Upload
others
View
9
Download
0
Embed Size (px)
Citation preview
UNODC International Cooperation and
Assistance in Cybercrime Matters
To integrate cybercrime and electronic evidence related issues in broader UNODC mandates of • Supporting Member States with ratification and
implementation of international treaties • Research and analytical work to increase knowledge
and understanding of crime-related issues • Promoting international cooperation • Enhancing Member States’ capacities to counteract
illicit drugs, crime and terrorism
UNODC Approach
Intergovernmental Expert Group - Study
• Mandate: General Assembly Resolution 65/230 • Responses from 69 Member States (13 from the Americas) • Private Sector, Academia, Intergovernmental Organizations • Open source documents
Commission on Crime Prevention and Criminal Justice (CCPCJ) Resolution 22/8 (2013) • Requests UNODC to serve as a central data
repository of cybercrime laws and ‘lessons learned’
• With a view to facilitating the continued assessment of needs and criminal justice capabilities and delivery and coordination of TA
• Will be integrated into SHERLOC knowledge management portal
Global Cybercrime Repository
0%
2%
4%
6%
8%
10%
12%
14%
16%
Email account
hacked
Responded to
phishing
attempt
Identity theft Online credit
card fraud
Burglary Robbery Car theft
% r
esp
on
de
nts
re
po
rtin
g vi
ctim
izat
ion
in
las
t ye
ar,
20
11
or
late
st a
vaila
ble
ye
ar
Figure 2.4: Cybercrime and conventional crime victimization
HDI < 0.8 (8 countries)
HDI > 0.8 (13 countries)
Source: UNODC elaboration of Norton Cybercrime Report and crime victimization surveys.
Cybercrime Victimization
Transnational Dimension of Cybercrime
0
10
20
30
40
50
60
70
80
90
Europe (8) Asia &Oceania (7)
Africa (6) Americas (7)
%
Figure 7.1: Percentage of cybercrime acts involving a transnational dimension
Source: Study cybercrime questionnaire. Q83. (n=28)
Electronic Evidence
Company records:
• Corporate structures • Contracts • Directors
Bank accounts:
• Account statements • Details of beneficial owners • Wire transfer payments
Communications data:
• Emails confirming ownership of IP addresses
• Emails evidence fraud scheme
Servers:
• Contracts • Wire transfer
payments
Victims:
• Analysis of malware
• Which countries have jurisdiction to prosecute?
• What is the basis of jurisdiction?
• Where could prosecution best take place?
• Can nationals be extradited? If not, what happens?
• Is there dual criminality?
• How can investigations best be coordinated?
• How can evidence be obtained?
• What evidence is needed?
• Do sufficient investigative powers exist in criminal procedure law?
• How can the criminal assets be identified and seized?
• How should victims (infected computers) be informed/treated?
International Cooperation Challenges
Means of Obtaining Extra-Territorial Evidence
73%
9%
8%
6%4%
Figure 7.4: Means of obtaining extra-territorial evidence
Formal MLA request
Informal police cooperation
Direct contact with service provider
24/7 network point of contact
Other
Source: Study cybercrime questionnaire. Q105. (n=56, r=221)
Legal Basis of MLA and Extradition Requests
19%
5%
57%
18%
1%
Figure 7.5: Legal basis of cybercrime extradition and MLA requests
Multilateral instrument
Regional instrument
Bilateral instrument
Reciprocity
Other
Source: Study cybercrime questionnaire. Q202-207 and Q227-232. (n=21, r=50)
Key Components of Cooperation
Central authority
Accurate preparation of requests
Starting point: intelligence
Intelligence requests
Informal pre-submission
contact
Legal basis and procedural
laws
The Big Picture – Modes of Cooperation
Set priorities
Collect
Evaluate
Collate Analyse
Infer
Use
Formal Investigation and Evidence
Collection
Mutual Legal Assistance Police Cooperation
Intelligence Cycle
Informal Police Cooperation
0% 20% 40% 60% 80% 100%
Africa (n=6)
Americas(n=8)
Asia & Oceania(n=17)
Europe(n=14)
Figure 7.11: Can assistance be provided informally, as well as
through a formal MLA request?
Yes
No
Source: Study cybercrime questionnaire. Q223. (n=45)
Forms of Informal Cooperation
3%
3%
3%
3%
10%
23%
35%
35%
39%
42%
Stored traffic data from a service provider
Seizure of computer hardware or data
Search for computer hardware or data
Provisional arrest of a suspect
Other (unspecified)
Expedited preservation of computer data
Conduct of a joint investigation
Identity or subscriber information for a suspect
General legal advice
General technical advice
Form
s o
f in
form
al c
oo
pe
rati
on
Figure 7.13: Forms of informal cooperation with law enforcement agencies
Source: Study cybercrime questionnnaire. Q106. (n=31, r=61)
Average Response Time Informal Cooperation
23%
19%
13%
32%
13%
0%
5%
10%
15%
20%
25%
30%
35%
1-2 2-5 5-10 10-30 >30
% o
f re
qu
est
s
Number of days
Figure 7.16: Average time for response to requests sent and received by focal point for cooperation in cybercrime cases
Source: Study cybercrime questionnaire. Q107. (n=25, r=47)
Red de Fiscales contra el Crimen Organizado – REFCO Belize, Costa Rica, Colombia, the Dominican Republic, El Salvador, Guatemala, Honduras, Mexico, Nicaragua and Panama (+ Bolivia, Peru) (Meeting in Costa Rica, December 2013) • MLA requests take btw. 0.5 and 7 working days • Legal processing (i.e. signatures) may take up to 22+ days • Translation and Authentication may take up more than a week
• Drug-related crime, especially money laundering • Challenge: no standard terminology • Need to strengthen research • Stronger involvement of judges necessary • Standard operating procedures for obtaining/handling digital evidence
Network of Prosecutors against Organized Crime
International Cooperation
• Defines traffic data, service provider, computer data, computer system, and subscriber information
• Covers requests for:
• expedited preservation and disclosure of computer data;
• Production of stored data;
• Search and seizure of data.
UN Model Law on Mutual Assistance in Criminal Matters (2007)
UN Convention against Transnational Organized Crime • Art. 15 – Jurisdiction • Art. 16 – Extradition • Art. 18 – MLA
International Drug Control Treaties i.e. UN Convention against Illicit Traffic in Narcotic Drugs and Psychotropic Substances, 1988
• Art. 3 – Offences and Sanctions (including technology-facilitated conduct)
• Art. 7 – MLA
International Cooperation
UNODC Mutual Legal Assistance Writer Request Tool (MLA Tool)
• Available upon request • Does not require prior experience • Helps to avoid incomplete requests • Information on treaties and nat. legislation
Upgrade and re-design • Increase usability • Include module on digital evidence • Create an application that does not require MS
Access • Link to CNA directory
UNODC MLA Tool
Objective: to assist and support Member States with preventing and combating cybercrime through a global, sustainable and holistic approach
UNODC Global Programme on Cybercrime
• Upon request • Pre-assessment process:
• Desk assessment • Pre-assessment mission
• Needs based • Local ownership • Sustainability – tied in with LE and
prosecution structures
UNODC Approach
• East Africa 2013
• In-depth country response capabilities assessment – Kenya • Regional joint training of Investigators and Prosecutors from 7
countries (Mobile & desktop forensics; Private sector participation; Specific prosecutorial training; Distance learning materials)
2014 • Regional conference for the East African region • Follow up in-country activities in Kenya
• Southeast Asia • Assessment of cybercrime response capabilities across the
region • Regional training workshops for LE, prosecutors, judges • Training modules for police academy in Viet Nam
Activities 2013/2014
Americas Establishment of National Police cybercrime unit in El Salvador
• Training on digital forensics and cybercrime investigation • Training of prosecutors on basic case strategy and handling of
digital evidence • Specialized training on crimes against children • Digital forensics lab • Cooperation with service providers • Support coordination with INTERPOL support networks • Advanced training • Development of curriculum for National Police academy
Further requests from the region, similar approach
Activities 2013/2014
UNODC - Contact
United Nations Office on Drugs and Crime (UNODC)
Division for Treaty Affairs, Organized Crime and Illicit
Trafficking Branch, Conference Support Section
Thank you!