Proposal for a Council Framework Decision on attacks against information systems
Date: 2002-04-19
Institutions: European Commission
Subjects: EC Decision, computer crime, computer piracy, computer system, data protection

27.8.2002

EN

Official Journal of the European Communities

C 203 E/109

Proposal for a Council Framework Decision on attacks against information systems

(2002/C 203 E/16)

COM(2002) 173 final — 2002/0086(CNS)

(Submitted by the Commission on 19 April 2002)

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on European Union, and in
particular Articles 29, 30(1)(a), 31 and 34(2)(b) thereof,

(4) Significant gaps and differences in Member States' laws in
this area hamper the fight against organised crime and
terrorism, and act as a barrier to effective police and
judicial
cooperation in the area of attacks against
information systems. The trans-national and borderless
character of modern electronic communication networks
means that attacks against information systems are often
international in nature, thus underlining the urgent need
for further action to approximate criminal
laws in this
area.

Having regard to the proposal of the Commission,

Having regard to the opinion of the European Parliament,

Whereas:

and increasing concern at

(1) There is evidence of attacks against information systems,
from organised
in particular as a result of the threat
crime,
the potential of
terrorist attacks against information systems which form
part of the critical
infrastructure of the Member States.
This constitutes a threat to the achievement of a safer
Information Society and an Area of Freedom, Security
and Justice, and therefore requires a response at
the
level of the European Union.

(2) An effective response to those threats requires a compre-
hensive approach to network and information security, as
underlined in the eEurope Action Plan, in the Communi-
cation by the Commission ‘Network and Information
for a European Policy Approach’ (1)
Security: Proposal
and in the Council Resolution of 6 December 2001 on
a common approach and specific actions in the area of
network and information security.

(3) The need to further increase awareness of the problems
related to information security and provide practical
also been stressed in the European
assistance has
Parliament Resolution of 5th September 2001 (2).

(1) COM(2001) 298.
(2) (2001/2098(INI)).

(5) The Action Plan of the Council and the Commission on
how to best implement the provisions of the Treaty of
Amsterdam on an area of freedom, security and justice (3),
the Tampere European Council on 15-16 October 1999,
the Santa Maria da Feira European Council on 19-20 June
the Commission in the Scoreboard (4) and the
2000,
in its Resolution of 19 May
European Parliament
2000 (5)
for legislative action against
high technology crime,
including common definitions,
incriminations and sanctions.

indicate or call

(6) It is necessary to complement the work performed by
in particular the Council of
international organisations,
Europe's work on approximating criminal
law and the
G8's work on transnational cooperation in the area of
high tech crime, by providing a common approach in
the European Union in this area. This call was further
elaborated by the Communication from the Commission
to the Council, the European Parliament, the Economic
and Social Committee and the Committee of the Regions
on ‘Creating a Safer Information Society by Improving the
Security of
Information Infrastructures and Combating
Computer-related Crime’ (6).

(7) Criminal

law in the area of attacks against information
systems should be approximated in order to ensure the
greatest possible police and judicial cooperation in the
area of criminal offences
related to attacks against
information systems, and to contribute to the fight
against organised crime and terrorism.

(3) OJ C 19, 23.1.1999.
(4) COM(2001) 278 final.
(5) A5-0127/2000.
(6) COM(2000) 890.

C 203 E/110

EN

Official Journal of the European Communities

27.8.2002

(8) The

For

crime

should

the purposes of

Framework Decision on the European Arrest
Warrant, the Annex to the Europol Convention and the
Council Decision setting up Eurojust contain references to
computer-related crime which needs to be defined more
such instruments,
precisely.
computer-related
as
understood
including attacks against information systems as defined
in this Framework Decision which provides a much
greater
constituent
approximation of
elements of such offences. This Framework Decision
on
also
combating terrorism which covers
actions
causing extensive destruction of an infrastructure facility,
including an information system,
likely to endanger
human life or result in major economic loss.

Framework Decision

complements

level of

terrorist

the

the

be

(9) All Member States have ratified the Council of Europe
Convention of 28 January 1981 for the protection of
individuals with regard to automatic processing of
personal data. The personal data processed in the
context of
Framework
implementation of
Decision will be protected in accordance with the prin-
ciples of the said Convention.

this

the

(10) Common definitions

of
in this
information systems and computer data, are important
to ensure a consistent approach in Member States in the
application of this Framework Decision.

particularly

area,

(11) There is a need to achieve a common approach to the
constituent elements of criminal offences by providing for
a common offence of illegal access to an information
system, and illegal
interference with an information
system.

21 December 1998 adopted by the Council on the basis
of Article K.3 of
the Treaty on European Union on
making it a criminal offence to participate in a criminal
organisation in the Member States of
the European
Union (1).

(15) Measures should be taken to enable legal persons to be
held liable for the criminal offences referred to by this act
which are committed for their benefit, and to ensure that
jurisdiction over offences
each Member
committed against
in situations
where the offender is physically present on its territory
or where the information system is on its territory.

information systems

State has

(16) Measures should also be foreseen for the purposes of
cooperation between Member States with a view to
against
ensuring
information systems. Operational contact points should
be established for the exchange of information.

effective

against

attacks

action

and dissuasive

effective, proportionate

(17) Since the objectives of ensuring that attacks against
information systems be sanctioned in all Member States
by
criminal
penalties and improving and encouraging judicial coop-
eration by removing potential obstacles, cannot be
sufficiently achieved by the Member States individually,
as rules have to be common and compatible, and can
therefore be better achieved at the level of the Union,
the Union may adopt measures, in accordance with the
principle of subsidiarity as referred to in Article 2 of the
EU Treaty and as set out in Article 5 of the EC Treaty. In
accordance with the principle of proportionality, as set
out in the latter Article, this Framework Decision does
not go beyond what is necessary in order to achieve
those objectives.

(12) There is a need to avoid over-criminalisation, particularly
of trivial or minor conduct, as well as the need to avoid
criminalising right-holders and authorised persons such as
legitimate private or business users, managers, controllers
and operators of networks
legitimate
scientific researchers, and authorised persons testing a
system, whether a person within the company or a
person appointed externally and given permission to test
the security of a system.

and systems,

(18) This Framework Decision is without prejudice to the

powers of the European Community.

(19) This Framework Decision respects the fundamental rights
and observes the principles recognised in particular by the
Charter of Fundamental Rights of the European Union,
and notably Chapters II and VI thereof,

(13) There is a need for Member States to provide penalties for
attacks against information systems which are effective,
proportionate
custodial
dissuasive,
sentences in serious cases;

including

and

(14) It is necessary to provide for more severe penalties when
certain circumstances accompanying an attack against an
to
information system make it an even greater threat
society. In such cases, sanctions on perpetrators should
be sufficient
information
to allow for attacks against
systems to be included within the scope of instruments
already adopted for the purpose of combating organised
the 98/733/JHA Joint Action of
crime

such as

HAS ADOPTED THIS FRAMEWORK DECISION:

Article 1

Scope and objective of the Framework Decision

The objective of this Framework Decision is to improve coop-
eration between judicial and other competent authorities,
including the police and other specialised law enforcement
services of the Member States, through approximating rules
on criminal law in the Member States in the area of attacks
against information systems.

(1) OJ L 351, 29.12.1998, p. 1.

27.8.2002

EN

Official Journal of the European Communities

C 203 E/111

Article 2

Definitions

(i) against any part of an information system which is subject

to specific protection measures; or

For the purposes of this Framework Decision, the following
definitions shall apply:

(ii) with the intent to cause damage to a natural or legal

person; or

(a)

and other

switching or

resources which permit

‘Electronic communications network’ means transmission
routing
applicable,
systems and, where
equipment
the
conveyance of signals by wire, by radio, by optical or by
other electromagnetic means, including satellite networks,
fixed (circuit- and packet-switched, including Internet) and
mobile terrestrial networks, electricity cable systems, to the
extent that they are used for the purpose of transmitting
signals, networks used for radio and television broad-
casting, and cable TV networks,
irrespective of the type
of information conveyed

(b) ‘Computer’ means any device or group of inter-connected
or related devices, one or more of which, pursuant to a
program, performs automatic processing of computer data.

(c)

‘Computer data’ means
facts,
any
information or concepts which has been created or put
into a form suitable for processing in an information
system,
including a program suitable for causing an
information system to perform a function.

representation of

(d) ‘Information System’ means computers and electronic
communication networks,
computer data
stored, processed, retrieved or transmitted by them for
the purposes of their operation, use, protection and main-
tenance.

as well

as

(e)

(f)

‘Legal person’ means any entity having such status under
the applicable law, except for States or other public bodies
in the exercise of State authority and for public inter-
national organisations.

‘Authorised person’ means any natural or legal person who
the lawful
has the right, by contract or by law, or
permission,
conduct
to use, manage,
legitimate scientific research or otherwise operate an
information system and who is acting in accordance with
that right or permission.

control,

test,

(g)

‘Without right’ means that conduct by authorised persons
or other conduct recognised as lawful under domestic law
is excluded.

Article 3

Illegal access to Information Systems

(iii) with the intent to result in an economic benefit.

Article 4

Illegal interference with Information Systems

Member States shall ensure that
conduct, without right, is punishable as a criminal offence:

the following intentional

(a) the serious hindering or interruption of the functioning of
transmitting,
an
damaging, deleting, deteriorating, altering, suppressing or
rendering inaccessible computer data;

system by

information

inputting,

(b) the deletion, deterioration,

suppression or
rendering inaccessible of computer data on an information
system where it is committed with the intention to cause
damage to a natural or legal person.

alteration,

Article 5

Instigation, aiding, abetting and attempt

1. Member States shall ensure that the intentional instigation
of, aiding or abetting an offence referred to in Articles 3 and 4
is punishable.

2. Member States shall ensure that attempt to commit the
offences referred to in Articles 3 and 4 is punishable.

Article 6

Penalties

1. Member States shall ensure that offences referred to in
Articles 3, 4 and 5 are punishable by effective, proportionate
and dissuasive penalties including a custodial sentence with a
maximum term of imprisonment of no less than one year in
serious cases. Serious cases shall be understood as excluding
cases where the conduct resulted in no damage or economic
benefit.

Member States shall ensure that the intentional access, without
right, to the whole or any part of an information system is
punishable as a criminal offence where it is committed:

2. Member States
the possibility of
shall provide for
imposing fines in addition to or as an alternative to custodial
sentences.

C 203 E/112

EN

Official Journal of the European Communities

27.8.2002

Article 7

(c) an authority to exercise control within the legal person.

Aggravating circumstances

1. Member States shall ensure that the offences referred to
in Articles 3, 4 and 5 are punishable by a custodial sentence
with a maximum term of imprisonment of no less than four
years when they are committed under the following circum-
stances:

organisation

(a) the offence has been committed within the framework of a
criminal
Joint Action
as
98/733/JHA of 21 December 1998 on making it a
criminal offence to participate in a criminal organisation
in the Member States of the European Union, apart from
the penalty level referred to therein;

defined

in

(b) the offence caused, or resulted in, substantial direct or
indirect economic loss, physical harm to a natural person
or substantial damage to part of the critical infrastructure
of the Member State;

(c) the offence resulted in substantial proceeds; or

2. Member States shall ensure that the offences referred to
in Articles 3 and 4 are punishable by custodial sentences
than those foreseen under Article 6, when the
greater
offender has been convicted of such an offence by a final
judgement in a Member State.

Apart

from the cases provided for

in paragraph 1,
2.
Member States shall ensure that a legal person can be held
liable where the lack of supervision or control by a person
referred to in paragraph 1 has made possible the commission
of the offences referred to in Articles 3, 4 and 5 for the benefit
of that legal person by a person under its authority.

3.
Liability of a legal person under paragraphs 1 and 2 shall
not exclude criminal proceedings against natural persons who
commit offences or engage in the conduct referred to in
Articles 3, 4 and 5.

Article 10

Sanctions for legal persons

to Article

1. Member States shall ensure that a legal person held liable
effective,
pursuant
is
9(1)
proportionate and dissuasive sanctions, which shall
include
criminal or non-criminal fines and may include other sanctions,
such as:

punishable

by

(a) exclusion from entitlement to public benefits or aid;

(b) temporary or permanent disqualification from the practice

of commercial activities;

Article 8

Particular circumstances

(c) placing under judicial supervision; or

Notwithstanding Articles 6 and 7, Member States shall ensure
the penalties referred to in Articles 6 and 7 can be reduced,
where, in the opinion of the competent judicial authority, the
offender caused only minor damage.

(d) a judicial winding-up order.

Article 9

Liability of legal persons

1. Member States shall ensure that legal persons can be held
liable for conducts
referred to in Articles 3, 4 and 5,
committed for their benefit by any person, acting either indi-
vidually or as part of an organ of the legal person, who has a
leading position within the legal person, based on:

2. Member States shall ensure that a legal person held liable
pursuant
effective,
by
is
9(2)
proportionate and dissuasive sanctions or measures.

to Article

punishable

Article 11

Jurisdiction

(a) a power of representation of the legal person, or

1.
Each Member State shall establish its jurisdiction with
regard to the offences referred to in Articles 3, 4 and 5
where the offence has been committed:

(b) an authority to take decisions on behalf of the legal person,

or

(a)

in whole or in part within its territory; or

27.8.2002

EN

Official Journal of the European Communities

C 203 E/113

(b) by one of its nationals and the act affects individuals or

Article 12

groups of that State; or

(c)

for the benefit of a legal person that has its head office in
the territory of that Member State.

2. When establishing
paragraph (1)(a), each Member State shall ensure that
includes cases where:

jurisdiction in accordance with
it

(a) the offender commits the offence when physically present
on its territory, whether or not the offence is against an
information system on its territory; or

(b) the offence is against an information system on its
the

territory, whether or not
offence when physically present on its territory.

the offender

commits

3.
A Member State may decide not to apply, or to apply
only in specific cases or circumstances, the jurisdiction rule set
out in paragraphs 1(b) and 1(c).

4.
Each Member State shall take the necessary measures also
to establish its jurisdiction over the offences referred to in
Articles 3 to 5 in cases where it refuses to hand over or
extradite a person suspected or convicted of such an offence
to another Member State or to a third country.

and when any of

5. Where an offence falls within the jurisdiction of more
the States
than one Member State
concerned can validly prosecute on the basis of
the same
facts, the Member States concerned shall cooperate in order
to decide which of them will prosecute the offenders with
if possible, of centralising proceedings in a single
the aim,
Member State. To this end,
the Member States may have
recourse to any body or mechanism established within the
European Union in order to facilitate cooperation between
their judicial authorities and the coordination of their action.

6. Member States shall inform the General Secretariat of the
Council and the Commission accordingly where they decide to
apply paragraph 3, where appropriate with an indication of the
specific cases or circumstances in which the decision applies.

Exchange of information

For the purpose of exchange of information relating to
1.
the offences referred to in Articles 3, 4 and 5, and in
accordance with data protection rules, Member States shall
ensure that
they establish operational points of contact
available twenty four hours a day and seven days a week.

2.
Each Member State shall inform the General Secretariat of
the Council and the Commission of its appointed point of
contact
exchanging information on
offences relating to attacks against information systems. The
General Secretariat shall notify that information to the other
Member States.

the purpose of

for

Article 13

Implementation

shall bring into force the measures
1. Member States
necessary to comply with this Framework Decision by
31 December 2003.

2.
They shall communicate to the General Secretariat of the
Council and to the Commission the text of any provisions they
adopt and information on any other measures taken to comply
with this Framework Decision.

On that basis, the Commission shall, by 31 December
3.
2004, submit a report to the European Parliament and to the
Council on the operation of this Framework Decision, accom-
panied where necessary by legislative proposals.

The Council shall assess the extent to which Member

4.
States have complied with this Framework Decision.

Article 14

Entry into force

This Framework Decision shall enter
into force on the
twentieth day following that of its publication in the Official
Journal of the European Communities.