WRITTEN QUESTION E-2064/02

by Erik Meijer (GUE/NGL) to the Commission

(11 July 2002)

Subject: Misuse of websites and charge collection methods to confront consumers unexpectedly with the biggest possible telephone bills

1. Is the Commission aware that users of personal computers are taken unawares by unexpectedly large bills for calling premium rate numbers, sometimes in distant countries, as a result of visiting websites which give the impression that their purpose is to provide consumers with information or entertainment, and that these costs arise from the fact that, after contact with the internet provider has been broken, a connection is automatically established with a telephone number which is not broken once the visitor leaves the website but is reactivated every time the consumer uses the internet again? Are these unforeseen charges caused by the fact that software is in secret remotely installed on customers' personal computers, and are the large telephone charges incurred by customers in such situations not a side-effect but the deliberate main purpose of these operators' activities, bearing in mind inter alia that the holding open or reopening of phone lines is kept secret from customers?

2. Is the Commission also aware that the phenomenon of unexpectedly high telephone charges may also arise if the customer himself consents to the installation of dialler access by means of which one can pay for internet services, because the telephone company collects payments on behalf of businesses to which it has leased the dialler numbers, while it does not prevent these numbers from being subleased to other businesses with criminal intentions and does not prevent the setting of extremely high charges, so that up to EUR 400 per minute is now being charged for content which is not serious?

3. In view of this deliberate fraud against computer users, will the Commission increase protection against abuses in international electronic commerce? What measures are being considered to this end, and how soon could they enter into force?

Sources: De Volkskrant, 21 June 2002, Frankfurter Allgemeine Sonntagszeitung, 23 June 2002.

Answer given by Mr Liikanen on behalf of the Commission

(26 September 2002)

Electronic communication networks and information systems are an essential part of the daily lives of European citizens and are fundamental to the success of the Union's economy. Networks and information systems are converging and are becoming increasingly interconnected.

Despite the many benefits of these developments, these infrastructures have their own vulnerabilities and offer new opportunities for criminal conduct. The Commission is concerned about the increasing prevalence of cybercrime, including the incidents of abuse and fraud to which the question of the Honourable Member refers. In January 2001, the Commission issued its first comprehensive policy statement on cybercrime, the Communication Creating a safer information society by improving the security of information infrastructures and combating computer-related crime(1).

With respect to the use of the full potential of the new and converging technologies, including how to effectively act against abuse, there is a learning process for users, service providers and law enforcement. In the past few years, the Commission has issued a number of legislative initiatives that seek to protect users and give law enforcement instruments to tackle the new types of crime.

In the context of the types of abuse and fraud mentioned in the question, one of these instruments is Directive 97/7/EC of the Parliament and of the Council of 20 May 1997 on the protection of consumers in respect of distance contracts(2). This Directive imposes information requirements, a right of withdrawal and provisions against the fraudulent use of payment cards and inertia selling and it obliges the Member States to ensure that effective judicial and/or administrative means for redress exist. The deadline for implementation in the Member States was June 2000.

More recently, a Framework Decision on attacks against information systems has been proposed by the Commission(3). This proposal contains provisions that would approximate criminal law provisions for illegal access to or illegal interference with information systems. Provided that the conditions under this instrument are present it could be relevant for the situation that an abusive service provider would install software on a computer without the authorisation of the user. This proposal is currently being discussed in the Council and in the Parliament.

In addition to initiatives in the European Union, in the context of the Council of Europe of Strasbourg, a Convention on Cybercrime has been concluded in November 2001 and is now open for signature and ratification. The Commission participated in the negotiations as an observer. It has so far been signed by 12 Member States and will enter into force when ratified by at least five signatories, including at least three Member States of the Council of Europe. This Convention contains relevant provisions on computer-related fraud.

The Commission will continue to actively follow the developments concerning cybercrime and cybersecurity and will propose additional initiatives when necessary.

(1) COM(2000) 890 final.

(2) OJ L 144, 4.6.1997.

(3) COM(2002) 173 final.