Agreement on cyber-attacks harms freedom of expression

The Justice ministers of the EU countries (by means of the Council of the European Union) have agreed on a decision to harmonize the criminal code in EU countries regarding attacks on information systems.

The ministers agree that “there is evidence of attacks against information systems, in particular as a result of the threat from organised crime, and increasing concern at the potential of terrorist attacks against information systems which form part of the critical infrastructure of the Member States.” The proposal forces EU members states to make ‘illegal access to information systems’ and ‘illegal system interference’ a crime.

The proposal is widely criticized for being unbalanced. Especially regarding illegal system interference (denial of service attacks) it does not distinguish between a terrorist that intends to inflict harm or a non-violent protester that causes a system overload through email protests or virtual sit-ins. The proposal does not refer to freedom of expression or other fundamental rights and can have serious consequences for political protest and campaigning on the internet.

European parliament member Marco Cappato criticized the proposal. “It suits the national justice ministries to criminalize activities on an EU-wide level,” Cappato said. “They seek greater coordination with regard to prosecuting, but there is very little effort made to coordinate legal defence.”

Member states had difficulty to agree on the definition of hacking. Illegal access to information systems is defined as “intentional access without right.” According to that very broad definition, accessing an unprotected and ‘open’ computer can be a crime. Countries with a stricter definition of hacking however, are allowed to only punish wilful infringements of security measures. An earlier proposal would have forced those member states into judicial cooperation, creating great legal uncertainty for internet users. Lawful behaviour in their own country could suddenly have landed them in a foreign jail.

Proposal for a Council Framework Decision on attacks against information systems
http://register.consilium.eu.int/pdf/en/03/st06/st06671en03.pdf

2489th Council meeting justice and home affairs (27.02.2003)
http://ue.eu.int/pressData/en/jha/74719.pdf

EU pact would ‘criminalize’ Net protesters (04.03.2003)
http://www.iht.com/articles/88499.htm