WRITTEN QUESTION E-1011/00

by Cristiana Muscardini (UEN) to the Commission

(31 March 2000)

Subject: Computer hackers and security

In recent weeks the international press has contained reports on the crimes committed by hackers, who have broken into Internet sites in America in order to fraudulently obtain data and confidential codes and to block use of the network. Similar events have also occurred in Europe.

Given the danger that such activities, which represent a genuine threat to the right to privacy and confidentiality, may become more widespread:

- has the Commission made provision for any measures to prevent the activities of these hackers?

- has it taken measures to establish cooperation at international level on the development of projects designed to counteract this criminal interference?

- what proposals will it pt forward to improve the security of European operators and citizens using the Internet

- does it think funds should be made available to so that this matter can be included in research programmes?

Answer given by Mr Liikanen on behalf of the Commission

(22 May 2000)

One of the main challenges of the information society and one of the conditions for the success of e-commerce is to ensure the confidence of users in the information communication networks.

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data(1) and Directive 97/66/EC of the European Parliament and of the Council of 15 December 1997 concerning the processing of personal data and the protection of privacy in the telecommunications sector(2) provide for the implementation of appropriate security measures to protect personal data against accidental or unlawful destruction, alteration or access which has not been authorised by those responsible for processing personal data. It is for the Member States to adopt implementing measures and lay down the sanctions to be imposed in cases of infringement. The Commission, assisted by the working party set up by Article 29 of Directive 95/46/EC, ensures that these provisions are properly applied and among other things carried out a verification of the correct transposition of Directive 97/66/EC as part of the 1999 review of the regulatory framework for communications. The Commission is planning to clarify and update this to take account of technological progress.

The European Council, meeting in Tampere, stated its commitment to reinforcing the fight against transnational crime and implementing the means for crime prevention and cooperation. At international level, the Commission is monitoring the efforts made by the various international and supranational organisations in this fight. In particular, the Council of Europe Committee of Experts on Crime in Cyberspace is preparing a convention on cyber crime; the United States, Canada, South Africa and Japan are involved in this work. Moreover, the Ministers for Justice and Internal Affairs of the group of eight leading industrial nations (G8) have approved an action plan to combat the use of the Internet and other new technologies to carry out criminal activities. In this connection, a network of contact points which are operational 24 hours a day, seven days a week, has been set up.

Moreover, the Commission has undertaken consultations with the Member States, the agencies responsible for implementing legislation, industry and the authorities competent for the protection of personal data in order to determine what measures should be proposed in this area at European level. A Commission communication to Parliament and the Council is planned for July 2000.

As far as speculative or abusive reservation of Internet domain names (cybersquatting) is concerned, the Commission indicated in its communication The organisation and management of the Internet international and European policy issues 1998-2000(3), that it intends to make a proposal for a code of conduct or another appropriate instrument that would restrict the scope of current abuses in this area. In addition, when formulating the registration policy for the proposed top level domain EU, the Commission will ensure that the possibilities for abuses in this domain are minimised.

As regards research, the Information Society technologies programme supports research and development projects on technology and security and privacy infrastructures. In particular, the work programme for 2000 contains a heading under key action II which is intended to encourage technologies reinforcing security, particularly those making it possible to prevent and combat abuses perpetrated through infrastructures, such as fraud and criminal activities, as well as technologies aimed at reinforcing users control over their personal data. These actions reinforce projects underway and the results already obtained from research projects funded under previous programmes such as Esprit, ETS, Infosec, AXTS or Telematics.

(1) OJ L 281, 23.11.1995.

(2) OJ L 24, 30.1.1998.

(3) COM(2000) 202 final.