Budapest Convention

The Convention on Cybercrime of the EC (CETS No.185), known as the Budapest Convention, serves as a guideline for developing comprehensive national legislation against cybercrime and as a framework for international cooperation between State Parties to this treaty. It is supplemented by a Protocol on Xenophobia and Racism committed through computer systems.

Overview

The Convention is the first international treaty on Internet and computer-network crimes. It focuses on copyright infringement, computer-related fraud, child pornography, and network security violations. It outlines powers and procedures, such as searching computer networks and making interceptions. The aim of the treaty is to reconcile a free Internet, with the free flow of information and effective criminal justice for criminal misuse. Thus, its restrictions are narrowly defined and electronic evidence for criminal proceedings is subject to human rights and legal safeguards.

The Convention sets out the following procedural powers: expedited preservation of stored data; expedited preservation and partial disclosure of traffic data; production order; search and seizure of computer data; real-time collection of traffic data; and interception of content data.

History

• The treaty was opened in Budapest on November 23, 2001.
• The convention first went into force on July 01, 2004, following its ratification by five members, including 3 EC states.
• By April 28, 2021, 45 EC member states and 21 non-member states had signed and ratified the treaty.
• From 2012 to 2014, the State Parties searched for further solutions on transborder access to data. From 2015 to 2017, a working group focused on Cloud Evidence. They adopted a set of recommendations to enhance the effectiveness of mutual assistance and Guidance Note on Article 18, which explains how domestic production orders for subscriber information can be issued to a domestic provider irrespective of data location and to providers offering a service on the territory of a Party.

The resulting Second Additional Protocol to the Convention on Cybercrime on enhanced cooperation and disclosure of electronic evidence provides for:

1. Direct cooperation with service providers and entities providing domain name registration services in other countries for the disclosure of information to identify suspects of cybercrime;
2. Expedited forms of cooperation between countries for the disclosure of subscriber information and traffic data;
3. Expedited cooperation and disclosure in emergency situations;
4. Additional tools for mutual assistance; and
5. Data protection and other rule of law safeguards.

The Second Additional Protocol also provides for law enforcement in a requesting country to obtain domain name registration information directly from an entity in another country without going through the mutual legal assistance process. In response to a valid request, the entity providing domain name registration services is expected to provide the relevant information in the entity’s possession or control.

Cybercrime Convention Committee

The Cybercrime Convention Committee, aka C-TY, assesses the Convention implementation, the adoption of its guidance notes, and the preparation of legal instruments. It acts as a forum for 74 participant states.

Outcomes

By February 2020, 55% of United Nations members had developed domestic legislation with the help of the C-TY to criminalize computer-related offences aligning with the Budapest Convention.

Capacity Building

The Convention is supported by capacity-building projects managed by the EC Cybercrime Programme Office (C-PROC) to help countries worldwide investigate, prosecute, and adjudicate cybercrime or cases involving electronic evidence.