necessary, and no longer than 90 days in any case. If there are special grounds to do so, it should be possible to extend the time period by a maximum of 30 days. If possible the order should be issued in writing. Other- wise the person who is the subject of the order should receive written evidence of the decision as soon as possible. Communica- tions concerning the measure may not be forwarded without authorisation. The order should contain information to this effect. According to our proposal, a preservation order may not be issued to anyone who might reasonably be suspected of the offence or anyone closely associated with the suspect. Decisions to issue a preservation order should be communicated by the leader of the investigation or the prosecutor. A person to whom a preservation order is issued should be able to demand a judicial review of the order. Such judicial reviews should, where appropriate, be subject to the rules that apply to reviews of seizures. If a preservation order is issued to a service provider that is liable to store traffic data under the Act (2003:389), we propose that the same rules that apply for measures to protect data to be stored should also apply to data covered by the order. Furthermore, corresponding rules on the right to compensa- tion for costs and on adaptation for disclosure of data that apply to traffic data storage should apply to data to be preserved. In our view, in certain situations it should be possible to hold anyone who fails to comply with a preservation order criminally liable under the provisions on breaches of official orders contained in Chapter 17, Section 13 of the Penal Code. Under Chapter 9, Section 6 of the Swedish Code of Judicial Procedure criminal liability may be enforced against anyone who, without authorisation, breaches an obligation to conceal the fact that a preservation measure has been taken. In order to meet the requirements contained in Article 29 of the Convention, we propose that the possibility to order anyone who has certain data stored in electronic form that can reasonably be assumed to be of significance to the investigation of an offence to preserve that data should count as one of the measures covered by judicial assistance under the Act on International Judicial Assistance in Criminal Matters (2000:562). Under Article 17, the expeditious preservation of traffic data referred to in Article 16 should be possible regardless of whether one or more service providers were involved in the transmission of a communication. In many cases, several service providers are in- volved when electronic data is transmitted. It is therefore not neces- sarily sufficient to preserve traffic data from just one of the service providers in the chain of transmission. For it to be possible to order all service providers involved in the transmission to preserve traffic data, it must first be possible to identify them. For it to be possible to preserve data from those service providers that have been involved in the transmission, Article 17 states that it must be possible to gain expeditious access to the data required to trace the service providers and the path through which the communication was transmitted. Preservation under Article 17 should also be applicable both to offences that are punishable under the Conven- tion and other offences committed using a computer system, and generally to the collection of electronic evidence concerning an offence. In order to meet the requirements contained in Article 17, we propose that an obligation be introduced into the Electronic Com- munications Act for service providers to submit information con- cerning the other providers involved in transmission of the com- munication that is the subject of the preservation order to the authority that has decided to issue the order. In our assessment, no other legislative measures are needed in order to meet the require- ments contained in Article 30 of the Convention concerning judicial assistance for the expedited disclosure of certain traffic data. Under Article 19.4 of the Convention, national legislation must empower the competent authorities to order any person who has knowledge about the functioning of a computer system or measures applied to protect the computer data therein to provide, as is reasonable, the necessary information to enable searches of the IT environment to be undertaken. In our view, although the Swedish rules on the examination of witnesses in court can certainly be con- sidered to meet the requirements of the article in formal terms, there are still grounds to introduce a specific possibility to order the disclosure of information into Swedish law with the aim of facilitating searches in IT environments. This is because there is, according to the criminal investigation authorities, a practical need to introduce the possibility to issue this kind of order. We therefore propose a new provision in the Swedish Code of Judicial Procedure stating that anyone who can be assumed to be familiar with the functions of a given computer system or other re- quirements for accessing it and examining the data in it may be ordered to provide the necessary instructions for a search to be conducted. A decision to issue an order may be communicated by the investigation leader or the prosecutor. The order must be docu- mented. Under our proposal, if anyone can reasonably be suspected of the offence, the order cannot be issued to the suspect. may an order be issued to anyone who, if prosecution proceedings are initiated, would not be obliged to testify in the case or with regard to the data that the criminal investigation authorities wish to access. If the subject of the order refuses to disclose information, the in- vestigation leader or prosecutor may demand that they be examined before a court. This examination should be subject to the appro- priate parts of the rules that apply to the taking of evidence outside of a main hearing. A suspect may be given the opportunity to attend the examination if this will not harm the investigation. Article 6.1 of the Additional Protocol requires the criminalisa- tion of acts whereby a person intentionally, and without right, uses a computer system to distribute or otherwise make available to the public material which , grossly minimises, approves or justifies acts constituting genocide or crimes against humanity, as defined in international law or certain international courts. We propose that take the opportunity to declare a requirement that the offences of denial or gross minimisation are committed with intent to incite hatred, discrimination or violence against an individual or group on grounds of race, skin colour, origin, national or ethnic roots, or faith, because Swedish law would then meet the criminali- sation requirements contained in the article, primarily through the provisions on agitation against a national or ethnic group and incite- ment to rebellion. Articles 20 and 21 of the Convention concern the real-time collection of traffic data and the interception of content data re- spectively. We propose that enter a reservation of substance to the effect that the measures in Article 20 should only apply to offences for which secret surveillance of electronic communications can be used, and that a reservation of substance be entered to the effect that the measures in Articles 20 and 21 should not apply to communications transmitted solely through an electronic communi- cations network that is relatively insignificant from a general com- munication standpoint. for legislative amendments in light of the Directive In 2005, a framework decision concerning attacks on information systems was adopted within the EU. The Directive of Parliament and of against information systems, repealing Council Framework Decision 2005/222/JHA, aims to bring the Member States criminal legislation into greater align- ment in the area of attacks on information systems, and to amend and expand the provisions in the framework decision. A further aim is to improve cooperation between authorities and law enforcement bodies in the Member States. The negotiations on the Directive have, in essence, been concluded. It remains for the EU institutions to formally adopt the text that has been approved by representa- tives in the Council and Parliament. Once the Direc- tive is adopted the Member States have two years to implement it. The central point of the Directive consists of material criminal law provisions. These provisions largely correspond to those found in on Cybercrime. Unlike the Convention, however, the Directive sets specific requirements for the penalties that can be imposed for certain offences outlined in the text. Under Articles 9(3) and 9(4), the offences of illegal system interference and illegal data interference should, in some cases, respectively be punishable by a maximum penalty of at least three years or five years imprisonment. Primarily through the provisions on data security breaches, Swedish law meets the requirements con- tained in the Directive with regard to the actions that should be punishable as illegal system interference and illegal data inter- . The scale of penalties for data security breaches is a fine or a maximum of two years imprisonment. We therefore consider that the scale of penalties for data security breaches must be tougher in order for to be able to implement the Directive. Further- more, Article 9(2) states that certain the criminal use of various tools should be punishable by a maximum penalty of two years imprison- ment. Swedish law meets the punishability requirement, primarily through the provisions on preparation to commit an offence, in- cluding preparation to commit a data security breach. However, preparation to commit a data security breach cannot be punished by two years imprisonment. This is another reason why the scale of penalties for data security breaches needs to be tougher. In other respects we consider that Swedish law fulfils the require- ments set out in the Directive. A special scale of penalties for gross breaches of data security The scale of penalties for breaches of postal or telecommunication secrecy ranges from fines to two years imprisonment. In our view, the current scale of penalties is still well-balanced. There is there- fore no reason to introduce a tougher scale of penalties for breaches of postal or telecommunication secrecy. The scale of penalties for breaches of data security also ranges from fines to two years imprisonment. In our view, however, the current penalty scale for data security breaches does not allow suffi- cient scope to take account of the seriousness of large-scale attacks on information systems. For various reasons, in the case of such attacks on information systems it is not always possible to apply other penalty provisions involving higher penalty scales, such as those concerning sabotage, gross vandalism or terrorist offences. In our view therefore, even aside from the Directive there are criminal policy grounds to introduce a tougher scale of penalties for data security breaches. We therefore propose the introduction of a special scale of penalties for gross breaches of data security. The scale should range from six months to six years imprisonment. When assessing whether a breach of data security is gross, special attention should be paid to whether the act caused, or could have caused, serious damage, targeted a large volume of data or was otherwise of a particularly dangerous nature. The provision on breaches of data security should no longer be subsidiary to the penalty provisions concerning breaches of postal or telecommunication secrecy and intrusion into a safe depository. Attempts and preparations to commit gross breaches of data security should be punishable offences. lag om ändring i Härigenom föreskrivs att det i ska införas tre nya paragrafer, 27 kap. 16 och 16 a §§ samt 28 kap. 7 a §, av följande lydelse. Den som i elektronisk form innehar en viss lagrad uppgift som skäligen kan antas ha betyd- else för utredningen om ett brott får föreläggas att bevara upp- giften. I föreläggandet ska anges uppgiften ska bevaras. Tiden får inte bestämmas längre än nödvändigt och får inte överstiga . Om det finns särskilda skäl får tiden för bevar- ande förlängas med . Föreläggande får inte riktas mot den som skäligen kan misstänkas för brottet eller någon honom eller henne sådan närstående person som avses i 36 kap. 3 §. 1 16 § upphävd genom 1989:650. Föreläggande enligt 16 § be- slutas av undersökningsledaren eller åklagaren. Om det är möj- ligt ska föreläggandet ges skriftligt. I annat fall ska den förelagde få ett skriftligt bevis om beslutet. Meddelande om åtgärden får inte obehörigen föras vidare. Före- läggandet ska innehålla en under- rättelse om detta. Den som ålagts föreläggandet får begära rättens prövning av föreläggandet. För rättens prövning gäller i tillämpliga delar vad som sägs i 6 §. Undersökningsledaren eller åklagaren får förelägga den som kan antas känna till funktionerna i eller andra förutsättningar för åtkomst till ett visst datasystem och granskning av uppgifterna där att lämna de upplysningar som behövs för att ett beslut om husrannsakan ska kunna verk- ställas. Beslut om föreläggande ska dokumenteras. Om någon skäligen kan miss- tänkas för brottet får föreläggande inte riktas mot den misstänkte. Föreläggande får inte heller riktas mot den som, om åtal väcks, inte skulle vara skyldig att vittna i målet om omständighet som avses i första stycket. Vägrar den förelagde att lämna upplysningar får på undersök- ningsledarens eller åklagarens be- gäran vittnesförhör med honom eller henne äga rum inför rätten. Om förhöret gäller i tillämpliga delar vad som föreskrivs om bevisupptagning utom huvudför- handling. En misstänkt får be- redas tillfälle att närvara vid för- höret om det kan ske utan men för utredningen. Denna lag träder i kraft . Den som olovligen bereder sig tillgång till en uppgift som är avsedd för automatiserad be- handling eller olovligen ändrar, utplånar, blockerar eller i register för in en sådan uppgift döms för dataintrång till böter eller fängelse i högst .