EN    EN EN 
 
EN    EN  EUROPEAN COMMISSION 
Brussels, 30.9.2010 
SEC(2010) 1122 final 
COMMISSION STAFF WORKING DOCUMENT 
IMPACT ASSESSMENT  
  
Accompanying document to the 
  
Proposal for a 
 
DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL 
 
on attacks against information systems, and repealing Council Framework Decision 
2005/222/JHA
 
 
  
{COM(2010) 517 final} 
{SEC(2010) 1123 final} 
 
EN 2   EN Terms of Reference - Definition of basic concepts for the purposes of this Impact 
Assessment  
Botnet –  indicates a network of computers that ha ve been infected by  malicious software 
(computer virus). Such network of compromise d computers ('zombies') may be activated to 
perform specific actions such as attacks agai nst information systems (cyber attacks). These 
'zombies' can be controlled – often without the knowledge of the user s of the compromised 
computers – by another computer. This 'controlli ng' computer is also known as the 'command-
and-control centre'. The persons who control th is centre are among the offenders, as they use 
the compromised computers to launch attacks agai nst information systems. It is very difficult 
to trace the perpetrators, as th e computers that make up the botnet and carry out the attack, 
might be located elsewhere than the offender himself. 
Bot capacity –  the number of computers in a given botnet. 
Contact Point  – two relevant defi nitions exist. Firstly, in the context of the G8 network of 
contact points, Council Recommendation of 25 June 2001 on contact points maintaining a 24-
hour service for combating high-tech crime ( 2001/C 187/02), stipulates: "A desirable common 
standard would be that the unit de signated as a national contact poin t really is a specialist unit 
that applies recommended interna tional practice to investigations of high-tech crime, and that 
the unit is prepared to take any possible action, with due re gard, of course, to national 
legislation." (OJ C 187/5, 3/7/2001) 
Secondly, the Council of Europe's Cybercrime Convention defines a contact point as: "Each 
Party shall designate a point of contact available on a twen ty-four hour, seven-day-a-week 
basis, in order to ensure the provision of  immediate assistance for the purpose of 
investigations or proceedings concerning criminal offences re lated to computer systems and 
data, or for the collection of evidence in electronic form of a criminal offence […]" 
Both definitions are applicable . For the purpose of this Imp act Assessment, the essential 
function required from a contact point is to  react swiftly to requests for assistance.  
Critical Information Infrastructure (CII) – Information and Commu nication Technologies 
(ICT) systems that are critical infrastructures for themselves or that are essential for the 
operation of critical infrastructures (teleco mmunications, computers/software, Internet, 
satellites, etc.).1 
Critical Information Infrastructure Protection (CIIP) – the programs and activities of 
infrastructure owners, operators, manufacturers, users, and regulatory authorities which aim at 
keeping the performance of critical information in frastructures in case of failures, attacks or 
accidents above a defined minimum level of serv ices and aim at minimising the recovery time 
and damage.2 
Denial-of-Service (DoS) attack  – a denial of service attack is an act to make a computer 
resource (for example a website or Internet se rvice) unavailable to its intended users. The 
contacted server or webpage will show itself as "unavailable" to its users. The result of such an attack could, for example,  render online payment system s non-operational, causing losses 
for its users.  
                                                
 
1 COM(2005) 576 final, Annex 1, p. 19. 
2 Idem. 
 
EN 3   EN Information System  is any device or group of interconnect ed or related devices, one or more 
of which, pursuant to a program me, performs automatic processing of computer data, as well 
as computer data stored, processed, retrieved or transmitted by them for the purposes of their 
operation, use, protection and maintenance.3 An example of this is a computer or a server. 
Illegal System Interference  is the intentional serious hindering or interruption of the 
functioning of an information system by inputting, transmitting, damaging, deleting, 
deteriorating, altering, suppressing or rende ring inaccessible computer data, which is 
punishable as a criminal offence when committe d without right, at least for cases which are 
not minor (as defined in Fr amework Decision 2005/222/JHA). 
Illegal data interference  is the intentional deletion, damaging, deterioration, alteration, 
suppression or rendering inaccessible of computer  data on an information system, which is 
punishable as a criminal offence when committe d without right, at least for cases which are 
not minor (as defined in Fr amework Decision 2005/222/JHA). 
Large-scale  attacks are the attacks that can either be  carried out by big botnets, or attacks that 
cause considerable damage, e.g. in terms of disr upted system services, financial cost, loss of 
personal data, etc.. The damage caused by th e attack can have a major impact on the 
functioning of the target itself, a nd/or affect its working environm ent. In this context, a 'big' 
botnet will be understood to have the capacity to cause serious damage. It is difficult to define 
botnets in terms of size, but the biggest botnets witnessed we re estimated to have between 
40,000 to 100,000 connections (i.e. infected co mputers) per time span of 24 hours.4 
Malware  is computer software designed to infiltra te or damage a computer system without 
the owner's consent. It is distributed through a variety of means (emails, computer viruses, 
botnets). Intention is to obtain da ta (passwords, codes) in a fra udulent way, or to integrate this 
computer in a computer network destin ed to be used for criminal actions. 
Phishing is an electronic mail that convinces end users to reveal c onfidential data via 
websites that imitate the sites of bona fide companies (e.g. websites of banks). 
Spam  is electronic messages sent in large numbers  to internet users without their consent. 
These unsolicited electronic messages are usua lly of a commercial nature. Spam is the 
electronic equivalent of stuffing letter boxes w ith advertising materials that have not been 
requested by their recipients. 
Spyware  is software that is installed on a user 's computer without his knowledge. Such 
software transmits information on the user and his habits once connected to the internet. The 
information gathered this way is usually intended for use by advertisers. 
                                                 
3 Council Framework Decision 2005/222/JHA of 24 February 2005 on attacks against information 
systems, OJ L 69 of 16.3.2005, p. 67. 
4 Number of connections per 24 hours is the comm only used measuring unit to estimate the size of 
botnets. 
 
EN 4   EN IMPACT ASSESSMENT 
On a proposal for a Directive repealing Framework Decision 2005/222/JHA of 24 
February 2005 on attacks aga inst information systems 
1. PROCEDURAL ISSUES AND CONSULTATION OF INTERESTED PARTIES  
1.1 Background 
1.1.1.  Policy context 
The Commission's Work Programme for 20095 included a proposal to amend Council 
Framework Decision 2005/222/JHA of 24 Febr uary 2005 on attacks ag ainst information 
systems6 (hereafter: "FD on att acks"). The FD on attack s responded, as stated in its recitals, to 
the objective to improve cooperation between j udicial and other competent authorities, 
including the police and other specialised law enforcement services of EU Member States, 
through approximating rules on criminal law in th e Member States in the area of attacks 
against information systems. It introduced EU le gislation against the offences such as illegal 
access to information systems, illegal system interference and illega l data interference7, as 
well as particular rules on the liability of legal persons, jurisdic tion and exchange of 
information. Member States were obliged to take the necessary measures to comply with the 
provisions of the FD on attacks by 16 March 2007. 
On 14 July 2008, the Commission published a re port on the implementation of the FD on 
attacks8. In the conclusive part of the report, it was noted that signifi cant progress was made 
in most Member States and that the level of implementation was relatively good, but that 
implementation was still ongoing in some Member States. Further on, it was stated that "[s]everal emerging threats have been highlig hted by recent attacks across Europe since 
adoption of the FD, in particul ar the emergence of large scal e simultaneous attacks against 
information systems and increased criminal use of so called botnets. Th ese attacks were not 
the centre of focus when the FD was adopted. In response to these developments, the Commission will consider actions aiming at find ing better responses to the threat […]."  
The importance of taking further actions to st rengthen the fight ag ainst cybercrime was 
underlined in the Hague Programme on strengthe ning freedom, security and justice in the 
European Union, and in its successor, th e Stockholm programme and the Action Plan 
implementing the Stockholm Programme.
9  
At the international level, the Council of  Europe Convention on Cybercrime (CETS N° 
185)10, signed on 23 November 2001, is regarded by experts as constituting the highest 
international standard to date , since it provides a comprehens ive and coherent framework on 
the different aspects relating to cybercrime. To date, the Convention has been signed by 25 
                                                 
5 COM(2008) 712. 
6 OJ L 69 of 16.03.2005, pp. 67-71. 
7 See Definitions provided in the terms of reference of this report. 
8 Report from the Commission to the Council based on Article 12 of the Council Framework Decision of 
24 February 2005 on attacks against information systems, COM (2008)0448 final. 
9 OJ C 236 of 24.9.2005; OJ C 155 of 4.5.2010, pp.1-38. 
10 Council of Europe Convention on Cybercrime, Budapest 23.XI.2001, CETS n° 185. See also the Terms 
of Reference - Definition of Basic Concepts. 
 
EN 5   EN out of 27 Member States, and has b een ratified by 15 Member States.11 The Convention 
entered into force on 1 July 2004. The Europ ean Union (EU) is not a signatory to the 
Convention. 
This impact assessment discusses possible actions in this sense from a primarily criminal law 
and police cooperation perspective. Any su ch EU action has to be developed with 
consideration given to related EU  policies, in particular on cri tical information infrastructure 
protection, but also to internati onal instruments, such as the Council of Europe convention on 
Cybercrime, in order to avoid duplication of efforts.  
Following the entry into force of the Treaty of Lisbon, the possibility  of amending the FD 
does not exist anymore. According to the new le gislative framework in place, the existing FD 
can only be repealed via a Directive, which is  foreseen in the Commission's Work Programme 
2010. 
1.2 Consultation and expertise 
The issue of cyber attacks has been discussed in tensively in Europe duri ng the last few years. 
This led to extensive consultations at EU-level, in particular within the framework of the policy on network and information security. Thes e consultations have been of fundamental 
importance for the policy initiative discussed in this report, and a full presentation of these 
consultations and the conclusions  of them is given in the recent Communication from the 
Commission on Critical Information Infrastructure  Protection (CIIP): 'Pro tecting Europe from 
large scale cyber attacks and di sruptions: enhancing preparedness,  security and resilience' and 
the Impact Assessment report linked to that Communication.
12 The present Impact 
Assessment report generally refers to the documen ts mentioned, and therefore limits itself to a 
description of a number of specific consultations targeted at criminal law and police 
cooperation issues.  
On 22 May 2007, the Communication from the Co mmission 'Towards a general policy on the 
fight against cybercrime' was adopted.13 This Communication was preceded by extensive 
consultations with stakeholders and an impact assessment.14 Among other things, these 
consultations touched upon the issues discussed in the present report and should be regarded 
as a first step in the preparation towards a fu rther development of EU legislation and other 
actions to combat attacks against information systems.  
These initial consultations induced the Commissi on to start analysing di fferent policy options 
in detail, in view of both an update the EU  legislation on cybercrime and potential non-
legislative actions. In this context, an Inte r-service steering group wa s set up, including DG 
INFSO, MARKT, HR (formerly ADMIN) and DIGI T, in addition to the General Secretariat 
and the Legal Service. The steering group met on 27 November 2008 and on 18 February 
2009. 
                                                 
11 An overview of the ratifications of the Convention (CETS n° 185) can be seen at 
http://conventions.coe.int/Treaty/Commun/ChercheSig.asp?NT=185&CM=&DF=&CL=ENG 
12 "Protecting Europe from large scale cyber-attacks and disruptions: enhancing preparedness, security 
and resilience" Communication from the Commission to the Council, the European Parliament, The 
European Economic and Social Committee and the Committee of the Regions on Critical Information 
Infrastructure Protection, COM (2009) 149/1 
13 Communication from the Commission to the European Parliament, the Council and the Committee of 
the regions "Towards a general policy on the fight against cyber crime", COM(2007) 267 final 
14 As presented in the accompanying Imp act assessment report,  SEC (2007) 0642. 
 
EN 6   EN Informal consultations have been carri ed out continuously since at least 2006.15 In particular, 
specific issues concerning attacks against information systems were addressed in the context of a number of expert meetings  in 2007 and 2008. The main events where stakeholders have 
been consulted can be summarised in the following non-exhaustive way: 
• In preparation of the expert meeting held  on 15-16 November 2007, a questionnaire was 
sent to the Member States on EU needs in the area of fight against cybercrime 
• 15-16 November 2007: EU expert meeting on cybercrime in Brussels, with the 
participation of experts from almost all Member  States, both from public and private sector 
• 25-26 September 2008: EU expert meeting on cyberc rime in Brussels, with participation of 
experts from the almost all Member  States and the private sector 
• 30-31 October 2008: OSCE memb er states' experts at annual OSCE Police Experts 
meeting on "Fighting the Threat of Cybercrime" in Vienna (Austria) 
• 25-29 November 2008: EU seminar for the fi ght against cybercrime for judges and 
prosecutors in Durbuy (Belgium) 
• 2-3 December 2008: EU Member States' expe rts at annual Europol High Tech Crime 
Expert meeting in The Hague (The Netherlands) 
• 10 December 2008: Consultation of important thir d country partners to the EU at the G 8 
Roma-Lyon High Tech Crime Grou p meeting in Kyoto (Japan) 
• 16 December 2008: Consultation meeting with repr esentatives of EU business and industry 
federations in the area of information and network security in Brussels  
During most of the meetings mentioned above, di fferent concrete options  – presented orally 
or in the form of non-papers - for further EU legislative and other actio ns were presented and 
discussed in detail. A short discussion on future  plans was also held at the occasion of the 
presentation of the report on the implementation of the FD on attacks at the Council Working 
Group DROIPEN meeting on 21 January 2009. 
The general principles for consultations laid  down by the Commission have been followed, as 
a wide range of stakeholders, including go vernments, NGOs, the private sector and 
independent experts have taken part in the preliminary discussions. The outcome of these 
consultations and discussions will  be outlined below, but it s hould already be underlined that 
a high degree of consensus regarding the needs and possible actions has been observed among both governments and private sector experts.  
1.3 Impact Assessment Board 
The Impact Assessment was revised to take into account the opinion issued by the Impact 
Assessment Board (IAB) on 2 June 2009. All comm ents made by the IAB were taken into 
consideration in the present, revised Impact  Assessment. It was ex plained why enhanced 
penalisation and approximation of criminal laws against cybercrime is an effective, but not 
                                                
 
15 When the preparations for the Communication "Towards a general policy on the Fight against cyber 
crime" were started. 
 
EN 7   EN the only measure to combat cybercrime, the content of the preferred policy option was 
clarified, and the option was presented and a ssessed up-front. The issue of the appropriate 
level of action was elaborated further, and the level of penalties was better explained. 
The issue of the interaction between the EU's  action and wider international cooperation was 
broadly discussed, the impacts on third countries were included and a new policy option on updating the Council of Europe Convention was added. 
The exception for the legitimate use of IT-tools su ch as botnets in order to develop Internet 
security applicati ons was explained. 
Following these modifications, the Impact As sessment Board on 31 August 2009 issued a 
favourable opinion on the Report. The Board howe ver also asked for further explanations on 
certain issues related to the level of penalties,  the appropriateness of se tting penalty levels at 
EU level instead of the national level as well as regarding the need for the proposed level of 
penalties of five years imprisonment to be incl uded in the Report. These requests have been 
taken into account through additi onal explanations that  have been introduced  in section 2.4 of 
this report dealing with the underlying drivers of the problem, section 2.7 concerning the right 
to act, subsidiarity and f undamental rights and section 5. 6 proposing the preferred policy 
choice. 
2 P
ROBLEM DEFINITION  
For a better understanding of th e problem, the most important concepts are defined in the 
Terms of Reference - Definition of basic concepts (see above). 
2.1 What is the problem? 
The number of attacks against information systems has increased significantly since the 
adoption of the FD on attacks. One of the leadin g Internet Security firms reported that threats 
to confidential information (as opposed to pub licly available information, and not protected 
by a password) increased considerably in 2008, rising from 624,267 to 1,656,227 identified 
new threats in 2008.16 Moreover, a number of attack s of previously unknown large and 
dangerous scale have been observed, such as those in Estonia and Lithuania in 2007 and 2008 
respectively (the consequences of these att acks are detailed in section 2.1.1). In March 2009, 
computer systems of government and private organizations of 103 c ountries (including a 
number of Member States, such as Cyprus, Germany, Latvia, Malta, Portugal and Romania) 
were attacked by malware instal led to extract sensitive and classified documents. Finally, at 
the time of writing this assessment, the world witnessed the spread of a botnet called 'Conficker' (also known as Downup, Downadup and Kido), which has propag ated and acted in 
an unprecedented scale and scope since Nove mber 2008, affecting millions of computers 
worldwide.
17 Although it is impossible to determine ex actly how many were infected in the 
EU due to the lack of reporting and the densit y of the ICT infrastructure, the number is 
deemed to be considerable as demonstrat ed by the increasing number of threats.  
                                                 
16 http://eval.symantec.com/mktginfo/enterprise/white_papers/b-
whitepaper_internet_security_threat_report_xiv_04-2009.en-us.pdf, p.10. 
17 http://www.lemonde.fr/technologies /article/2009/03/31/virus-confi cker-catastrophe-ou-poisson-d-
avril_1174916_651865.html 
 
EN 8   EN Secondly, insufficient co-operation between the Member States, and specifically law 
enforcement agencies and judicial authorities wi thin the EU make a coordinated and effective 
response to these attacks diffi cult. Whilst the implementation report on the FD on attacks 
shows that a majority of Member States ha ve put in place permanent contact points as 
required by Article 11 of the FD on attacks, pr oblems persist as to their responsiveness and 
their capacity to react to ur gent requests for cooperation.18 
In line with the Council  of Europe Cybercrime Convention,  the role of a permanent contact 
point is to ensure the provision  of immediate assistance for the purpose of investigations 
concerning criminal offences related to comput er systems and data, or for the collection of 
evidence in electronic form. Such assistance sh all include facilitating, or, if permitted by its 
domestic law and practice, directly carrying measures, such as the provision of technical 
advice, the preservation of data, the collectio n of evidence or locating of suspects. Each 
contact point shall have the capac ity to carry out communications with the point of contact of 
another party on an expedited basis.19 
Indeed the existence of a cont act point is not a gua rantee for its proper f unctioning. In their 
notifications to the Commission, a number of Me mber States indicated that their respective 
contact points were in place, but not operatin g 24 hours a day as required by the FD on 
attacks. This indicates that they cannot res pond to urgent requests outside the office hours. 
Public-private cooperation is of ten hampered by the low effici ency/availability of contact 
points or their inability to deal with  private sector re quests for cooperation. 
Thirdly, there is still little data available concerning the follow-up given by the police and the 
judiciary to such attacks. Not all Member States  collect statistical data relating to cybercrime, 
such as fraud through the use of the internet . Moreover, available st atistics are often not 
comparable due to varying statistical methodol ogies among the Member States. For example, 
Luxemburg does not collect statis tical data specifically on c ybercrime, however the crimes 
categorized elsewhere sometimes involve the us e of the Internet and a computer. Italy does 
collect data concerning attacks against inform ation systems, but sub-divides these attacks 
according to 6 different classifications.  
2.1.1 Types of attacks 
A number of ways to carry out an attack ha ve been observed. However, most important and 
threatening are botnets (see terms of refere nce). Botnets have become an increasingly 
significant part of the cybercrime landscape, a nd are used to send spam and phishing e-mails, 
as well as to launch large-scale denial of serv ice attacks, or similar (i.e. any attack that 
disables an information network to fulfil its normal function).  
The underlying objectives can be of different char acter. Attacks can have criminal objectives, 
but they sometimes are used as one of the means in a larger campaign to exert pressure. 
Attacks often include one or more of the following elements: 
                                                 
18 Report from the Commission to the Council based on Article 12 of the Council Framework Decision of 
24 February 2005 on attacks against information systems, COM (2008)0448 final. 
19 See: http://conventions.coe.int/Treaty/EN/Treaties/Html/185.htm 
 
EN 9   EN • Extortion : criminals only unlock the computers afte r the victims pay a certain amount of 
money to the contro llers of the botnet;20 
• Sabotage purposes : disabling (critical) infrastructure, such as a security system, either to 
commit another crime, or in relation to a terrorist act; 
• Exerting illicit pressure on a state or an organization.21 This pressure can have various 
objectives. In some cases, pressure is exerte d through illegal means: there are a number of 
documented cases where viruses attacked site s related to certain political movements,22 or 
attempted to take out the sites and servers of governments.23 Economic pressure on a 
company can be exerted through for example, th e use of emails containing malware. These 
can also be used to undermine the reputation of a competitor. 
• Illegal information gath ering / spyi ng activities . Information and Communication 
Technologies (ICT) are increasingly used for pur poses of information gathering, setting up 
surveillance networks by breaking into com puter systems of economic competitors, or 
political opponents.24  
A strong tendency towards a stronger implicatio n of organized crime in the attacks has been 
observed; organized crime groups may, for instance hire hackers or other computer specialists 
to conduct a specific attack.25  
A large-scale attack may be launched against a critical information infrastructure of for 
example a financial institution, followed by a messa ge that the financial institution has to pay 
a ransom in order for the attack to cease.26 Networks of more than a million computers linked 
together by a command-and-control centre have been observed, and the damages caused by a 
coordinated attack through the use of  such network can be considerable. 27  
Attacks from such botnets can be very dangerous  for the affected country as a whole, and can 
also be used by terrorists or othe rs as a tool to put political pr essure on a state. This became 
clear in Estonia in April-May 2007, where im portant parts of the critical information 
                                                 
20 See: http://www.cpni.gov.uk/docs/botnet_11a.pdf , p11, indent 30; 
http://www.cisco.com/en/US/solutions/collateral/n s340/ns394/ns171/ns441/networking_solutions_whit
epaper0900aecd8072a537.pdf 
21 Jennifer A. Chandler, University of Ottawa, "Lia bility for Botnet Attacks", p. 16 Conference Paper, 
presented at the Oxford Internet Institute’s Confer ence ‘‘Safety and Security in a Networked World’’, 
September 8–10, 2005. Paper available at: http://c jlt.dal.ca/vol5_no1/pdfarticles/chandler.pdf 
http://cjlt.dal.ca/vol5_no1/pdfarticle s/chandler.pdf, footnotes 48-50 
22 http://www.sophos.com/pressoffice/news/articles/2004/12/va_maslanc.html 
23 ‘‘Yaha Worm Takes Out Pakistan Government’s Site’’ Security Focus (26 June 2002); available at:  
http://online.securityfocus.com/news/501 
There are several other cases like this documented, wher e political opponents attack the websites of rival groups 
or the state they oppose. However, similar att acks have been seen targeted against commercial 
organisations and companies. 
24 An example of this is the so- called "Ghostnet" where 1295 comput ers in highly sensitive places were 
infiltrated: embassies, foreign ministries and a number  of international organisations. The origins of the 
network have been traced back to China-based computers. The Economist, 4/4/2009.  
25 Chandler, "Liability for Botnet Attacks", p. 15 
26
 http://www.pdesign.net/SED /SED%20Articles/Web%20of%20Crime%20Enter%20the%20Pro
fessionals.htm 
27 See: 
http://www.informationweek.com/ne ws/security/government/showAr ticle.jhtml?articleID=172303265 
 
EN 10   EN infrastructure in government and the private sect or were taken out for days due to large scale 
attacks against them. As a result, the Parliament  was forced to close down its e-mail system 
for 12 hours. Due to extensive access attacks tw o major banks present in Estonia (Hansabank 
and SEB Eesti Unisbank) completely stopped thei r online business and bl ocked their contacts 
with foreign countries for a long time. There have  also been reports of attacks on the Estonian 
telephone system stating that at  least one public telephone excha nge was put out of service.  
A similar attack occurred in Lithuania on 28 June 2008 when more than 300 private and 
official sites were attacked from pr oxy servers located ou tside of Lithuania.28 
Although the total financial cost of a large-scal e attack, regardless of the criminal objectives 
behind it, cannot be estimated precisely, it is likely to be considerable. According to an 
estimate by the Estonian government , the cost of the cyber attack  against Estonia amounted to 
EEK 300 to 400 Million – roughly between EUR 19 and 28 Million.29  
The (especially indirect) damage caused by th e attacks against Lithuania could not be 
estimated precisely. The Lithuani an authorities estimated that the direct damage caused by the 
cyber attacks to one of the companies affect ed by the attack amounted to EUR 3,000. It is 
assessed that interruption of  Internet sites of severa l hundred companies and public 
institutions caused much higher indirect damage.30 
The low figure for direct cost is identified as a very limited number of computers that were 
damaged or destroyed due to the attacks. It  does not refer to damages caused due to 
interruption of services by companies and the government. 
Another, more precise estimation has been given regarding the financial cost of fraud crimes 
(phishing) conducted via different tools for la rge scale attacks: about USD 3.2 billion a year 
in the USA31 (2007 data).  
2.2 Who is affected and how? 
The victims of large-sc ale attacks against information syst ems can be found in all parts of 
society. The general public, consisting of the us ers of modern information systems, suffers 
negative effects, such as intrusion in their pr ivate spaces on-line, loss of access to increasingly 
vital information functions and fraud crime att acks targeted at them directly. There is no 
trustworthy estimation available on how many pers ons have been affected by the offences in 
question or how great the financial impacts are, but it is clear th at citizens are at risk due to 
different types of cyber attacks. Accordi ng to the 2008 Annual Report on the number of 
Internet crime complaints received by the Internet Crime Complaint Center (IC3) in the US, complaints of online crime hit a record high in 2008. IC3 received a total of 275,284 
complaints, a 33.1% increase over the previous y ear. The average individual loss amounted to 
USD 931.
32 No comparable data is yet available at EU-level. 
                                                 
28 http://www.irishtimes.com/newspaper/world/2008/0702/1214949259098.html  
29 There were costs to the government organisations re lated to the restoration of information systems and 
compensations for caused disturbances. In addition to the estimated financial cost, the total cost of such 
attacks is difficult to compile, as this involves not only the direct economic costs due to the attack, but 
also extra measures that were required to prevent further damage. Source: e-mail exchange with the 
Estonian Ministry of Foreign Affairs. 
30 E-mail exchange with Lithua nian authorities, April 2009. 
31 http://www.gartner.com/it/page.jsp?id=565125 
32 http://www.ic3.gov/media/annua lreport/2008_IC3 Report.pdf 
 
EN 11   EN Furthermore, critical information infrastructure s of central and local government, international 
organisations and private entiti es are under threat. This affect s the general security in our 
societies, and individual citi zens. Industry and business are also affected by the problem, 
mainly as victims, but also as providers of security solutions.  
Third countries – and relations between the EU a nd third countries - may also be affected, as 
attacks can be launched in third countries agai nst targets within the EU, and the other way 
around.  
2.3 The size and nature of the problem 
Statistics on the size of the problem are rare and often only estimates, as offences related to 
cyberspace in many cases are not reported, and sometimes go unnoticed. It is necessary to 
point out that the current dimension of c ybercrime has a remark able negative economic 
impact. UK's National Hi-Tech Crime Unit (NHTCU ) estimated the nation' s cost of computer 
crime at GBP 2.45 billion in 2005.33 According to the 2007 Co mputer Economics Malware 
Report, worldwide loss due to malware attacks was estimated  at USD 13.3 billion in 2006.34 
The same report notes interestingly that the overall cost of direct damages fell for the second year in a row due to more widespread  deployment of anti-malware technology.
35  
Another factor is that the goals of malware authors have shifted over the past several years. In 
fact, the report notes that it is the nature of  attacks that changed. According to the report, 
"cyber-criminals today are motivated more by a de sire to gain financially than to create 
havoc." Instead of releasing malware as a form  of electronic vandalism, they design malicious 
code to quietly use infected machines to acco mplish their objectives, such as sending spam, 
stealing credit card numbers, perpetuating click-fraud36, displaying advertisements, or 
providing a backdoor into the organization's ne twork. The second factor […] implies that 
although direct damages of malware may be d eclining, the indirect or secondary damages 
(e.g. loss of personal data and their use for othe r criminal activities) are likely increasing. For 
example, a spyware attack may cost a few thousa nd dollars in damages, mo stly in terms of the 
labour cost required to remove it from desktop machines. But if the spyware allows the hacker 
to sniff a user's password, which he then uses  to infiltrate the organization's network, the 
secondary damages resulting form the unauthorized access could be devastating."37 Therefore, 
the report suggests that the increase in indirect and secondar y damages, in spite of the slight 
decline in direct damages, is due to the finding that malware has become more sophisticated 
and more 'large-scale'. The threat is particular ly linked to botnets due to the wide variety of 
activities for which they are increasingly used, such  as to mount denial of service attacks, host 
'phishing' websites for identity theft38, financial fraud, and distribute malware.39 
                                                 
33 http://www.crime-research.o rg/news/28.04.2005/1189/ 
34 http://www.computereconomics.com/article.cfm?id=1225 
35 DG INFSO Safer Internet Programme: 
http://ec.europa.eu/information_society/activities/sip/index_en.htm 
36 Click fraud is a type of Internet crime that occu rs in pay per click online advertising when a person, 
automated script, or computer programme imitates a legitimate user of a web browser clicking on an ad 
for the purpose of generating a charge per click withou t having actual interest in the target of the ad's 
link. Click fraud is the subject of some controve rsy and increasing litigation due to the advertising 
networks being a key beneficiary of the fraud. 
37 http://www.computereconomics.com/article.cfm?id=1225 
38 In the case of phishing scams, the scammer (cyb er criminal, the person attempting to steal the 
confidential information) is attempting to acquire sensitive information such as usernames, credit card 
 
EN 12   EN In addition, according to the Symantec's 2008 "Underground Economy"-report, the cost of 
phishing attacks – an important aspect of the to ols used for large-scale attacks - reached USD 
2.1 billion for U.S. consumers and businesses in 2007.40 Symantec is on of the world's biggest 
anti-virus software companies. 
In terms of the potential capacity  of current botnets, the abov e-mentioned botnet ‘Conficker', 
with an alleged bot capacity number of 12 million infected computers (February 2009 
estimate41) and a capacity to send 10 bill ion of spam emails per day, is considered the biggest 
and fastest botnet currently affecting the world. It infected at a rate of more than a million 
computers worldwide per day.42 Inside the EU, damages from this botnet were reported in 
France, the UK and Germany. French fighter plan es were unable to take off after military 
computers were infected by Conficker in January 2009. The German  army reported in 
February 2009 that parts of its computer ne twork were infected by Conficker, making the 
websites of the German army, and the Defenc e ministry unreachable and preventing them 
from being updated by their administrators.43 Certain IT services, including e-mails, were 
unavailable for weeks to the UK Ministry of  Defence personnel in January/February 2009 
after they were infected by the Conficker botnet.44 
Although the origins of the attack s are still technically difficult to determine, Symantec enlists 
4 EU Member States in its top 10 of countries from where att acks are launched. According to 
these calculations, 15% of all worldwide detect ed attacks in 2008 were launched from inside 
the EU. To put this share into perspect ive, Symantec detected 1,656,227 new pieces of 
malware in 2008. Symantec has detected, over time , in total approximately 2.6 million pieces 
of malware. The number of new threats detected  in 2008 represents over  60% of this total 
number. Virtually all attacks have  been large-scale, given that  they used botnets with bot 
capacities averaging tens of thous ands of infected computers. Symantec also notes that 
whereas the US, Europe and Asia are the most targeted regions for la rge-scale attacks, the 
technical capability of botnets al so turns the targeted countries into the count ries of origin of 
such attacks by infecting computers there. This also demonstrates the difficulty in determining 
exactly the source and targ et countries of botnets.45 
 As already defined above in the terms of refere nce, large scale attacks usually take place in 
various locations. In a preparat ory step, a hacker (i.e. the cy ber criminal) takes control over 
                                                                                                                                                        
 
numbers, or bank account credentials. Source: Symantec Report on the Underground Economy, July 
07-June 08, p.82. 
39 Symantec Report on the Underground Economy, July 07–June 08, p. 19. See also footnotes 13 & 14. 
40 Consumer Reports.org source cited in Symantec Report on the Underground Economy July 07–June 08, 
p. 19; source: http://eval.symantec.co m/mktginfo/enterprise/white_papers/b-
whitepaper_underground_economy_report_11-2008-14525717.en-us.pdf 
41 Arbor Sert Security Engineer ing and Response Team, http://asert.arbornetworks.com/2009/01/two-
weeks-of-conflicker-data/ 
42 http://www.f-secure.com/web log/archives/00001584.html 
43
 http://www.bundeswehr.de/p ortal/a/bwde/kcxml/04_Sj9SPykssy0xPLMnMz0vM0Y_QjzKLd4
43DgwBSUGYAfqR6GIBIQixoJRUfW99X4_83FT9AP2C3NCIckdHRQAlYgRn/delta/base64xml/L2
dJQSEvUUt3QS80SVVFLzZfQ18zUkU!?yw_contentURL=/C1256EF4002AED30/W27PED65714IN
FODE/content.jsp 
44 http://www.theregister.c o.uk/2009/01/20/mod_malware_still_going_strong/ 
45 Symantec Global Internet Security  report, Trends for 2008, Volume XIV, Published April 2009. The 
report specifically mentions the Netherlands as 4th worldwide source of attacks with 8%, the UK, 
Latvia and France are also in the top-10. http://eval.symantec.com/mktginfo/enterprise/white_papers/b-
whitepaper_internet_security_threat_report_xiv_04-2009.en-us.pdf  
 
EN 13   EN one computer (this computer becomes the 'com mand-and-control centre', or 'C&C'), and is 
set-up by the hacker to remo tely control other computers through malware. These malware-
infected computers are called 'zom bies'. All 'zombies' together form a botnet. Attacks carried 
out through means of a botnet are large-scale attacks. The sequen ce for a botnet attack is the 
following: (1) computers are successfully attack ed by malware; (2) they are integrated in a 
botnet; and (3) they can carry out attacks upon command of the hacker. Otherwise stated, the 
attacked (compromised) computer late r becomes an attacking computer.  
 Cyber attacks can be committed across a number of  countries: e.g. a cyber criminal can be in 
the Netherlands, his command-and-control ce ntre can be in Germany, the compromised 
computers can be in Ukraine, and the attack can be directed against a bank in the UK. For that 
reason, it is incorr ect to assume there is a dominant link between the le vel of penalties in one 
Member State and the number of attacks origin ating from this Member State. Certainly, the 
level of penalties is an important  factor. However, other factors al so play an important role in 
selecting targets for attacks:   Attacks are most directed at countries/organizations where: 
• Economic and financial gains can be made  
• There is lesser degree of prot ection of computer networks  
2.3.1.  The issue of the (non-)availability of data 
Obtaining data on cyber attacks is difficult for a number of reasons: 
Computers are interconnected and data flows freely across bord ers. Malware can be launched 
in one continent to infect a computer, after wh ich the infected computer may attack another 
information system in another country or even c ontinent. It is therefor e very difficult to make 
geographical delimitations of c yber attacks. However, securi ty companies start from the 
presumption that targeted attacks (botnet a ttacks, fraud, phishing and the like) go where 
profits are to be made, i.e. in wealthy areas of the world, including the European Union.  
The available data is collected mainly by those companies at the source of combating 
malware, i.e. internet security firms. They how ever collect data largely on a global scale. The 
available regionalised data are often aggregated  data, or extrapolations of initial findings.  
To determine how many computers are affected in a certain geographical area, such as the 
EU, one should also know that (i nfected) computers can also form  a 'sleeping botnet', only to 
be activated (and thus become detectable) wh en the cyber criminal wants to commit the 
crime. In such instances, bot nets are difficult to trace.  
There is also the issue of ope nness of data: in the European Union, firms are less willing to 
share data on cyber attacks they experienced, fo r reasons of loss of reputation and potentially 
business opportunities. Most attacks are not re ported or do not become public, because the 
private sector, particularly small-size enterprise s, either does not record such data, or is 
reluctant to release such data not to draw a ttention to its system vulnerabilities. As an 
 
EN 14   EN example, the (UK) Federation of Small busine sses found that one third of SMEs do not report 
fraud or online crime to the police or to their ba nks because of a lack of faith in the system.46  
Furthermore, a great many firms dealing with in ternet security are US firms, as are their 
clients, leading to the fact that a majority of their first-hand data concerns the situation in the 
US market. These internet secu rity firms regularly publish reports based on the data they 
receive from their clients, albeit af ter this data was rendered anonymous.  
2.4 The underlying drivers of the problem  
The main drivers of the problem are the eas e with which damages can be caused by illicit 
activities on the internet, in pa rticular through large-scale attacks against information systems. 
Indeed, the internet today is host to mechanis ms and tools used or designed to infect 
computers with viruses capable  of launching attacks (incre asingly large-scale) against 
information systems.47 New criminal tools are being constantly developed, but the 
institutional response to this problem in terms of penalisation of spread ing such tools remains 
inadequate.  
The example of a too low level of penalisation is provided by the follow-up to the 2007 cyber 
attacks on Estonia: the only pe rson brought to justice was fined EEK 17500 (equivalent to 
EUR 1180), which was deemed by the Estonian aut horities as inadequate and not dissuasive 
enough. As a reaction to this, Estonia has sin ce increased penalties for large-scale cyber 
attacks to up to five years of imprisonment, or up to 25 years of  imprisonment if considered to 
be an act of terrorism. Following a legislative change, Estonia also in creased its spending on 
the fight against cybercrime, by establishing an international centre of excellence in Tallinn 
2008.48 In the case of large-scale attack in Li thuania in 2008, no person has been prosecuted 
to date (situation as of April 2009).  
General experience shows that a higher level of penalties tends to have the quasi-automatic 
effect that more resources are earmarked for law enforcement and judicial authorities to fight 
the corresponding crime. This should in particular  be the case when it is question of crime that 
requires considerable resource s to investigate, such as sophisticated attacks against 
information systems. It can be assumed that law enforcement authorities will not - primarily for economic reasons - allocate the substantial resources needed to fully investigate a crime 
when the penalties foreseen are so low that the cost of a complicat ed investigation would 
appear not to be proportiona te to the results of it
49. Higher penalties would thus have the de 
facto effect that more resources will  be allocated to fight the crime in question. This effect 
could be expected to be partic ularly important in the area di scussed in this report, where 
                                                 
46 http://www.fsb.org.uk/news.asp x?REC=5038&re=policy/news.asp 
See also: CSI Computer Crime and S ecurity Surveys, CSI 2008:22-23, according to this research, only 27 
percent of victims report cybercrime, and 47 percent of those interrogated agreed with the statement that 
they do "not believe that Law en forcement can help the matter". 
47 See: http://www.darkr eading.com/security/man agement/showArticle.jhtml?articleID=208808174 
48 See: http://news.bbc.co.uk/ 2/hi/technology/7208511.stm; 
http://www.baltictimes.com/ news/articles/18815/ 
49 This has been repeatedly explained to the Commi ssion to be a well know fact within European law 
enforcement by different authorities in Member Stat es and European institutions, although it has not 
been possible to find a scientific source to confirm this. 
 
EN 15   EN available resources for law enforcement are deemed inadequate to the scale of the problem.50 
The following higher prioritisation of the investigations of cybercrime is likely to lead to 
increased international coopera tion. The discrepancy between the high frequency of cross-
border cybercrime indicated in this report a nd the low number of cross-border requests for 
assistance observed must be considered to i ndicate that the recourse to international 
cooperation instruments is too rare.  
Further on, the currently low level of penaltie s for cyber attacks may prevent the use of 
special investigative technique s (e.g. covert operations and re mote searches online) in 
countries concerned, which are indispensable for investigating this type of crime. 
The penalties for cybercrime are currently not on par with its effects: the Estonian 
government considered the sentence given (approx. EUR 1180) for th e cyber attack as 
inadequate for the damage caused (EUR 19-28 million). The call for more adequate (stricter) penalties for cyber attacks has been made by all MSs and the private sector in the consultation 
process, and has also been raised by inte rnational organisations , such as the G8. 
Another factor which has a str ong impact on the weaknesses in i nvestigations and prosecution 
is insufficient cooperation at European and international level. The procedures and 
mechanisms for cross-border actions from law enforcement and other authorities - necessary 
in order to build up effective counter actions  against the attacks - are not sufficiently 
developed. Indeed, the majority of Member Stat es have put in place national contact points to 
respond to requests for assistance from other Member States, but thei r capacity to react 
swiftly and efficiently is still low, as there is no obligation for them to react. When a threat is 
detected by one Member State, it is important that this information is shared swiftly with 
other Member States, so that they can take measures to defend themselves against the threat or seek effective remedies. Given the potential of current tools, such as botnets, to spread 
large-scale attacks by infecting thousands co mputers a day, a rapid cooperation among the 
Member States is crucial to tackle the problem.
51  
As an example of the low level of cooperation:  France sent 3 requests for information and 
cooperation, and received 8 reque sts. The Netherlands sent ou t 13 requests, and received 31.52 
France and the Netherlands are the two top EU countries mentioned by Symantec as countries 
of origin of cyber attacks in data collect ed between January 2007 and October 2008. Given 
the number of pieces of malware detected  in 2008 (1,656,227), each capable of being 
exploited in a cyber attack, th e number of actual attacks is in the range of hundreds of 
thousands.  
Differences in national legislations on criminal ising acts of cybercrime also complicate an 
efficient response to cybercrimes. This applie s in some cases to the mere definition of 
cybercrime in the law, and the laws govern ing penalisation of in ternet-related crimes.53 Also 
                                                 
50 This has been confirmed to the Commission by law enforcement from different Member States and 
from Europol, for example, in a telephone conversa tion with the Europol High Tech Crime Centre on 
29 January 2010.  
51 See Council of Europe paper "The functioning of 24/7 points of contact for cybercrime." 2 April 2009. 
52 Idem. 
53 See also point 2.1 Problem definition, see above in the text. 
As an example of the differences in application of the law, we can look at the way “illegal system interference” 
is applied in Germany and France (FD 2005/222 JHA article 3, corresponding to the CoE Cybercrime 
Convention, article 5): this article implies the co ncept of serious hindering of the functioning of a 
computer system, which has, as such, been incorporated in French law (article 323-1 du code penal). In 
German law the hindering is not specified as dealing with a computer (or information technology) 
 
EN 16   EN concerning the applicable international law, differences exist: some Member States have 
ratified and incorporated the provisions of the Council of Europe Cybercrime Convention, 
whilst others have yet to do so. The reasons fo r non-ratifications vary from being political, 
structural or simply procedural or a combinati on of them. A number of EU  stakeholders in the 
consultation process indicated that while their co untry is in favour of ratifying the Cybercrime 
Convention, the issue of ratifica tion has not yet been put on th e agenda of their Parliament. 
Similar reasons, compounded with insufficient or  patchy awareness of risks related to 
cybercrime, have been evoked for failing to upgrade their legislation to EU standards. 
As an example: although Estoni a and Lithuania have upgraded their legislation, both Member 
States have asked the EU to take action also  at the EU level to avoid situation, where 
countries without adequate penalties would b ecome the weakest link, and targets for large-
scale attacks. As shown in the time sequence of  an attack, countries targeted by large-scale 
attacks can also become the 'source' of such att acks, as infected computers will be used as 
instruments in further attacks.54 
2.5 Weakness of the current legal framework and policy 
The current legal framework has two major weaknesses: 55  
• it does not foresee an adequate answer to larg e-scale attacks against information systems. 
This is due to the absence of specific legal provisions addressing bot nets and similar tools 
used to prepare and conduct a ttacks against information systems; and due to the absence of 
dissuasive penalties associated  with large-scale attacks.56 This makes prosecution more 
difficult, as the formal criminal offence linked to a large-scale attack may not be regarded 
as severe enough to justify ra pid cross-border law enforcemen t and judicial cooperation. 
Cybercrimes are prosecuted according to vari ous national laws, some of which are not 
specifically geared to attack s through computer systems. 
• it does not address the issue of  cross-border cooperation agai nst such attacks in a way 
which would ensure swift dealing with the problem. 
The need to strengthen the exchange of urgent  information on such offences was one of the 
main reasons why an obligation for Member States to use the existing network of operational 
points of contact 24 hours a day, seven days a week (24/7) was introduced in Article 11 of the 
FD on attacks. According to the FD's implemen tation report, the level of implementation of 
the contact points was relatively good, but th at implementation was still ongoing in some 
Member States. However, as a result of the cons ultation process, concerns  have been raised in 
terms of the contact points' effectiveness in pr oviding a response. This position is also in line 
with the G8 JHA Ministerial Declaration (29-30 May 2009), where the issue of further 
cooperation between the Member States concerni ng cybercrime has been raised: "It is also 
essential for States to give a technologically adva nced response, and to strengthen the existing 
                                                                                                                                                         
system, therefore allowing a subjective interpretation of the hindering. This might lead to a restriction 
of the criminalisation.  
54 See point 2.3 on the size and nature of the problem 
55 These areas of weakness have been identified as a result of consultations with Member States and 
stakeholders. 
56 Report from the Commission to the Council based on Article 12 of the Council Framework Decision of 
24 February 2005 on attacks against information systems, COM (2008)0448 final. 
 
EN 17   EN forms of international co-operation such as  the G8 24/7 High Tech Crime Points of 
Contact."57 
In addition, the consultation process and th e above-mentioned recent large scale attacks 
against information systems of some Member States have shown that the mechanisms intended for the Member States to immediately engage in oper ational cooperation to counter 
ongoing attack, are not as effective as they could be, particularly in term s of their visibility 
and responsiveness to assistance requests by  other law enforcement agencies and their 
openness to requests by the private sector a nd the possibility to exchange strategic 
information and share best practice with the private sector.
58 
To combat cybercrime effectively, cooperati on beyond the EU is necessary. Weaknesses in 
the structures for international cooperati on, and in the cooperation with governments and 
private sector, including independ ent experts, have b een identified, in pa rticular concerning 
the contact points.59  
2.6 How would the problem evolve, all things being equal?  
In addition to the existing Framework Deci sion on attacks, the Council of Europe's 
Convention on Cybercrime addresses the problem  of cyber attacks. Whereas the Convention 
remains the only international legal instrument to date, it shows certain weaknesses due to the 
fast-moving developments in cybercrime.  
The Convention does not specifically address the above-highlighted weaknesses regarding 
large-scale attacks, and an update of the Convent ion is not on the agenda for the foreseeable 
future.  
Furthermore, the existing structures for interna tional cooperation tend to  react too slowly to 
cyber attacks and other cybercrimes, principally due to th e inefficient functioning of contact 
points.60 The need for, and value added of an EU initiative to the Cybe rcrime Convention is 
outlined and discussed further down in this impact assessment. 
Given the lack of comparable and reliable quant itative data, it is very difficult to foresee how 
this problem would evolve in the absence of  further EU action. The activities of current 
botnets (see section 2.3 above) suggest that the pr oblem will continue to rise in the future if 
no counteraction is taken.61 Attacks have become an important field of activity for many 
                                                 
57 Final Declaration, G8 ministerial meeting of Ju stice and Home Affairs, Rome, 29- 30 May 2009, 
http://www.g8italia2009.it/static/G8_Allegato/declaration1giu2009.pdf 
58 See Council of Europe paper "The functions of 24/7 points of contact for cybercrime", 2009; Report 
from the EU expert meeting on cybercrime of 15-16 November 2007 (internal DG JLS document). 
59 See Council of Europe paper "The functions of 24/7 points of contact for cybercrime", 2009. Still to be 
released. 
60 See Council of Europe paper "The functions of 24/7 points of contact for cybercrime", 2009. Still to be 
released. CETS 185, article 35 states that contact poin ts shall ensure that they are able to coordinate 
with the responsible authority or authorities responsible for international mutual assistance or 
extradition. They thus act as  liaison offices in cases of international requests.  
61 It should be kept in mind that the EU is not the only organisation that could take action to fight the 
problem. NATO and Council of Europe, are also very active in the efforts to strengthen the fight against 
attacks as well as to strengthen network and inform ation security. In this context, NATO created a 
Cooperative Cyber Defence (CCD) Centre of Excelle nce (COE) in Tallinn, Estonia. However, NATO 
only deals with military infrastructure.  
 
EN 18   EN criminal networks at international level. Taking into account the recurrent dynamics of 
criminal markets, any lucrative activity attracts new criminal business. In addition, profits 
coming from the crime are re-invested in the same  or other criminal activities. From this, we 
can conclude that the criminal phenomenon is exp ected to remain stable or even grow if no 
effective deterrents are put in place in the near future. 
Finally, the risk that the confidence and trust in information systems in general would be 
seriously hampered if nothing is done needs to  be highlighted. Such a drop in confidence and 
trust could have very serious consequences fo r the growing information technologies sector 
and thereby for the economy in general.  
2.7 Right to act, subsidiarity and fundamental rights 
In accordance with Article 67 of the Treaty on  the Functioning of the European Union, the 
Union's objective shall be to provide citizens wi th a high level of safety. This objective shall 
be achieved by preventing and combating crime. 
Action of the Union in this fiel d should be taken only if and in  so far as this objective cannot 
be sufficiently achieved by the Member States  and can be better achieved by the Union. 
Cybercrime is a truly international problem, which only rarely can be fought in a mere 
national context. It is generally accepted that EU  and international actions are needed in order 
to prevent it. Most attacks cross also the borde rs of the EU. They affect all Member States, 
and there is evidence that a considerable propo rtion of it involves activ ities from one Member 
State to another. Information systems are ofte n technically interconnect ed and interdependent 
across borders. The consensus among experts is ther efore that internationa l as well EU actions 
are needed, and that the objectiv e of effectively combating such  crime cannot be sufficiently 
achieved by Member States alone.  
Experience also shows that Member States, w ho have not experienced large-scale attacks (or 
do not consider themselves to be ‘interesting’ targets – e.g. small countries) do not regard it as 
a political necessity to upgrade their legislation. However,  reacting only af ter a large-scale 
attack has occurred is too late  given that such an attack can  paralyse the whole country and 
cause considerable damages. Damages in one country often have cons equences in a number 
of other countries due to the interconnectedness of informati on networks and enterprises. 
There are clear indications that higher level of penalties in general will lead states and their 
authorities to give the fight against a specifi c crime higher priority (see section 2.4 above).  
A number of other Member States  (Malta, Portugal, Latvia), ha ve considered to upgrade their 
laws, but argued that this is preferable at EU level, as most attacks cross their borders and those of the EU. A national approa ch to cybercrime runs the risk  of producing a fragmentation 
and inefficiency across Europe. Di fferences in national approaches and the lack of systematic 
cross-border cooperation substa ntially reduce the effectivene ss of domestic countermeasures, 
partly because the interconnectedness of info rmation systems means that a low level of 
security in one country has the potential to in crease vulnerabilities in ot her countries. It should 
also be kept in mind that attacks against in formation systems are phenomena which make it 
particularly easy for the criminal to choose the country from which he or she will conduct the 
attack. With regard to this, measures to decrease the fragmentation of criminal law and penalties would reduce the risk th at the criminals will choose the location of their activities on 
the basis of the local criminal law ('forum shopping'). 
 
EN 19   EN Finally, it can be argued that a lack of European coordination - including of pe nalties - would 
make it difficult for the EU to take a unified  position in relation to third countries and in 
international fora. As explained in section 2.5 a bove, it is necessary to take the fight against 
cybercrime also beyond the borders of the Union.  
In addition, any action of the EU in this fiel d must respect fundamental  rights and observe the 
principles recognised in particular by the Ch arter of Fundamental Ri ghts of the European 
Union (EU Charter) and the Convention for th e Protection of Human Rights and Fundamental 
Freedoms (ECHR), and notably the protection of personal data and the right to freedom of 
expression, the right to a fair tr ial, presumption of innocence a nd the right of defence as well 
as the principles of legality and proportionality  of criminal offences. Member States, when 
implementing Union law, must do so in acco rdance with these rights and principles. 
The EU builds on the existing framework of  the Council of Europe Convention on 
Cybercrime, and goes beyond to tackle those prob lems indicated as weak nesses in the current 
legal framework. 
2.8 Views of stakeholders a nd Member States consulted 
The main outcome of the consultations was a wide consensus in favour of the Commission 
updating the existing legislation.62 The general orientations of the Commission policy in this 
area has already been welcomed, as expres sed in the Conclusions  of the JHA Council 
'Combating cyber crime' of 8 November 2007, and by the participants in the meetings of EU 
Member State experts on cybercrime orga nised by the Commissi on on 15-16 November 2007 
and 25-26 September 2008. 
The main remarks or suggestions expressed du ring the consultations ca n be summarized as 
follows: 
• A large majority of Member States  have, insofar as they have expressed an opinion (23 out 
of 27), agreed on the objectives and possible ac tions that the Commission has suggested in 
its 2007 Communication and, which were subsequently endorsed by the above-mentioned expert meetings in 2007 and 2008. Some Member States have underlined the importance of the Council of Europe Cybercrime Convention and made clear that they would be unlikely 
to give full support to an EU proposal whic h is not fully in line  with the Convention. 
Overall, Member States have welcomed furthe r development of the EU  policy in this area, 
as efforts at European level would comple ment the Council of Europe Convention and 
different global internationa l and national action programmes.  None of the other Member 
States have voiced objections against the convention, but, as indicated above in section 2.4, 
it is unclear when ratification will happen. Only up to 5 Member  States spoke in favour of 
comprehensive EU legislation ag ainst all forms of cybercrime. 
• Private sector
 experts agreed on the problem descri ption and objectives outlined by the 
Commission in this impact assessment, and ha ve thereby underlined the need to formulate 
                                                 
62 The consulted experts represented 27 EU member  states law enforcemen t agencies, Switzerland, 
Norway and member countries of the Council of Europe, OSCE, G8, Interpol, Europol and Eurojust. 
Consultations with the private sector included industry federations, such as EuroISPA, Eco, the Irish Banking Federation, ECTA and a number of private companies including Symantec, eBay, Microsoft, 
MasterCard, Blueprint Partners, KPN, Telefoni ca, Bouygues Telecom, HP, CA, SAP, Business 
Software Alliance. 
 
EN 20   EN the legislation in a way, which ensures that private sector can develop security products 
and test them in all legality.63 They have also pointed at th e need to take action in this 
context against identity theft and fraud crimes , which are also committed at large scale. 
The need for a global legal in strument covering all types of  cybercrime has also been 
highlighted in the long-term perspective.  
• Third country  experts declared that the problems described and policy objectives of the 
Commission are in principle identical to pr oblems and objectives in other countries.  
A number of experts from (mainly Europ ean) countries, which have not yet signed 
(e.g. Turkey) or ratified (12 EU countries ) the Council of Europe Convention, were 
in favour of stronger measures to fight attacks, including large-scale, against 
information systems.64 They recognized the scale of the problem – the increasing 
threat to societies from large-scale att acks – and the need to deal with it by 
introducing a specific measure at supranat ional level. They did not deem the non-
signature or non-ratification by their resp ective countries of the Cybercrime 
Convention as an obstacle to re inforcing the fight against cy ber attacks at EU level.  
All the suggestions have been taken in due account while assessing the impacts of each policy 
option. 
2.9 The EU's actions in the wi der international framework. 
To deal effectively with cybercrime, cooperation is required on a technical level, dealing with 
the concrete instances of cybercrime. This t echnical, day-to-day coop eration is carried out 
through the 24/7 contact points. Ho wever, it is also of vita l importance that different 
international organisations dealing with cybe rcrime work together. Besides the EU, the 
Council of Europe and the G8 currently work on cybercrime.  
The Council of Europe Convention is the ol dest and most comprehensive document on 
cybercrime. The EU's work on cybercrime feed s into our relations with other Council of 
Europe member states. The work undertaken by the EU on cybercrime, such as in the framework of the Commission Co mmunication "Towards a genera l policy on the fight against 
cyber crime", Safer Internet programme an d the protection of Critical Information 
Infrastructures (CIIP), serves as an inspira tion for the other international organisations. 
Dealing with the international aspects of cybercrime is also complicated by the current non-
effectiveness of the existing Contact Points wh ich has a negative effect  on the whole network 
of G8 and Council of Europe c ontact points. The Contact point s are the first interlocutors 
among Member States and when internatio nal cooperation is sought in cybercrime 
investigation. Their efficiency (ra pidity) determines the efficien cy of the whole investigation. 
Furthermore, the Council of Europe's Global Project on Cybercrime, which aims to support 
countries worldwide in the implementation of the Cybercrime Convention, has called on 
Governments to provide for effective criminalis ation of cyber offences. The project clearly 
                                                
 
63 The new framework decision must ensure that the pr ivate sector can still use bo tnets or similar tools for 
testing the effectiveness of anti-virus so ftware or other security appliances.  
64 See: http://conventions.coe.int/Treaty/Comm un/ChercheSig.asp?NT=185&CM=8&DF=&CL=ENG 
 
EN 21   EN states that "[t]he legislation of different countries should be  as harmonized as possible to 
facilitate cooperation."65 
Finally, there is no inconsistenc y of the proposed measures with other jurisdictions, such as 
the US. The proposed measures reinforce the Council of Europe Cybercrime Convention by 
making the EU contact points more efficient, an d by strengthening the m easures against large-
scale attacks. The US are a si gnatory to the Convention, and have been favourable to the 
proposed measures in the consu ltation process. Similarly, the US, together with Japan, and 
partly also Russia (Russia does not wish to sign the Council of Europe Convention, but is in 
favour of implementing most of the measures it contains), have welcomed the proposed 
measures on number of occasions at the G8, consid ering them a step in the right direction in 
the global fight against cyber att acks and international cooperation.  
3. O BJECTIVES  
3.1 General, specific and operational objectives 
The overall goal is to deter the occurrence of , and decrease the number of large-scale 
attacks  originating from and/ or targeting the EU. 
A Specific objective: Prosecute and convic t criminals responsible for large-scale 
attacks, through the approximation of cr iminal law dealing with attacks against 
information systems 
Operational objectives: 
A1 To ensure the criminalisation of larg e-scale attacks, through the criminalisation 
of the sale, use and putting at the disposal of tools; 
A2 To facilitate prosecution of cross-border cybercrime cases; A3 To impose effective, proportio nate and dissuasive penalties. 
B Specific objective: Improve cross- border cooperation between Law 
Enforcement Agencies (LEA's) 
Operational objectives:  
B1 To introduce mechanisms for immediate international assistance in cases of 
urgency in a Member State; 
B2 To improve the exchange of informa tion and best practices among the Member 
States. 
B3 To improve public-private cooperation through the establishment of contact 
points and cooperation agreements. 
                                                
 
65 See: 
http://www.coe.int/t/dghl/cooperation/economiccrime/cybercrime%5Ccy%20Project%20global%20pha
se%202/2079adm_prosummary1d%20_9%20mar%202009.pdf 
 
EN 22   EN C Specific objective: To establish effectiv e monitoring systems and data collection 
Operational objectives: 
C1 To record, produce and provide statistical data on the offences referred to in the 
Directive. 
3.2 Consistency of the objectives with oth er EU policies and horizontal objectives 
Considering the global and borderless nature of cybercrime and cyber attacks, the policy in 
this area needs to be consistent not only with ot her EU policies, but also with the policies of 
international organisatio ns and third countries.66  
At the international level, the Council of Europe Cyberc rime Convention is the only 
instrument.67 It provides a comprehensive and cohere nt framework covering different aspects 
of criminal and procedural law, as well as of international law enforcement cooperation. The 
Convention is also open to countries that are not members of the Counc il of Europe and has 
already been ratified by i.a. the USA.68 A truly global coordina tion of anti-cybercrime 
policies is necessary, as a policy limited to the EU alone would not be able to address all 
aspects of the problem. The European Comm ission has declared its full support for the 
Convention and its ratifica tion by all Member States.69 
The FD on attacks, and in particular the funda mental provisions of Articles 2 to 4, build on 
the Cybercrime Convention, and are in principl e identical to the C onvention's corresponding 
Articles. All potential new actions discussed in th e present report will ha ve to be defined in 
view of guaranteeing a good level of  coherence with the Convention.  
The objectives presented above have been de fined in order to complement existing and 
prospective measures within the EU po licies for a secure information society70 and for Critical 
Information Infrastructure Protection. The Comm ission policy in this area has recently been 
presented in the Communication "Protecting Europe from la rge-scale cyber attacks and 
disruptions: enhancing preparedne ss, security and resilience".71 The objectives have also been 
defined to be consistent with  EU policies related to the fight against organised crime, 
terrorism and security in general.  
The Impact Assessment is also consistent w ith the report on the implementation of the 
European Security strategy from 2003 (Implem entation Report of the ESS, 4 February 2008), 
which for the first time mentions cyber security and internet-based crimes as one of the global 
challenges and key threats. The report requests more  work to be done in this area, particularly 
                                                 
66 In particular the United Nations, G 8 and NATO.  
67 Cybercrime Convention concluded in Budapest on 23 November 2001; See: 
http://conventions.coe.int/Treat y/EN/Treaties/Html/185.htm. 
68 List of signatories of the Cybercrime Convention (CETS 185): 
http://www.conventions.coe.int/Treaty/Commun/ ChercheSig.asp?NT=185&CM=8&DF=3/17/2009&C
L=EG 
69 COM(2007) 267 final 
70 COM(2006) 251 final 
71 "Protecting Europe from large scale cyber-attacks and disruptions: enhancing preparedness, security 
and resilience" Communication from the Commission to the Council, the European Parliament, The 
European Economic and Social Committee and the Committee of the Regions on Critical Information 
Infrastructure Protection, COM (2009) 149/1 
 
EN 23   EN when it comes to "attacks against private or gov ernment IT systems in EU Member States". 
The Impact Assessment responds to this challenge. 
4. P OLICY OPTIONS  
Elements of the various policy options can be pursued independently of the overall option 
chosen. 
4.1 Policy option (1) Status quo / no new EU action 
This option implies that the EU will not take any further action to fight this particular type of 
cybercrime. Ongoing actions, in particular the pr ogrammes to strengthen critical information 
infrastructure protection and improve public-p rivate cooperation against cybercrime, would 
be continued. This option does not exclude that  existing global legisla tion is strengthened. 
This option might entail sustained political – and possibly financial – support for actions 
connected to the implementation of the Counc il of Europe Cybercrime Convention and its 
further development. 
4.2 Policy option (2) Development of a programme to strengthen efforts to 
counter attacks against information syst ems with non-legislative measures  
Non-legislative measures would, in addition to the programme for critical information 
infrastructure protection, focus on cross- border law enforcement and public-private 
cooperation. These soft-law instruments should aim at favouring further coordinated action at 
EU level, including:  
• strengthening of the existing 24/7 networ k of contact points for law enforcement 
authorities by establishing best practice recommendations; 
• establishment of an EU networ k of public-private contact points of cybercrime experts and 
law enforcement. This network would take the form of a list containi ng contact details on 
both public and privat e contact points.  
• elaboration of a standard EU service level agreement for law enforcement cooperation with 
private sector operators, as agreed by the Counc il of the EU in its conclusions in November 
2008, when it invited the Council and the Commissi on to draft, in consultation with private 
operators, of a European agreement mode l for cooperation between law enforcement 
agencies and private operators.72 The Conclusions stipulated th at “the Member States are 
encouraged to set up standardized system fo r trusted operational and strategic information 
exchange between law enforcement and the private sector”. The EU service level agreement aims to create a trusted framew ork whereby companies and LE can exchange 
information on cybercrime and exchange best practice.  
• supporting the organisation of training progr ammes for law enforcement agencies on 
cybercrime investigation. The Commission will be establishing, together with the Member States and the private sector, an EU cybercrime training platform. 
                                                
 
72 OJ C 62 of 17.3.2009, p. 17. 
 
EN 24   EN 4.3. Policy option (3) Targeted update of FD on  attacks to address the specific threat 
of large-scale attacks a gainst information systems 
This option implies an introduc tion of specific targeted ( i.e. limited) legislation against large-
scale attacks against information systems that  are particularly dangerous. Such targeted 
legislation would be linked to measures to strengthen operational cr oss-border cooperation 
against attacks on information systems and an increase of already foreseen minimum 
penalties. This option would have the form of  an update of the existing FD on attacks, and 
would include the following specific measures identified in the consultation process with 
stakeholders: 
• introduction of legislation agai nst the tools used for attacks against information systems. 
This would entail the crimina lisation of the produc tion, sale, procurement for use, import, 
distribution or otherwise maki ng available of a tool enabling large-scale attacks against 
information systems;  
• introduction of new aggravating circumstances regarding large-scale attacks, such as the 
act of putting in place a botnet or a similar t ool enabling committing offences mentioned in 
Article 2 of the current FD, and when comm itted by concealing the real identity of the 
perpetrator and causing prejudice to the rightful identity  owner (so-called identity theft). 
For example, identity theft -related offence occurs when someone uses someone else's 
personal data, such as name or credit card number, without the permission of the identified person, to commit fraud or othe r criminal offences, such as attacks against information 
systems.  
• introduction of an obligation for Member States  to respond to an urge nt request from both 
the public and the private sector via the 24/7 network of contact poin ts within a certain 
time limit. The formulation should be based on Article 4 in the FD 2006/960/JHA
73 ("shall 
ensure that they have procedur es in place so that  they can respond within at most eight 
hours to urgent request…"), and shoul d limit the time period of response. 
• introduction of a monitoring oblig ation for Member States to facilitate the collection and 
provision of data about cyber attacks a nd cybercrime, including the number of 
prosecutions and criminal reports. As absence of accurate data is one of the key issues, 
there is a need for a provisi on introducing an obligation for Member States to collect and 
provide the Commission with statistical data regarding cybercrime. This obligation would 
also be consistent with the aim of EU Action Plan on criminal statistics, which is to to 
develop statistics that will allow comparisons re garding the structure, levels and trends of 
crime as well as the various criminal justice measures between Member States and regions 
within Member States.74  
• to limit the frequency of future changes,  the proposed measures will be termed 
technologically neutral. An exampl e of this is the use of the term 'tools' for attacks (instead 
of the currently used technica l term 'botnets'). Moreover, th e scope of the FD is geared 
                                                 
73 Council Framework Decision 2 006/960/JHA of 18 December 2006 on simplifying the exchange of 
information and intelligence between law enforcem ent authorities of the Member States of the 
European Union. 
74 Communication from the Commission to the European Parliament, the Council and the European 
Economic and Social Committee of 7 August 2006 - Developing a comprehensive and coherent EU 
strategy to measure crime and crim inal justice: an EU Action Plan 2006-2010, COM(2006) 437 final.  
 
EN 25   EN towards attacks only (and not other cybercrimes), which will reduce the likelihood of 
future changes. 
4.3.1.  Policy sub-options 
This policy option could have several sub-options.  
(a) Three sub-options would be proposed when  introducing aggravating circumstances. The 
purpose of these sub-options  is to consider the most approp riate form of penalisation of the 
criminal activities. The sub-opti ons are not mutually exclusive.  
The first policy sub-option would require th at Each Member State shall take the 
necessary measures to ensure that the o ffences related to large-scale attacks are 
punishable by criminal penalties of a maximum of at least five years of imprisonment when committed through the use of a mechan ism conceived to launch an attack at a 
large-scale. 
The second policy sub-option would require th at Each Member State shall take the 
necessary measures to ensure that the o ffences related to large-scale attacks are 
punishable by financial penalties taking into  account the estimated proceeds of the 
crime when committed through the use of a mechanism conceived to launch an 
attack at a large-scale. 
The third policy sub-option would be a combination of the first two, and would 
require that Each Member State shall take the necessary measures to ensure that the 
offences related to large-scale attacks are punishable by crimin al penalties of a 
maximum of at least five years of impris onment and financial penalties taking into 
account the estimated proceeds of the cr ime when committed through the use of a 
mechanism conceived to launch an  attack at a large-scale. 
The current level of penalties is set between  1 to 3 years of impri sonment (3 years for 
aggravating circumstances). This level is perceived as not reflecting the gravity of 
the crime, besides the fact that this level excludes the use in some Member States of 
special investigative techniques indispensable to the investigations required for this type of crime, such as covert operations. 
It is suggested to raise this level to 2, respectively 5 years (aggravating 
circumstances), which is in line with th e legislation in count ries that recently 
modified their legislation (Estonia, France, Germany), or that have a higher level of 
penalties (UK). Therefore, this sub-option is  considered best suited for the aims of 
this Impact Assessment. 
(b) Three sub-options would also be proposed when introducing  the obligation on the 24/7 
contact points to respond to  requests for assistance.  
The first policy sub-option would require that  Member States shall ensure that they 
have procedures in place to respond to reque sts within the shortest delay possible.  
The second policy sub-option would require that Member States shall ensure that 
they have procedures in place so that they  can respond within at most eight hours to 
requests. 
 
EN 26   EN The third policy sub-option would require that  Member States shall ensure that they 
have procedures in place so  that they can re spond within at most eight hours to 
urgent requests.75 The qualification of 'urgent' should be agreed between law 
enforcement authorities and the private sector. 
4.4. Policy option (4) Introduction of comprehensive EU legislation against 
cybercrime 
This option would entail new and comprehensive EU legislation. In addition to the update set 
out in policy option 3, this option would add the soft-law measures of policy option 2, and go 
beyond these by tackling other legal probl ems related to Internet usage.  
The identification of the use of  botnets for a range of crimin al activities in cluding not only 
large-scale attacks, but also iden tity theft, hosting of illicit content online, fraud, etc., raises 
the question whether a new, broa der EU legislation on cybercri me should be introduced. Such 
legislation would also necessitate measures addressing fraud committed online, illegal web 
content (e.g. by blocking or taking down we b pages which sell/rent botnets), the 
collection/storage/transfer of el ectronic evidence, and the clarification of jurisdiction rules in 
cross border cyber incidents. The legislation wo uld run in parallel to the Council of Europe 
Convention on cybercrime, and would includ e accompanying, non-legislative, measures 
mentioned above. The policy option would deal with other cybercrimes than merely large-
scale attacks, which may howev er, facilitate the occurren ce of large-scale attacks. 
4.5. Policy option (5) Update of the Council of Europe Convention on Cybercrime 
This option would require substantial renegot iation of the current convention, which is a 
lengthy process and goes against the time frame for action that is proposed in this Impact 
Assessment. The renegotiation would have to focu s in particular on those elements introduced 
in the policy option (3), i.e. the introduction of  aggravating circumstances and penalties. At 
the time of negotiations of the current C onvention (before 2001), no agreement could be 
reached on the issue of penalties, reason for which there is no mention of this in the 
convention. There is no indication that su ch consensus could be reached today.  
There seems to be no interna tional willingness to renegotiate . Furthermore, any efforts to 
reopen negotiations can be seen  as efforts to undermine the ongoing, but not yet completed 
ratification process, and theref ore be seen as an attempt to undermine the value of the 
convention. 
The current convention entered into force on 1 July 2004, however 10 Member States have 
not yet ratified it.  
It is therefore outside the required time fram e for action to consider an update of the 
Convention a feasible option. Consequently, this option will not be assessed in detail. 
                                                 
75 In line with Framework Decision 2006/960/JHA on simplifying the exchange of information and 
intelligence between law enforcement authorities of the Member States of the European Union. 
 
EN 27   EN 5. A NALYSIS OF IMPACTS  
No significant environmental impacts are at stak e in any of the considered policy options, and 
no particular difficulties in relation with third c ountries can be expected as a consequence of 
any of the policy options. The policy options are evaluated on the following categories:  
• Economic impact, further subdivided in financia l cost (including admi nistrative costs for 
companies) of the option, and its economi c benefit (savings, economic growth).  
• Social impact 
• Impact on fundamental rights 
• Impact on third countries 
• Relevance of the measure - contribution to the achievement of the objectives 
• Consistency with international law 
• Political Feasibility (without magnitudes) 
• Proportionality (without magnitudes) 
Member States' and stakeholders' views are also mentioned concerning all policy options. 
Economic impact 
Measures that improve efficiency in fighting crime are likely to produce a general pattern of 
net positive economic impact. In the short term , there may be a moderate increase in 
administrative costs due to greater demands on the public system of criminal law (because a 
more efficient system to fight crime catches and processes more criminals), accompanied by a 
corresponding effect on the wider economy that must pay those costs . However, in the 
medium and long term, there should be a substan tial reduction in such co sts (because a more 
efficient system to fight and prevent crime dete rs more criminals and their rehabilitation leads 
to fewer offences, so that fewer criminals are ‘processed’), bearing in mind that a baseline level of crime is probably unavoidable. At any ra te, and especially in the case of crimes as 
fraud crimes committed via the internet, any possi ble short-term increase in administrative 
expenditure is largely compensated by the econo mic benefits of avoiding the economic costs 
of such offences listed above.  
Inversely, measures that are inefficient in fighting crime will produce a general pattern of 
negative economic impact. In the long term, this includes inefficient State intervention due to lack of trust in public author ities, undermining trust to deploy or take part in economic 
activities on the Internet, inefficient use of resources due to individuals adopting self-protecting measures, and unfair dist ribution of wealth as criminals profit from their activities. 
Social impacts 
Measures that improve efficiency in fighting crime are likely to produce positive social 
impacts, such as an increase in security and trust in authorities and interpersonal relations. They contribute to minimising the damage to valu es which matter to society, reinforce trust in 
public institutions and the authority of the State, help avoid tr auma for victims and 
 
EN 28   EN widespread fear. In the case of cybercrime , these impacts affect both individuals and 
corporate citizens. The existence of trust is an  essential component of the societal tissue.  
A table of symbols is used to establish the magn itude of foreseen impact . It distinguishes "-" 
for negative impacts or costs and "+" positive impacts or savi ngs. Symbols with both "-" and 
"+" mean that that both positive and negative impacts are expected. 
Small magnitude - / + Medium magnitude -- / ++ Significant magnitude --- / +++ No impact 0 
5.1 Option (1) Status quo / no new EU action 
This option would not address the need for further strengthening the efforts to fight 
cybercrime. 
The Council of Europe Conventi on on cybercrime is a very s ound instrument (both contents 
wise and in implementation) in the area, but new events such as  large-scale attacks necessitate 
EU action. In principle, all EU Member States  should ratify the Conve ntion. So far, however, 
only 15 Member States have done so.  
In addition and beyond the Council of Europe C ybercrime Convention, all the considerations 
developed under paragraph 2.6 must be recalle d here, with respect to the crime being 
expected to remain stable or even grow if no effective deterrence is put  in place in the near 
future. 
Taking into account that the fight against large- scale attacks against in formation systems is a 
high priority within EU policy, and a crosscut ting issue affecting many fields of EU action, 
the option of not taking further ac tion at the EU level would not  provide adequa te response to 
the identified problem. 
5.1.1 Economic impact 
• financial cost: 0  
• economic benefit: 0  
No action will reinforce the existing weaknesses in  the current legal set-up, leading eventually 
to legal uncertainty and the incapability to act following events such as large-scale cyber attacks. As a result, business and citizens will gradually lose trust in information technologies 
and the Internet, which will in turn hamper econo mic development. The effect particularly on 
SMEs, is likely to be significant, as their assets tend to be less protected against cybercrime due to their lower means to do so. Indeed, acc ording to a report of the UK's Federation of 
Small Businesses, cybercrime is becoming an in creasingly serious issue for SMEs which lose 
up to GBP 800 a year on average to cybercrime. According to the same report, 54 per cent of 
 
EN 29   EN UK SMEs reported being a victim of cybercrime  in the last twelve months – 15 per cent 
falling foul of IT problems cau sed by viruses and hackers.76 
Magnitude of the economic impact: 0  
5.1.2 Social impact 
Not acting (but continuing the ratification of  the Council of Europe Convention) has the 
disadvantage that it is unclear by what time all Me mber States will have ratified and acceded 
to the Convention. The society will be increasingly affected by cybercrime and attacks against their information systems, creating the feeling of insecurity on the Internet. 
Magnitude of the social impact: 0 
5.1.3 Fundamental rights impact 
In this option, interests and righ ts of individuals and businesses would be negatively affected 
due to the evolution of cybercrime, as further ca ses of misuse of personal data and/or stolen 
identity will occur. 
Magnitude of the fundamental rights impact: 0 
5.1.4  Effects on third countries 
If no new measures are taken to combat cyberc rime, the situation will become worse for the 
EU and third countries. This option also has as a consequence that no new legal, and practical 
expertise will be built in how to deal with large scale attacks. This expertise could eventually 
be used to assist third countri es in their fight against cyberc rime. The status quo can in this 
sense be considered to have ne gative effects for third countries in the medium to long term.  
Magnitude of the effect s on third countries: - 
5.1.5  Consistency with international law The relevance of the measure and consistence wi th international law as well as proportionality 
are also considered null, as there is no change in the policy. Therefore, the current difference 
between the existing FD on attacks and the C ouncil of Europe Cybercrime Convention would 
remain, such as on the issue of criminalisation of putting at criminals' disposal of tools used to 
conduct criminal attacks, where the current FD on attacks is not as advanced as the 
Cybercrime Convention.  
5.1.6  Stakeholders' views 
This option was not deemed to be satisfactory by the stakeholders given the growing number 
of large-scale attacks against information systems, loss of personal data and fraud committed on the Internet.  
                                                
 
76 http://www.smebusinessnews.co.uk/cybe r-crime-costs-smes-800-each-year/160/ 
 
EN 30   EN 5.1.7  Political feasibility 
Given the dynamics of cybercrime  and the need to take action, the political feasibility of non-
action is low, as it would go against current  EU policy and international developments. 
5.2 Option (2) Development of a programme  to strengthen the efforts to counter 
attacks against information systems with non-legislative measures 
5.2.1 Economic impact 
• financial cost: -  
• economic benefit: + 
The financial cost of this option is linked, firs t, to the strengthening of a law enforcement 
network of contact points by making them pe rmanent and responding within a certain time 
limit to requests for cooperation and, second, to the establishment of a similar network 
including also the private sector . Given that the majority of Me mber States already have their 
law enforcement contact points and some private sector contact points in place, the additional 
cost by those lagging behind (about a thir d) is expected to be moderate.  
The average cost related to the setting up of a permanent contact  point is estimated at around 
EUR 219,000 per Member State (see Annex 1). The cost is low, as it is principally linked 
merely to making the existing contact points tr uly permanent and respons ive within a defined 
time limit. Contact points that are not truly perman ent cannot be expected to be able to react 
to assistance requests within a guaranteed ti me limit. The cost of the measure obliging a 
permanent contact point to respond within a time limit is expected to be negligible and covered under the overall cost, as the contact points are me rely expected to reply whether a 
solution will be forthcoming fr om their side or not. The cont act points are not expected to 
provide the actual solutions within the time lim it, particularly when such solutions are 
complex and require the involvement of other authorities (e.g. only during working hours).  
The cost of the establishment of  an EU network of public-private  contact points of cybercrime 
experts and law enforcement would be negligible , as it would consist essentially of a list 
containing contact details on bot h public and private contact points which already exist on 
both sides, but their existence is  not known to the other side.  
The cost of the elaboration of a standard EU  service level agreement for law enforcement 
cooperation with private sect or operators can be estim ated at EUR 30,000 for the 
Commission, as was the case of the elaboration of the above-mentioned recommendations for 
public private partnership in C ouncil Conclusions of November 2008.
77 This cost is related to 
the organisation by the Commission of consu ltations and an expert meeting with all 
stakeholders. The additional costs for the stakehol ders are expected to be negligible, as they 
have already agreed to this measure in pr inciple by supporting the re commendations in the 
Council Conclusions. Their agreement was based on the necessity of th e measure and its low 
cost. 
                                                 
77 OJ C 62 of 17.3.2009, pp. 17-18. 
 
EN 31   EN As a result, the impact on the economy is expected  to be small, as benefits from the Internet 
(e.g. greater business opportunities in the IT sector, growth in  employment and productivity 
of the economy) will be offset by financial losses caused by cybercrime, such as cyber attacks. These losses can be potentially very hi gh, as according to a recent study, cost savings 
globally through business use of e-commerce re ached more than a trillion euro a year.
78 
Therefore, all potent ially positive impacts of these meas ures are diminished by the non-
binding nature of the measures (i .e. permanent contact points fo r the private sector) and by the 
absence of an obligation to react swiftly to ur gencies (for both law enforcement agencies and 
the private sector). 
Concerning the financial cost of training progr ammes, the European Commission has, since 
2001, lead efforts to develop sta ndardised training programmes for law enforcement agencies 
and judicial authorities on cybercrime invest igation and the admissibility of electronic 
evidence respectively. The cost of additional training foreseen in this policy option is 
estimated to reach almost EUR 4 million in the next two years, but th e cost for the Member 
States is estimated at less than EUR 1 million (20%) in total, given the high level of co-funding by the Commission.
79 This measure is estimated inde pendently of national training 
programmes run without the Commission's financia l support, for which data are not available. 
Nevertheless, any Member State can apply for EU funding to cover fo r training costs which 
would arise from the application of th e proposed non-legislative measures.  
Magnitude of the economic impact: -/+  
5.2.2 Social impact 
The number of PCs attacked or perpetrators iden tified is not expected to decline significantly 
by a non-binding reinforcement of a network of c ontact points. Therefore, the social impact in 
terms of improving the security and trust of citizens by the actions of existing law 
enforcement contact points can be considered lo w without an obligation for the contact points 
to react to requests within a certain time limit. A similar situation exists within the private 
sector. Consultations on the above-mentioned re commendations on public-private partnership 
revealed that even though large private stakeh olders currently operate  their contact points, 
they are operational only during working hours.  Without the guarantee of timely response by 
the contact points, the security  and trust of citizens is not  expected to be enhanced.  
As for the elaboration of a standard EU service level agreement for law enforcement 
cooperation with private sector operators, the soci al impact could potentially be significant if 
all parties were fully committed to effective public-private cooperation in tackling cybercrime, including cyber attacks (e.g. in complying with the above-mentioned 
recommendations adopted by the JHA Council C onclusions). However, the voluntary nature 
of such an agreement is expected to produce a low impact in terms of security and trust. 
Similarly to the issue of permanent contact points, the non-legally binding nature of the 
agreement would not deliver the desired social  impacts. Indeed, these measures will not 
impose effective, proportionate and dissuasive pena lties on perpetrators of cyber attacks, as 
they will not reinforce the existing legislative measures. 
                                                
 
78 http://www.businessweek. com/1999/99_40/b3649004.htm 
79 These programmes have been financed by the fina ncial programmes "Prevention of and fight against 
crime" and "Criminal Justice".  
 
EN 32   EN The organisation of training programmes for law enforcement agencies on cybercrime 
investigation, in order to improve best practice exchange and cooperation among law 
enforcement agencies, are also likely to have positive social impact. They provide 
opportunities to exchange experi ence and encourage operational cooperation, which in turns 
translates into more efficient investigation a nd prosecution of cybercri me and a more visible 
response by law enforcement agencies. The re sulting personal contacts and trust are also 
essential for a more effective law enforcemen t cooperation and public-p rivate partnership. 
The positive social impact of the EU cybercrime  training platform will also reach beyond the 
EU, as the training material is currently bei ng shared internationally (e.g. among Interpol 
members). The EU-funded material has become  a global reference for cybercrime training. 
The effect of EU support for cybercrime training is in its capacity to bring together the best 
cybercrime trainers and training material in Europe, and to share this expertise with countries, 
which would not otherwise be able  to have access to su ch expertise. EU f unding also serves to 
update the training material to keep abreast of the fast-evolving t echniques used by cyber 
criminals. The EU is being assisted by Europol, Interpol and the Council of Europe, which all 
contribute to the development of cybercrime trai ning platform in Europe, and consequently in 
the world. However, EU funding is used primarily to start up the process. It is expected that 
the private sector and universities will be ab le to sustain this process in the future. 
Magnitude of the social impact: ++ 
5.2.3 Fundamental rights impact 
Public-private cooperation on c ybercrime incidents and fighting against ID theft includes 
usually anonymous statistical, technical or econ omic data. However, in  a significant number 
of cases it may also include th e collection, storage and exchange of some personal data (such 
as IP-addresses, names, etc.), Th is is as such an interference w ith the fundamental rights to the 
protection of private life and pr otection of personal data (Ar ticles 7 and 8 EU Charter). The 
processing of personal data, including the possibl e transborder exchange of information, must 
fully respect the applicable provisions in the EU and in EU Member States for the protection 
of personal data. 
Any planned interference affecting these fundament al rights, in particular the protection of 
personal data, must demonstrably shown that this interference can be justified: the 
interference can only be justifie d, if it is in accordance with the law (this excludes taking non-
legislative measures) and is necessary in a demo cratic society in the interests of a legitimate 
aim listed in Article 8 (2) ECHR, such as national security or public safety. 
The fight against cybercrime will make some intrusions in the right of personal data 
protection which is strictly necessary in a democr atic society. This interference applies both to 
the exchange of information among law enforcement agencies and between the public and the private sector when assistance requests are made  through contact points or when standard EU 
service level agreements for la w enforcement cooperation with private sector operators are 
established. This interference and the personal data processed for that purpose must however 
be clearly defined and be proportio nate in relation to the purposes for which personal data are 
collected and/or further processed.  
As a result, only the exchange of fully a nonymous information has no negative fundamental 
rights impact in terms of the right to private life and the right to prot ection of personal data. 
However, depending on the concrete measures  and the amount of pe rsonal data processed, 
 
EN 33   EN there will be a negative fundamental rights impact  in terms of th e right to private life and the 
right to protection of personal data. This concern was also raised by private sector 
stakeholders during consultations mentione d above in section 1.2. In any case, any 
interference with the fundament al rights to the protection of private life and protection of 
personal data in relation to  law enforcement and public-pri vate cooperation on cybercrime 
incidents has to be minimized by applying existi ng EU and national legisl ations particularly 
on personal data protection. 
Magnitude of the fundamental rights impact: -/+ 
5.2.4  Effects on third countries 
The effect of this policy option and the progr amme will be to bring about the creation of 
networks and knowledge, which in turn will be  helpful in combating cybercrime. Through its 
various programmes and relations with third countries, the EU could also put the newly-
gained expertise at the disposal of countries , which would not otherwise be able to have 
access to such expertise.  
Overall, impact on third countries is expected to be positive.  
Magnitude of the effects on third countries: ++ 
5.2.5  Relevance of the measure 
This policy option contributes moderately to  the achievement of objective B by introducing 
measures promoting internationa l assistance in cases of urgenc y in a Member State and by 
improving the exchange of information and be st practice (training) among Member States. 
The policy option’s contribution is low to  the achievement of objectives A and C 
Magnitude of the relevance: ++ (objective B) 
    + (objectives A and C) 
5.2.6  Consistency with international law 
This policy option has no impact on international law (the Cybercrime Co nvention), as it is a 
non-legislative option.  
Magnitude of the consistency: 0 
5.2.7  Proportionality 
This option is in line with the principle of proportionality since it does not introduce new 
obligations for Member States. The non-legisl ative measures such as recommendations and 
exchange of best practice would leave a larg e scope for national decision to Member States. 
5.2.8  Stakeholders' views 
Both law enforcement agencies and the private s ector agreed on the nece ssity to create their 
respective permanent contact points by endorsi ng EU expert meeting recommendations, one 
of which stated: "Law enforcement permanent c ontact points – and privat e sector equivalents 
 
EN 34   EN – should be established in order to improve the clarity and efficiency of request and response 
processes. The private sector equi valent should also provide an ' out of hours' service in order 
to respond to urgent law enforcement requests. The qualification of 'urgent' should be agreed 
between law enforcement and the private sector ." The cost of this measure was thoroughly 
discussed with the stakeholde rs and not deemed substantia l. These recommendations were 
also agreed in form of Council Conclusions on 27-28 November 2008.80 
Concerning the elaboration of a standard EU service level agreement for law enforcement 
cooperation with private sector operators, this is a measure that does not imply significant 
financial costs for both LEAs and the private s ector, as this agreemen t would be voluntary. A 
comparison could be made again to the re commendations on public- private partnership 
against cybercrime adopted by JHA Council Conclusions of 27-28 November 2008. The Conclusions contain eight recommendations that  were deemed necessary and not costly to 
implement by the stakeholders.
81 
5.2.9  Political feasibility 
The political feasibility  of this policy option is high, as it does not involve changes in the 
legislative framework.  
5.3 Option (3) Targeted update of FD on attacks to address the threat from large-
scale attacks against information systems 
5.3.1 Economic impact 
• financial cost: - - 
• economic benefit: ++ 
An update of the current FD targeted at strong er penal measures against perpetrators of the 
most damaging manifestations of attacks – larg e-scale attacks against information systems – 
is likely to have positive financial and economic  effects. This option is likely to reduce the 
financial cost caused by large-scale attack s coming from the European Union and third 
countries, which in turn will have a positive economic impact in terms of the continued growth of the Internet economy (estimated at  more than EUR 300 bil lion in Europe) and the 
economy as a whole.  
Moreover, the obligation for th e contact points to react with in a certain time frame would 
limit the possibility for attacks coming from outside the European Union to cause financial damage due to the lack of, or delaye d response, by such contact points. 
There would only be a limited cost  related to the obligation on the Member States to ensure 
the permanency of their contact points, the time limit for the contact points’ response to 
requests for assistance, and the collection an d provision of statis tics on attacks against 
                                                
 
80 OJ C 62 of 17.3.2009, p. 18. 
81 OJ C 62 of 17.3.2009, p. 18. 
 
EN 35   EN information systems. Such statistics will include security breaches, crime reports and 
prosecuted cases.82  
The average cost related to the setting up of a permanent contact  point is estimated at around 
EUR 219,000 per Member State (see Annex 1). The cost is low, as it is principally linked 
merely to making the existing contact points tr uly permanent and respons ive within a defined 
time limit. Contact points that are not truly perman ent cannot be expected to be able to react 
to assistance requests within a guaranteed ti me limit. The cost of the measure obliging a 
permanent contact point to respond within a time limit is expected to be negligible and covered under the overall cost, as the contact points are me rely expected to reply whether a 
solution will be forthcoming fr om their side or not. The cont act points are not expected to 
provide the actual solutions within the time lim it, particularly when such solutions are 
complex and require the involvement of other authorities (e.g. only during working hours).  
The cost of other measures, such  as the introduction of legislat ion against the tools used for 
attacks against information systems and the introduction of new aggravating circumstances regarding large-scale attacks canno t be quantified since they are included in the general costs 
of the criminal justice system of each Member  State. Similarly, although it can be expected 
that higher penalties will make at least some  Member States willin g or able to provide 
additional resources to investig ate and prosecute cybercrime, th ese costs cannot be quantified 
at this stage. However, the Estonian example has shown that a legislative change has been followed by higher resources, such as in the es tablishment of an international centre of 
excellence in Tallinn in 2008. 
The total administrative costs of this polic y option would amount to approximately EUR 
5,960,655 (see Annex 2) 
Magnitude of the economic impact: --/++ 
5.3.2 Social impact 
The scale of the social impact in terms of in dividuals’ security and trust in cyberspace is 
expected to be positive and significant. Hars her criminal penalties for the production, sale, 
procurement for use, import, distribution or otherwise making available of a tool enabling 
large-scale attacks against information system s, and when committed by concealing the real 
identity of the perpetrator and causing prejudic e to the rightful identity owner (so-called 
identity theft), are expected to reduce the numbe r of such attacks origin ating in the European 
Union. Moreover, this measure will also provide a timely and visible response the public's current high concern about public security, in cluding cybercrime. A survey has shown that a 
majority of EU citizens show concern about persona l data protection issues.
83  
The obligation for Member States , not only to set up permanent contact points, but also to 
respond to information requests within a time limit in urgent cases is expected to speed up the 
authorities' reaction and consequently limit the ex tent of negative social impact – e.g. personal 
feeling of insecurity due to the possibility of  personal data loss – a large-scale cyber attack 
                                                 
82 Aspects of cybercrime often surface in other crimes , such as fraud through use of a computer. It is 
therefore essential that not only  those crimes are recorded whic h "cyber crimes" are according to 
existing legislation, but also those where the cybercri me is a secondary crime in the prosecutor’s file.  
83 Flash Eurobarometer, Data Protection in the European  Union, Citizens’ perceptions, Analytical Report,  
 available at: http://ec.europa.eu/public_opinion/flash/fl_225_en.pdf 
 
EN 36   EN may otherwise have. In addition, the actual im plementation of the obligation by the Member 
States should facilitate cooperation among th e permanent contact points also on non-urgent 
cases, and enhance citizens' trust in the capacity of the Member States and the EU as a whole 
to deal collectively with cyber att acks and cybercrime in general.  
Finally, a non-legislative measur e, including the organisation of  training programmes for law 
enforcement agencies on cybercrime investigatio n in order to improve best practice exchange 
and cooperation among law enforcement agencies, are also likely to have positive social 
impact. They provide opportunities to excha nge experience and encourage operational 
cooperation, which in turns translates into mo re efficient investigation and prosecution of 
cybercrime and a more visibl e response by law enforcement agencies. The resulting personal 
contacts and trust are also essential for a more effective law enforcement cooperation and 
public-private partnership 
Magnitude of the social impact: +++ 
5.3.3 Fundamental rights impact 
In so far as this option suggests the introduc tion of new criminal provisions and harsher 
penalties, it must be ensured that these provisio ns are drafted in line with the principles of 
legality and proportionality of criminal offences and penalties, as foreseen in Article 49 of the 
EU Charter. Careful attention must furthermore be  paid not to criminalis e lawful behaviour in 
the efforts to legislate against the tools used for attacks. This could not only impede lawful 
business activities (see Article 16 EU Charter), but could also endanger the free exercise of 
political rights and activities, such as freedom of expression (Article 11 EU Charter). This 
potentially negative impact will be mitigated by  a provision authorising the use of the tools, 
including botnets, not for the purpose of committing an offence, such as testing or protection of a computer system. An interf erence with the fundamental right s to the protection of private 
life and protection of personal data in rela tion to law enforcement and public-private 
cooperation on cybercrime incidents has to be minimized by applying existing EU and 
national legislation particularly fo r the protection of personal data. 
Nevertheless, the impact on fundamental rights by the introduction of ne w criminal provisions 
and harsher penalties will mostly be positive in terms of the protection of private life and the 
protection of personal data as a result of more effective and deterring sanctions to be imposed 
in case of infringement of the provisions of existing EU and national legislation in particular 
for the protection of personal data. 
Magnitude of the fundamen tal rights impact: -/++ 
5.3.4  Effects on third countries 
EU measures taken will have the effect of ra ising the standard for other countries. Based on 
the conducted consultations, the EU is looked upon as a standard setter. Therefore, an EU 
action will have a beneficial im pact in the long run due to othe r countries follo wing its lead. 
Stronger measures, such as more efficient contact points, will make the EU's action more effective, which in turn will translate into a more effective response worldwide given the 
interconnectedness of cont act points worldwide, including th ird countries. The introduction of 
aggravating circumstances for committing large-sc ale attacks is not expected to 'export' the 
problem to third-countries, as large-scale att acks almost invariably target EU countries, and 
 
EN 37   EN their authors are therefore liable for prosecu tion. In addition, the majority of large-scale 
attacks already origin ates outside the EU. 
Magnitude of the effects on third countries: +++ 
5.3.5  Relevance of the measure 
As explained above on the analysis of impacts, this policy option contributes significantly to 
the achievement of all objectives , and they are expected to be  met in the short-to-medium 
term. 
Magnitude of relevance: +++ (objectives A, B and C) 
5.3.6  Consistency with international law 
As already discussed, above, this policy option is consistent with the Council of Europe 
Cybercrime Convention, as was also the re quirement by the stakeholders during the 
consultation process. The new Directive on attack s would bring its use of terms and concepts 
in line with the Convention, and, similarly to Article 19 of the Convention, it introduces new 
procedural rules, such as those regarding sear ch and seizure of computer data. However, it 
goes beyond the Convention in a number of aspects: 
Substantive aspects:  
The Directive will introduce measures allowing sp ecifically tackling the large-scale aspect of 
attacks, which is in line with curren t tendencies witnesse d in cybercrime.84 
A. The Directive adds aggravating circumstances: 
• the large-scale aspect of the attacks - the botnets or  similar tools would be 
addressed through the introduction of a new aggravating circumstance, in the 
sense that the act of putting in place a botnet or a similar tool would be 
aggravating when crimes enumerated in the existing FD are committed.  
• when concealing the real identity of th e perpetrator and causing prejudice to the 
rightful identity owner (e.g. identity theft) . Any such rules would need to comply 
with the principles of legality and pr oportionality of criminal offences and 
penalties and be fully consistent with existing legislation on the protection of 
personal data85. 
B. The Directive will also introduce measur es to improve European criminal justice 
cooperation by strengtheni ng the existing structure of 24/7 contact points86:  
                                                 
84 the use of computer networks and botnets as tools in committing crimes. 
85 Such as the Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 
concerning the processing of personal data and the protection of pr ivacy in the electronic 
communications sector (Directive on privacy and electronic communications) OJ L 201 of 31.7.2002, p. 
37–47 (currently under revision), and such as the general data protection Directive 95/46/EC.  
86 Introduced by the Convention, and FD 2005/222/JHA on Attacks against Information Systems 
 
EN 38   EN • An obligation to reply to assistance reque sts over the operational points of contact 
(foreseen in Article 11 of the FD) within  a certain time limit could be proposed. . 
The Cybercrime Convention does not specify such binding provision;  
• the Contact Points will also be accessibl e to private sector input and requests. 
C. The Directive would also address the ne cessity to provide for statistical data on 
cybercrimes by imposing an obligation on the Member States to ensure that an adequate system is in place for the recording, producti on and provision of statistical data on the 
offences referred to in the existing FD.  
Formal aspects:
 
Due to the legal nature of the Convention, even  if all Member States  ratified, there are a 
number of advantages to taking action th rough means of a Directive, notably the: 
• Faster adoption of national measures 
In contrast with the lengthy procedures to sign and rati fy international conventions 
that can last for many years, Directives have  to be transposed to national legislation 
do, and set out a restricted period for implementation. 
• Monitoring of implementation 
Member States must notify the national m easures implementing Directives to the 
Commission. The correct and full implementa tion by Member States is evaluated in 
an implementation report from the Commissi on, which is then sent to the European 
Parliament and the Council. In addition, the European Court of Ju stice is entitled to 
interpret Directives via preliminary rulings.  
The Cybercrime Convention does not have the same  binding nature as an EU-initiative, and it 
is not enforceable. This is a problematic aspect as an effective approach to large scale attacks 
can only be achieved if structures, such  as the CP's are fully operational. 
Magnitude of consistency: ++ 
5.3.7  Proportionality 
This option contributes substan tially to the achieveme nt of the objectives and, at the same 
time, results in a positive economic, social an d fundamental rights impacts, which would not 
be possible to achieve appl ying simpler Community actions. The update would be limited 
only to large-scale attacks against information systems (targeted update). This problem can be 
tackled neither by the Member States alone nor merely by a non-legi slative EU action. Well 
established national arrangements and legal sy stems applied in individual Member States 
would be respected. Medium fi nancial costs would be necessa ry but would be kept on the 
minimal level to ensure the achievement of the objectives.  
As already mentioned in relation to fundamental  rights impact, the proposed measures would 
aim to prevent and combat large-scale attacks, a legitimate aim that, subject to the principle of proportionality, can justify limitations on the righ ts and freedoms recognised by the Charter, 
provided they are foreseen by la w which contain, and respect, the essence of those rights. This 
is the case of policy option 3.  
 
EN 39   EN 5.3.8  Stakeholders' views 
The risk of non-compliance and low transpositi on is expected to be low due to broad 
agreement on this policy option that has been ac hieved in the consulta tion process and due to 
the low cost associated with the proposed measures. Indeed, as explained in section 5.2.1, the 
member States and the private sector agreed on the necessity to create permanent contact 
points to deal not only w ith the public, but also with the private sector.87 The measure 
regarding data collection is also in line w ith JHA Council Conclusions of 24 October 2008, 
where Member States agreed to "compile st atistics on alerts, showing the development of 
cybercrime at national level".88 
5.3.9  Possible policy sub-options  
(a) Aggravating circumstances:  
These policy sub-options deal specifically with objective A. They have little to no impact on 
objectives B & C. 
Policy options 1 and 2 aim at the establishing a system of dissuasive punishments as the legal 
response to cyber attacks. Policy option 2 aims at incorporating the proceeds of the illegal 
activities into the punishment. As these economic gains are the main reason for committing the crime, this might have a more  dissuasive effect than option 1. 
Option 3 (a combination of both) will of course have the biggest effect. 
(b) The obligation on the 24/7 contact poi nts to respond to assistance requests: 
These policy sub-options deal specifically with  objective B. They have  little to no impact on 
objectives A & C. 
Policy option 1 does not define a strict dead line for reaction, thus leaving a margin of 
interpretation. Opposed to th is is policy option 2, where th e deadline is fixed. Option 3 
introduced the concept of 'urgency', whilst at th e same time leaving the definition of this in 
the realm of the Member Stat es. This, in ideal circumstan ces, could lead to a clear 
classification where Member States and the private sector have a clear understanding of 
cooperation. A risk lies in cross-border cases, where this solution leaves room for 
interpretation. However, the time limit, analogous with option 2, should offset this. 
The sub-options under (b) are in  line with the above-mentioned Council Conclusions of 27-28 
November 2008, which stated that permanent cont act points should facilit ate the "clarity and 
efficiency of request and respons e processes" and that the "qualif ication of ‘urgent’ should be 
agreed between law enforcement and the private sector".
89 Moreover, the second and third 
policy sub-option takes into account Arti cle 4 of the Council Framework Decision 
                                                 
87 OJ C 62 of 17.3.2009, p. 18.  
88 Council Conclusions on setting up national alert platforms and a European alert platform for reporting  
 offences noted on the Internet, 2899th JUSTICE and HOME AFFAIRS Council meeting, Luxembourg, 
24 October 2008, p. 2. 
89 OJ C 62 of 17.3.2009, p. 18. 
 
EN 40   EN 2006/960/JHA90 ("shall ensure that they have proce dures in place so that they can respond 
within at most eight hours to urgent request  […]"), which limits the time period of response 
between law enforcement authorities when exch anging information and intelligence (see also 
section 4.3 above). 
Each sub-option under (a) is also mutually compatible with any sub-option under (b). 
5.3.10  Political feasibility 
This policy option is politica lly feasible, as it builds upon the consensus between all 
stakeholders, and is compatible with both EU priorities and the priorities set out at the international level.
91 Indeed, as already mentioned in section 2.9, the Counc il of Europe's 
Global Project on Cybercrime has as one of its priorities the effective criminalisation of 
cyber-offences. The project clearly states that "[t]he legislation of different countries should 
be as harmonized as possible to facilitate cooperation."92 The suggested policy sub-options 
allow sufficient manoeuvre for discussion in  the final elaboration of the update. 
In terms of the level of interv ention needed by the Member Stat es, almost all Member States 
will have to take action for each of the issues, but the proposed measures have been welcomed 
by all Member States in the consultation process,  as they were not considered too costly and 
difficult to implement. Most Member States have at present low level penalties (1 to 3 years), 
which is in line with the current FD on atta cks. Only Estonia has introduced aggravating 
circumstances for large-scale attacks, and Fran ce and Germany recently increased penalties to 
up to five years for cyber attacks. The UK Co mputer Misuse Act of  1990 (updated in 2004 to 
comply with the Council of Eu rope Cybercrime Convention) allows penalties of up to 10 
years for cyber attacks. 
The Contact points of FR, UK, IT, EE, NL and LT already usually respond within less than 12 
hours to assistance requests, although they do not specify any time limit for that. Other 
Member States will have to modify more subs tantially their existing arrangements for contact 
points. While Member States collect statistical data relating to cybercrime, the statistics are 
often not comparable due to va rying statistical methodologies applied by the Member States. 
5.4 Option (4) Introduction of comprehe nsive EU legislation against cybercrime 
This policy option introduces new comprehensiv e EU legislation, dea ling with all aspects 
related to cybercrime. It invol ves the update set out in policy option 3, and adds the soft-law 
measures of policy option 2. It goes beyond thes e by tackling other legal problems related to 
internet usage.  
5.4.1 Economic impact 
• financial cost: ---  
                                                 
90 Council Framework Decision 2 006/960/JHA of 18 December 2006 on simplifying the exchange of 
information and intelligence between law enforcem ent authorities of the Member States of the 
European Union. 
91 Council Conclusions of 27/11/2008, and the European Security Strategy. 
92 See: http://www.coe.int/t/dghl/c ooperation/economiccrime/cybercri me%5Ccy%20Project%20global% 
20phase%202/2079adm_prosummary1d%20_9%20mar%202009.pdf 
 
EN 41   EN • economic benefit: +++ 
The budgetary consequences of the criminal la w provisions cannot be quantified since they 
are included in the general costs of the criminal  justice system. Neverthe less, it is possible to 
estimate that there will be additional costs related to the obligation to set up permanent 
contact points and their monitoring obligati on, which have been estimated at around EUR 
219,000 per Member State (see Annex 1 and 2).  
In addition, blocking access to we bsites offering tools to carry out attacks against information 
systems would involve financial costs. The economic impact of a similar measure to restrict 
access to material inciting terrorism was asse ssed in revising the Framework Decision on 
Combating Terrorism and Framework Decision  on combating the sexual abuse and sexual 
exploitation of children.93 Although the impact assessments accompanying the respective 
Commission proposals state d, the cost of imposing any of the different filtering methods to all 
internet service providers based in the EU is im possible to calculate, an  upper limit of EUR 10 
per computer is given on the basis of a specific example of implementing filtering in a network of 100,000 computers at 4,000 schools in Ireland. The cost of running a list of 
websites to be blocked may be  borne by those in charge of it, whether law enforcement 
authorities or specific NGOs. This can be estimated at about EUR 110,000 and EUR 90,000 per year for maintenance. However, EU fundi ng may be available for managing blacklists and 
exchanging information on illegal content, such as under the financial programme 'Prevention 
of and fight against Crime'. 
The economic impact related to the decrease of severe forms of crime is likely to be positive, 
since this option is most likely to produce deterrent effects and a substantial reduction of the scale of the crime in the medium-to-long term.  
The Directive on attacks will criminalise the use, sa le and putting at the disposal of tools such 
as botnets; thereby undermining the ability of or ganised crime to launch large-scale attacks. 
This criminalisation will also affect the ability  to use these tools for committing other types of 
cybercrimes, and gives law enforcement agencies a tool in fighting cert ain crimes related to 
terrorism, such as cyber attacks against critical infrastructure. 
However, the considerable economic losses re sulting from cybercrime are unlikely to be 
reduced in the short term by an attempt to  introduce a comprehensive EU legislation on 
cybercrime. Such impact has to be viewed  as medium-to-long term, as negotiating a 
comprehensive EU legislation would likely cause delays due to the existing disparities among 
Member States' practices and positions on issu es, such as collection/ storage/transfer of 
electronic evidence, the blocking of  websites that can be used to sell tools facilitating attacks, 
and a clearer definition of juri sdiction rules. Indeed, only six EU member states currently 
allow blocking access to web sites with illicit web content: DK, FI, IT, NL, SE and UK. Only 
BE, DE and FR consider this option to be in troduced this year, mo stly on voluntary-based 
agreements with the private sector. No othe r countries are currently favourable to this 
measure. 
Moreover, the current practice of blocking access is targeted principally at child-abuse web 
content.
94 However, thousands of web sites exist where tools for creating and selling custom 
                                                 
93 SEC(2009) 355, p. 29.  
94 A number of current non-legislative activities concerning filtering/blocking of illicit web content are 
currently undergone in for a, such  as COSPOL Internet Related Child Abusive Material Project or the 
 
EN 42   EN designed malware (e.g. botnets) are openly comme rcialised. Any of these tools poses a threat 
and could be used for cyber attacks, corpor ate espionage and theft of confidential and 
sensitive data. These sites may also offer stolen  personal data, credit card details and other 
illegally obtained material. However, it is very  unlikely that political agreement on blocking 
or 'take down' measures that go beyond chil d pornography can be reached at this stage.95 This 
has to do with different interp retations in national legal sy stems about what content is 
considered harmful. 
The argument is raised that blocking websites can  easily be circumvented. With regard to the 
blocking of child pornography websites, this argum ent is however not convincing, as the 
average paedophile is not a versed IT expert. Ad mittingly, the situation is different in the case 
of websites offering tools to carry out cyber attacks. Here, the likely user will probably 
possess a higher level of IT skills and blocking might not be an effective measure in this context. 
Similarly to the previous section, the admini strative cost related to the obligation on the 
Member States to ensure that an adequate syst em is in place for the recording, production and 
provision of statistical data on attacks against information systems is expected to be low. 
Magnitude of the economic impact: ---/+++  
5.4.2 Social impact 
A positive impact on public security and citizens’ trust can be expected, but only in the 
medium-to-long term given the necessity to implement all measures of a comprehensive EU legislation. This would be ma de more difficult by introducing all other complementary 
measures on which there is currently little consensus among stakeholders (as became obvious 
during the consultation process). Nevertheless, one can assume that by the approximation of 
national law in the area of cybercrime, law en forcement and judicial cooperation improves, 
which in turn translates over time into a gr eater number and quality of investigations and 
prosecutions. 
Magnitude of the social impact: +++  
5.4.3 Fundamental rights impact 
In addition to the elements outlined in op tion 3, this option would introduce legislation 
covering illicit web content, including blocking of  access to websites that facilitate attacks as 
well as legislation covering the collection, st orage and transfer of  electronic evidence. 
Blocking of websites by public authorities may carry the risk that also legal Internet content is 
deemed illicit and could lead to infringement s of the right to engage in legal business 
activities and freedom of expressi on. As far as the introduction of criminal procedural rules is 
concerned, negative impacts on the principle of presumption of innocence, the right to a fair 
                                                                                                                                                        
 
Virtual Global Taskforce, which Member States may join in the short-term. See: 
http://www.europol.europa.eu/index.asp?page=I nternetRelatedChildAbusiveMaterialProject; 
http://www.virtualglobaltaskforce.com/ 
In this framework too, is the proposal for a new FD on combating the sexual abuse , sexual exploitation of 
children and child pornography, repealing Framework Decision 2004/68/JHA, COM(2009)135 final 
95 This is the conclusion of consultations undertaken by the Commission in preparation for this impact 
assessment. 
 
EN 43   EN trial, and the right of defence would need to be avoided (Articles 47 and 48 EU Charter). The 
blocking of access should be subject to adequate safeguards, in particular to ensure that the 
blocking is limited to what is necessary, that users are informed  of the reason for the blocking 
and that content providers, as fa r as possible, are informed of the possibility of challenging it. 
As for the obligation to collect statistics, sta tistical data is anonymous , and therefore does not 
have data protection implications. 
Magnitude of the fundamental rights impact: --/++ 
5.4.4  Effects on third countries 
The legislative update will have in the medium -to-long term a positive effect on the situation 
in third countries. EU measures taken will have  the effect of raising the standard for other 
countries. Based on the conducted consultations, the EU is looked upon as a standard setter. 
Therefore, an EU action will have a beneficial  impact in the long run due to other countries 
following its lead. 
Magnitude of the effects on third countries: +++ 
5.4.5  Relevance of the measure 
As explained above on the assessment of impact s, the policy option c ontributes potentially 
significantly to the achievement of all objectives, but  unlike in previous  policy option, they 
cannot be met in the short-to-medium term, wh ich would not meet current expectations of 
stakeholders.  
Magnitude of relevance: ++ (objectives A, B and C) 
5.4.6  Consistency with international law 
As already discussed above, th is policy option is consistent  with the Council of Europe 
Cybercrime Convention, but goes beyond in a numb er of measures as di scussed in previous 
policy option. Moreover, a number of negative im pacts on fundamental rights would have to 
be minimized to ensure consistency w ith EU Charter of Fundamental Rights. 
Magnitude of consistency: -/++ 
5.4.7  Proportionality 
Similarly to policy option 3, this option contribut es substantially to the achievement of the 
objectives and, at the same time, results in positive economic, social and fundamental rights 
impacts. However, as the proposed solution woul d not be limited only to large-scale attacks 
against information systems (targeted update),  but would also tackle other forms of 
cybercrime, it would be dispr oportionate to the obj ectives sought. Indeed, applying simpler 
Community actions, such as policy option 3, woul d be possible to deal with the identified 
problems.  
 
EN 44   EN 5.4.8  Stakeholders' views 
Although most stakeholders agreed on the long-te rm need to deal with large-scale cyber 
attacks, and cybercrime in general, by in troducing comprehensive measures, including 
legislation, no consensus emerged in the consulta tion process on the measures to be included 
in the comprehensive legislation.  
5.4.9  Political feasibility 
This policy option is currently not politically feasible, as there is  little consensus on the scale 
and scope of such legislati on (as already discussed in 5. 4.1). Moreover, Member States 
policies on the admissibility of electronic evidence in courts are too differently developed. An approximation in this area would be difficult to attain in the short-to-medium term.
96 
5.5 Comparison of options  
Option (1) Status Quo As cybercrime will become more advanced over time, this would also lead to an increased 
vulnerability for all actors (public and priv ate). The overall security structure (law 
enforcement and the legal framework) will not catch up with the crime. Even at a sustained 
level of currently existing actions, Eur opean coordination would be required.  
Option (2) Development of a programme to st rengthen the efforts to counter attacks 
against information sy stems with non legislative measures  
This option has all the advantages and disadvant ages related to a soft law instrument. The 
positive side is that it is possible to descri be each measure as the current best national 
practices, and thereby facilitate  the identification of which measures are best in terms of 
effectiveness. 
However, this option is less effective in te rms of the achievement of the objectives. In 
addition, this option implies that a ban of botne ts and similar tools will not be addressed. 
Furthermore, issues related to substantive crim inal law and prosecution are crucial to curb and 
eradicate the crime; these are not properly addressed in this option. 
Option (3) Targeted update of FD on attacks  to address the threat from large-scale 
attacks against info rmation systems  
This option offers a timely and targeted respons e to the identified problems. It addresses the 
criminal law issues necessary to effectively pros ecute the perpetrators of  this crime. It also 
improves international cooperation by introduci ng a mechanism for immediate international 
assistance in cases of urgent requests for cooperation, and promotes cooperation with the 
private sector through accompanying measures, such  as expert meetings. Finally, to enable 
measuring of the extent of the problem , monitoring obligatio ns are introduced. 
                                                
 
96 “The Admissibility of Electronic Evidence in Court: Fighting against Hight-tech Crime,” Cybex report 
(2006); available at: http://www. itu.int/osg/csd/cybersecurity/WSI S/3rd_meeting_docs/contributions/ 
libro_aeec_en.pdf 
 
EN 45   EN Option (4) Introduction of comprehensive EU legislation against cybercrime 
This option, like option 3, has the added value of establishing binding provisions, and 
therefore a higher level of effectiveness is expected  if fully implemented. It is also expected to 
maximise the positive impact of both the legisla tive and non-legislative instruments in a wider 
range of cybercrime issues th an only large-scale attacks. In addition, it would address the 
criminal law legal framework and at the sa me time improve law enforcement cooperation 
over the borders. However, this ho listic approach at this stage is  not reflecting a consensus of 
the stakeholders.  
5.6 T HE PREFERRED OPTION : A COMBINATION OF OPTIONS (2) "DEVELOPMENT OF A 
PROGRAMME TO STRENGTHEN THE EFFORTS , WITH NON -LEGISLATIVE MEASURES ", 
AND (3) "A TARGETED UPDATE OF FD ON ATTACKS " 
The preferred policy option is neither of the f our policy options alone, but a combination of 
policy options 2 and 3. These policy options comp lement each other and therefore best meet 
the defined objectives, and give th e most value added in resolvi ng the issues associated with 
the existing situation.  
The preferred option combines all elements  of options (2) an d (3), which are: 
From Option 2, the non-legislative elements:  
• Strengthening of the existing 24/7 networ k of contact points for law enforcement 
authorities by establishing best practice recommendations;  
• Establishment of an EU network of public-priva te contact points of cybercrime experts and 
law enforcement, and consequent opening of  these contact points for requests from the 
private sector. This network would bring a bout a list containing contact details on both 
public and private contact points the elaborati on of a standard EU se rvice level agreement 
for law enforcement cooperation with private sector operators; 
Supporting the organisation of training programmes for law enforcement agencies on 
cybercrime investigation.  From Option 3, the legislative elements:  
• Introduction of legislation agains t the tools used for attacks against information systems;  
• Introduction of new aggravating circumstances re garding large-scale attacks, such as the 
act of putting in place a botnet or a similar t ool enabling committing offences mentioned in 
Article 2 of the current FD, and when comm itted by concealing the real identity of the 
perpetrator and causing prejudice to the rightful identity owne r (so-called identity theft);  
• Introduction of an obligation for Member States  to respond to an urgent request from both 
the public and the private sector via the 24/7 network of contact points within a certain 
time limit;  
• Introduction of a monitoring oblig ation for Member States to facilitate the collection and 
provision of data about cyber attacks a nd cybercrime, including the number of 
prosecutions and criminal reports.  
 
EN 46   EN Rationale for levels of penalisa tion and international cooperation  
A higher level of penalisation is required to effectively pursue international cooperation in the 
fight against cybercrime for the following reasons: 
• Firstly, higher level of penalties applied cons istently across the EU, and the introduction of 
aggravating circumstances would mean that a cr iminal offence linked to a large-scale attack 
will be treated everywhere as a serious crime. Differences between Member States’ levels of penalisation hinder cooperation, as level of  penalties in some countries may not be 
regarded as severe enough to  justify rapid cross-border la w enforcement and judicial 
cooperation. Qualificatio n as serious crime would allow for rapid, and fully fledged cross 
border law enforcement and judicial cooperation.  
The currently low level of penalties across the EU (mostly up to 3 years) does not reflect 
the seriousness of large-scale attacks and the damage they inflict. Estonia called for higher penalties nationally and internationally following cyber attacks in 2008. Lithuania 
increased penalties for cyber attacks in 2007, and at the same time called for higher penalties across the EU and in ternationally. The minimum of the maximum penalty should 
therefore be set at five years,  which corresponds to the level in those Member States which 
recently increased their penalties for cyber att acks, as well as to the generally perceived 
notion of what constitutes serious crime. Su ch an increase in the minimum level of 
penalties will not only send a cl ear message that the European Union is regarding this type 
of criminality with increased seriousness, but is also likely to have  a deterrent effect.
97 
• The legislative changes that were introduced by Estonia are too recent to establish a link 
between the higher penalties and the number of large-scale att acks. Large-scale attacks will 
inevitably continue to grow in absolute terms in years to come due to the fast development 
in computer technologies and the growth of the Internet. The Inte rnet will grow in terms of 
potential uses, applications, and number of users. Especially the new possibilities the 
Internet offers also come with vulnerabiliti es that can be explo ited. However, higher 
penalisation may slow down th e growth dynamic of the crimes, and limit the impact the 
attacks have on societies. S econdly, only qualification as se rious crime would allow for 
provision of adequate resources by law enforcem ent. To investigate cybercrime, computer 
data need to be tracked by specialized officer s, and specific high-tech tools need to be 
applied. This makes this type of investigatio ns rather costly. As a consequence, cross-
border cybercrime investigations are still rare , which compares unfavourably with the large 
number of cyber attacks.  
• Secondly, the use of special i nvestigative techniques (without which effective cybercrime 
investigation is not possible) is  only allowed in a number of c ountries in relation to serious 
crimes as they potentially infringe on individual liberties. These may be electronic surveillance, phone tapping and remo te investigation techniques.  
• Thirdly, the deterrent function of criminal law is  related to the level of  penalties. The higher 
the penalties, the higher their deterrent function is and this is one of the fundamental 
principles of modern criminal policy from  its beginning. This goes hand-in-hand with a 
stronger and more publicly visibl e prosecution of the crimes.  
                                                
 
97 For general surveys of the deterrent effect of higher penalties, see:  
http://pricetheory.uchicago.edu/levitt/Paper s/LevittWhyDoIncreasedArrest1998.pdf 
 
EN 47   EN The lack of efficient internat ional cooperation also results fr om problems with functioning of 
the contact points. Contact points are the firs t interlocutors among Member States and when 
international cooperation is sought  in cybercrime investigation. Their efficiency (speed of 
reaction) determines the effici ency of the whole investiga tion. Strengthening the contact 
points by making them truly permanent is goin g to make not only the EU, but the whole 
network of G8 and Council of Europe contact points stronger.98 Indeed, the G8 JHA 
Ministerial Declaration (29-30 Ma y 2009), raised the issue of fu rther cooperation between the 
Member States concerning cybercrime by stating that : "It is also essential for States to give a 
technologically advanced response, and to stre ngthen the existing forms of international co-
operation such as the G8 24/7 High Tech Crime Points of Contact."99 Similarly, the Council 
of Europe has called for greater efficiency in cooperation among the c ontact points, and is 
currently evaluating the efficiency of the contact  points in a report entitled "The functions of 
24/7 points of contact for cybercrime".100 Therefore, by promoting the efficiency of EU 
contact points we promote the efficiency of the whole world network of contact points. 
Due to the prioritisation of cybercrime brought by higher level of penalties, and the 
obligations included in the update of the FD to have the contact points operate efficiently and 
on a 24/7 basis, a new "institutional culture" will gradually come into existence. It will also 
build trust and know-how between the contact poi nts and law enforcement authorities, which, 
in turn, will make the fight against large scale attacks more efficient. This culture will be 
reinforced by the flanking actions such as the training and the establishment of the public-private network of contact points. 
Finally, training of law enforcement will also  enhance the capabilities of law enforcement 
agencies to respond effectively to cyber attacks. Promoting c ybercrime training of both law 
enforcement agencies and the private sector is esse ntial if the efficiency of all the measures in 
the preferred policy option is to be maximize d. In line with its Communication of 2007, the 
Commission is currently establishing with the Member States and the private sector an EU 
cybercrime training platform.
101 This support enables to bring together the best cybercrime 
trainers and training material in Europe, and to share this expertise with countries, which 
would not otherwise be able to  have access to such expertis e. EU funding also serves to 
update the training material to keep abreast of the fast-evolving t echniques used by cyber 
criminals. 
The setting up of EU cybercrime training plat form also goes beyond EU borders, as the 
training material is currently being shared wi th Europol, Interpol a nd the Council of Europe. 
The EU-funded material has become a gl obal reference for cybercrime training.  
                                                 
98 There are cases of cyber criminals in the UK, Sw eden and Norway being tr acked within 4 hours from 
notification by the UK law enforcem ent due to swift public-private cooperation and a rapid reaction by 
24/7 contact points.   
99 Final Declaration, G8 ministerial meeting of Ju stice and Home Affairs, Rome, 29- 30 May 2009, 
http://www.g8italia2009.it/static/G8_Allegato/declaration1giu2009.pdf 
100 Council of Europe paper "The functions of 24/7 points of contact for cybercrime", 2009. Still to be 
released. 
101 Communication from the Commission to the European Parliament, the Council and the Committee of 
the regions "Towards a general policy on the fight against cyber crime", COM(2007) 267 final 
 
EN 48   EN 5.6.1 Economic impact 
The economic impact of combining the non-legisl ative measures with th e update of the FD on 
attacks will be bigger than choosing and implemen ting either one of the op tions. This is due to 
the synergies that are created in the combination. 
The costs linked to this option are defined in the detailed assessments of options (2) & (3) 
above, and can be estimated at EUR 219,000 per Me mber State for making the contact points 
available 24/7. Including also the total monito ring and reporting costs (Annex 2), the overall 
cost linked to the obligation of  Member States to keep cont act points and provide statistics 
would amount EUR 5,960,655 for the entire EU. No  other entities will be subject to new 
reporting obligations. The cost of the elaboration of a standard EU service level agreement for 
law enforcement cooperation with private sect or operators has been  estimated at EUR 30,000 
for the Commission. 
The synergies are especially in the combination of programmes, such as the establishment of 
networks of cybercrime experts, the use of  a service level agreement and the training 
programmes for law enforcement agencies, with the strengthening of the legal framework (the 
Directive). The policy sub-options allow for the establishment of a dissuasive level of penalties, and optimize the way in wh ich the 24/7 contact points operate. 
This combination of options also allows lin king the binding nature of the update with the 
positive results to be expected from the flanki ng non-legislative measures, such as training.  
• financial cost: --  
• economic benefit: +++ 
Magnitude of the economic impact: --/+++  
5.6.2 Social impact 
The social impact in terms of improving the se curity and trust of ci tizens by the actions of 
existing law enforcement contact points will be  enhanced: if citizens and economic operators 
affected by cybercrimes are given the possibilities to report these crimes in a trusted manner, 
and if law enforcement has the possibilities to ac t, the overall perceived and real security will 
rise. For companies and internet service provi ders, initiatives such as the service level 
agreement, will provide the tool for transmitting confidential data on attacks in a trusted way 
to law enforcement.  
Magnitude of the social impact: +++ 
5.6.3 Fundamental rights impact 
Any measure taken by the Co mmission will be in line with  articles 7 & 8 European 
Convention on Human Rights. This concerns especially measures taken concerning the 
storage of data and the exchange of data be tween law enforcement agencies. However, the 
existing EU and national legisla tion, in particular on data prot ection, will guarantee a minimal 
impact on fundamental rights.  
 
EN 49   EN The strengthening of EU legi slation (Directive) through the penalisati on of the production, 
sale, procurement for use, import, distributi on or otherwise making av ailable of tools for 
cyberattacks needs to be worded carefully in or der not to criminalise lawful behaviour. This 
lawful behaviour includes the economic activities by internet security companies, such as the use of botnets to test the effectiveness of their products. From fundamental rights point of 
view, this measure needs to guarantee the free dom of expression and the free exercise of 
political rights and activiti es (Article 11 EU Charter of Fundamental Rights).  
This exception can be guaranteed in the following way:
 
• By making explicit references to the EU Charter, and referring to it as basic law for the 
interpretation of the acti ons investigated under the terms of the FD on attacks; 
• By detailing the exact conditions under which th e use of ICT tools that are mainly used to 
launch large scale attacks, can be used fo r beneficial purposes. To establish these 
conditions, further consultations  will be conducted with the relevant stakeholders, and a 
'white listing' of these conditions will be don e. This process implies that when these 
conditions are not met, the use of the tools is considered to be malic ious and can therefore 
be prosecuted. 
It will be modelled on the re levant provision in the Coun cil of Europe's Convention on 
Cybercrime, article 6, paragraph 2. 
Magnitude of the fundamen tal rights impact: -/++ 
5.6.4  Effects on third countries 
The positive effect of the comb ination of non-legislative ac tions and a proposed targeted 
update of the FD on attacks would be very positive, due to both the making available of knowledge and expertise on the one hand, and acti ng as a standard setter on the other hand. 
The positive effects would be most visible in the long term, but would already become clear 
through international coopera tion in the short-term. 
Magnitude of the effects on third countries: +++ 
5.6.5  Relevance of the measure 
The preferred policy option contributes in an  optimum way to the achievement of all 
objectives, which are expected to be met in the short-to-medium term. Furthermore, the 
achievement is supposed to be sustainable,  through the application of the flanking non-
legislative measures. 
Magnitude of relevance: +++ (objectives A, B and C) 
5.6.6  Consistency with international law 
The consistency of this option is identical to the consistency with international law of Option 
3 (see point 5.3.5), as Option 2 does not have implications on internati onal law (the 
Cybercrime Convention). 
 
EN 50   EN Magnitude of consistency: -/++ 
5.6.7  Proportionality 
The combination of the two options answers th e need to not only strengthen the legal 
framework, but to supplement it with fla nking measures. The synergies lead to the 
achievement of all objectives, and establish a good and positive balance in the economic, social and fundamental rights impacts.  
The proposed legislative measures will, on th e one hand, aim to prevent and combat large-
scale attacks, whilst the flanking non-legislat ive measures ensure a close and efficient 
cooperation between the law enforcem ent agencies across borders.  
5.6.8  Political feasibility 
The political feasibility of this option is the highest of all discussed options. It builds on the 
consensus amongst (public and private sector) stakeholders, on the policy documents that 
have been issued by the EU, and the actions that  are currently developed at the international 
level (especially the G8). 
5.6.9  Implementation of the measures 
As the real value added of the preferred option lies in the synergies created by the 
combination of both options, it is important to  ensure the correct implementation of all its 
components, legislative and non-legislative. 
In order to guarantee the impl ementation of non-legislative m easures, the following examples 
of actions can be mentioned: 
Concerning the establishment of a service leve l agreement, the Comm ission will follow the 
JHA Council Conclusions of 27-28 November 2008 on closer public-private cooperation. 
Best-practices will be learned from the Member States where such agreements are already in 
place, such as the German example of vol untary agreement dealing with Child Abuse 
Materials on the internet. 
The non-legislative measure of promoting traini ng is in line with th e Communication of 2007, 
and the financial support is and will be provided by EU financia l programmes, such as ISEC 
('Prevention of and Fight against Crime'). An example is the ongoing initiative to create EU 
training platform. 
The nature of non-legislative measures will  require that their implementation is done 
voluntarily by the Member States . However, as mentioned above , previous experience gained 
in public-private cooperation agreements and tr aining programmes suggests that the level of 
commitment by the Member States to other non- legislative measures is  expected to be good. 
Moreover, by agreeing to the Stockholm programme, the Member States have committed to promote cross-border investiga tions of cybercrime, and calle d on the Commission to take 
measures for enhancing/improvi ng public-private partnerships.
102  
                                                 
102 OJ C 115 of 4.5.2010, pp. 1-38. 
 
EN 51   EN 6. C OMPARING THE OPTIONS  
6.1. Summary table: costs and benefits 
Options Economic 
impact Social impact Fundamental 
rights impact Impact on third 
countries Relevance for 
objectives 
A,B,C Consistency 
with int’l law 
Option 1: Status quo / no new EU action 0 0 0 - 0 0 
Option 2: Development of a programme to strengthen the efforts to counter attacks 
against information systems with non- 
legislative measures. -/+ ++ -/+  
++ A + 
B ++ 
C + -/+ 
Option 3: Targeted update of FD on attacks to 
address the threat from large-scale attacks 
against information systems. --/++ -/+++ -/++  
+++ A +++ 
B +++ 
C +++ ++ 
Option 4: Introduction of comprehensive EU 
legislation against cybercrime. 
---/+++ +++ --/++  
++ A ++ 
B ++ C ++ -/++ 
Preferred option (Options 2 and 3): 
combination of non-legislative measures with a targeted update of the FD on Attacks --/+++ +++ -/++  
+++ A +++ 
B +++ C +++ ++ 
 
EN 52   EN 7. M ONITORING AND EVALUATION  
With respect to the specific and operational objectives identified in this impact assessment, 
rough indicators could be the following:  
Objective Indicator 
Specific Objective: 
A. Prosecute and convict criminals 
responsible for large-scale attacks, through the approximation of criminal law in the area of attacks against information systems  
A.1 To address the problem of large scale 
attacks from a criminal law perspective; i.e. through the criminalisation of the sale, use and putting at the disposal of tools. Number of investigated and prosecuted cases. 
Number of large-scale attacks detected 
A.2 To facilitate prosec ution of cross-border 
cybercrime cases. Number of cybercrime cases in which 
European cooperation tools have been used. 
A.3 To impose effective, proportionate and 
dissuasive penalties. Level of penalties imposed. 
Number of penalties. 
Specific Objective: B. Improve of cross-border cooperation 
between Law Enforcement Agencies  
B.1 To introduce mechanisms for immediate 
international assistance in cases of urgency in a Member State.  Number of occasions that the 24/7 network 
has been used. 
Time needed to get replies on urgent requests. 
B.2 To improve exchange of information 
and best practices among Member States. Number of organised be st practice events in 
the EU. 
Number of participants. 
B.3 To improve public-private 
cooperation through the establishment of contact points and cooperation agreements. 
 Creation of a service level agreement. 
Number of information exchanges between 
public and private sector contact points. 
 
EN 53   EN Specific Objective:  
C. To establish effective monitoring 
systems   
C1: To record, produce and provide 
statistical data on the offences referred to in the Directive. Monitoring mechanism established at national 
level. 
Tasks, human resources and budget set up. Number of information exchanged through the 
established channels. 
The Commission should ensure th e regular monitoring and eval uation of the Directive on the 
basis of the proposed indicators.  
An implementation report should be published within 2 years after the date of entry into force 
of the Directive. This report should pay attent ion to the exact implementation of the Directive 
by the Member States.  
Furthermore, regular evaluations  should be carried ou t in order to assess how and to what 
extent the Directive has contributed to the ach ievement of its objectives. The first evaluation 
should be carried out within fi ve years after the entry into force of the Directive; the 
Commission will then publish evaluation reports every five years thereafter and these will include information on implementation. On the ba sis of the conclusions and recommendations 
of the evaluations, the Commission should take into account any further amendment to or other possible developments of the Directive. 
 
EN 54   EN Annex 1  
Costs of keeping permanence of the contact points per Member State 
     Tariff (€ 
per hour)  
Time  (hour) Price 
(per action or equip) Freq  
(per year) Cost per 
Member State (€) 
No. Ass. Art. Orig. 
Art. Type of 
obligation Description of required 
action(s) Target 
group        
1      permanence
103  Keeping 
permanence in the 24/7 contact points. Member 
States 25  24 600 365 219,000 
Annex 2  
Administrative costs related to the contact points  (labour costs and overhead costs)  
Policy Option 3:  
     Tariff (€ 
per hour)  
Time  (hour) Price 
(per action or equip) Freq  
(per year) Nº of  
entities Total  
cost (€) Cost per 
Member State (€) Regulatory 
origin (%) 
      
No. Ass. Art. Orig. 
Art. Type of 
obligation Description of required 
action(s) Target 
group            Int EU104 Nat Reg 
1     collection 
 Collection of 
cybercrime data 
based on reports. Member 
States 25  24 600 365 27  5,913,000  219,000   0-95% 5-100%     
2   Annual 
reporting Annual reporting to 
the national statistical office. Member 
States 25  30 750 1 27  20,250  750   0-95% 5-100%
   
                                                 
103 This obligation already exists in the existing FD 2005/222, and can therefore not be considered to be a "new" administrative c ost. 
104 EU member states have the possibility to apply for Commission co -funding up to 95% of the overall costs associated with the re levant measures. 
 
EN 55   EN Total costs EUR 5,933,250 
The assumption is that there are 1760 working hours per year per person (8 hours * 20 days * 11 months).  
Average employment costs in the EU-27 public administration: Euro stat: Average hourly labour costs, defined as total labour cos ts divided by the corresponding number of hours worked (€20,35 in 2005). The 
2005 figure has been rounded upwards, based on the assumption of economic growth and pattern over the preceding years and overh eads of 10% have been added. 
Source: http://epp.eurostat.ec.eu ropa.eu/portal/page?_page id=1996,39140985&_dad=portal&_schema= PORTAL&screen=detailref&language =en&product=Yearlies_ne w_population&root=Y 
 
EN 56   EN Administrative costs related to monitoring costs  (labour costs and overhead costs) 
Policy Option 3:  
     Tariff (€ 
per hour)  
Time  (hour) Price 
(per action or equip) Freq  
(per year) Nº of  
entities Total  
cost (€) Cost per 
Member State (€) Regulatory 
origin (%) 
      
No. Ass. Art. Orig. 
Art. Type of 
obligation Description of required 
action(s) Target 
group            Int EU105 Nat Reg 
1      monitoring  retrieving relevant 
information from existing data
 Member 
States 25  40,00 1,000 1 27  27,000  1,000  0-95% 5-100%     
2     monitoring Submitting the 
information (sending it to the designated 
recipient) Member 
States  
25  0,1 2.5 1 27  67.5 2.5   0-95% 5-100%     
3     monitoring   filing the information Member 
States 25  0,5 12.5 1 27  337.5  12.5   0-95% 5-100%     
Total costs EUR 27 405  
The assumption is that there are 1760 working hours per year per person (8 hours * 20 days * 11 months).       
Average employment costs in the EU-27 public administration: Eu rostat: Average hourly labour costs, defined as total labour cos ts divided by the corresponding number of hours worked (€20,35 in 2005). The 
2005 figure has been rounded upwards, based on the assumption of economic growth and pattern over the preceding years and overh eads of 10% have been added. 
Source: http://epp.eurostat.ec.eu ropa.eu/portal/page?_page id=1996,39140985&_dad=portal&_schema= PORTAL&screen=detailref&language =en&product=Yearlies_ne w_population&root=Y 
 
TOTAL ADMINISTRATIVE  COSTS: EUR 27 405 + EUR 5,933,250 = EUR 5,960,655  
                                                 
105 EU member states have the possibility to apply for Commission co -funding up to 95% of the overall costs associated with the re levant measures.