Cybercrime jurisdiction: past, present and future

Abstract

This article describes activities and policies which have been put into place to date in order to deal with aspects related to cross-border access to computer data and cybercrime jurisdiction. It includes an analysis of the European instruments that address the issue of cybercrime jurisdiction; a perspective on the role of Internet Service Providers in facilitating cooperation to law enforcement for the adjudication of jurisdiction to prosecute cases in national courts. The article addresses some of the current international discussions and possible future scenarios and ends with a personal view and assessment of alternative approaches for asserting jurisdiction for the prosecution of internet-related crime.

1 Introduction

When the widespread use of computers and internet began in the mid-nineties, one of the major constraints among government, industry and academic circles was the difficulty of applying laws and regulatory frameworks to illegal activity committed through cyberspace which had real effects and repercussions on individuals who were physically located in the same or different countries.¹

The jurisdictional aspects of the internet have evolved more rapidly in countries with common law systems, where the national courts have relied on the doctrine of stare decisis and legal precedent and the application of traditional tests and standards for exercising and asserting personal jurisdiction based on the doctrine of minimum contacts and real and substantial connection with the forum²; on the effects or harm test doctrine³ or simply based on how passively ⁴ or actively ⁵ a website perform when targeting specific individuals in a certain state or territory.

Internet jurisdiction is at the intersection of different areas of law including criminal law and some courts around the world have issued landmark rulings involving the use of internet in which they have tried to resolve conflicts of jurisdiction when the offender was located in its territory or based in the location where the act was perpetrated or in the location of the computer system or of the servers or when one of its nationals has committed the offence when residing in another country or simply where the damage or effect was produced.⁶ For instance, in the United Sates, the case US v. Aleksey Vladimirovic Ivanov,⁷ Yahoo Inc. v, LICRA,⁸ in Australia, Gutnick vs. Down Jones & Co. Inc ⁹; in Philippines the I Love You prosecution¹⁰; and in Germany the Frederick Töben conviction¹¹ are just a few examples of cases with a transnational dimension which involved criminal conduct and cross-border internet jurisdiction.

Despite multiple efforts among law enforcement authorities in different countries, jurisdictional issues and the enforcement of laws against cybercrime continue to present the greatest of challenges particularly when the countries involved have no substantive or procedural laws against cybercrime, insufficient technical expertise in the investigation or lack the required infrastructure and financial capacity to conduct and follow-up an investigation of such complexity with the country or countries involved.

Another major problem is that law enforcement authorities and the judiciary in some countries do not have the required knowledge of the subject or receive continuous training in the field of preservation and use of digital evidence, technologies and forensic tools in order to track down criminal conduct, situations which make it even more difficult to launch an investigation and prosecute offenders on a coordinated basis.

Another major problem is that some countries may have priorities regarding the types of cybercrime they can investigate and prosecute, so that, for instance, many countries would probably decide to prosecute serious crimes or attacks seeking to damage critical national infrastructure, attacks against national security and child pornography, while some other countries might not necessarily have priorities to investigate crimes directed against the general population like financial and credit card fraud committed through phishing or identity theft techniques, extortion or attack against personal computers and devices.

The purpose of this article is first, to offer an overview of the issues involved in the past, particularly by European institutions to address cross-border jurisdictional concerns regarding cybercrime. Secondly, it is intended to examine and assess whether the current European legal instruments for investigating and prosecuting computer- and internet-related crime continue to be effective considering the evolution and sophistication of cybercrime, the volatility of electronic evidence and the current storage and preservation media, taking into account other factors that play an important role for a court in deciding whether to assert jurisdiction, such as the cooperation of internet and access service providers with investigative authorities. Thirdly, it is intended to offer a perspective on the future discussions and topics surrounding cybercrime jurisdiction. I end this article by offering a personal perspective regarding possible alternatives for approaching cybercrime jurisdictional issues on a more proactive basis.

2 The past

The fast development of information technologies and the growth of the use of computer, networks and the internet particularly in European countries during the decade of the nineties, led the European Committee on Crime Problems to set up a committee of experts in November 1996 specifically to deal with cybercrime. This Committee was subsequently named the Committee of Experts on Crime in Cyber-space (PC-CY) by a decision of the Committee of Ministers. The PC-CY was the original group that undertook the negotiations to draft the Council of Europe Convention against Cybercrime (hereinafter “Budapest Convention”) until its adoption and opening for signature in June 2001.¹²

Among the main tasks and issues analysed by the PC-CY were the question of jurisdictional approaches to offences committed through computer systems and information technologies, studying and considering aspects of conflicts of laws (both positive and negative), and international principles on jurisdiction during the drafting of the Budapest Convention.¹³

Even before the adoption of the Budapest Convention, a large number of European countries have incorporated international principles on jurisdiction in their constitutions and some others even have procedural legislation on criminal matters offering guidance on how to approach the issue of jurisdiction when two or more countries are involved.¹⁴ In practice, the approaches on asserting jurisdiction differ significantly between countries since it is up to the judiciary and national courts to decide on the precise circumstances of each case presented for a corresponding prosecution (on the basis of territory, nationality or damage to the victims); whether the court should or not prosecute the offender in its territory or to negotiate and consult with other countries the adjudication of jurisdiction and possible scenarios on extradition.

2.1 Cross-border access to computer data

Another task that was the subject of lengthy discussions by the PC-CY was whether a country should be allowed unilaterally to access computer data in another country without the consent and mutual legal assistance of another country. The drafters of the Budapest Convention determined that it was not possible to prepare a comprehensive, legally binding regime regulating cross-border access to data mainly due to the lack of concrete examples and experience with such situations at that time, and the group agreed not to regulate other situations until further experience and practice had been gathered and obtained by a number of countries.¹⁵

It should be noted that during the period of work of the former European Committee on Crime Problems and the work of the PC-CY, a number of international convention were simultaneously being drafted by the United Nations, such as for instance the Convention against Transnational Organised Crime which contains specific provisions on jurisdiction,¹⁶ which together with international general principles on jurisdiction served as the basis for drafting the scope of Article 22 of the Budapest Convention.¹⁷

However, with regard to issues of cross-border access to computer data dealt with in Article 32 of the Budapest Convention,¹⁸ there was no international legal source of reference and practice. This was the main reason for the PC-CY’s decision not to formulate general rules and regulate situations other than where unilateral access to data was permissible.

In the course of 1999, the former G-8 High-Tech Subgroup of Senior Experts on Transnational Organised Crime discussed the question of unilateral access by law enforcement authorities in one state to data stored in a computer system in a foreign state without the need for mutual legal assistance, and this subgroup approved a document containing principles and guidelines to accessing data in a foreign state during a Ministerial Conference on Combating Transnational Organised Crime in Moscow in November 1999.¹⁹

The first section of the G-8 principles, which deals with preservation of data stored in computer systems, allows LEAs to secure the preservation of data stored in computer systems and ensures that such preservation is possible through the cooperation of internet service providers and through state requests for the preservation of data contained in the computer systems of another state on an expedited basis and pursuant to national law. The second section of the G-8 principles deals with expedited mutual legal assistance to preserve data through traditional legal procedures, judicial and legal authorisations and through other methods of assistance provided by the law of the requested state. This principle includes the rule that each state should respond to the request on an expedited basis and using communications such as voice, fax or e mail. The third section specifically deals with cross-border access to stored data not requiring legal assistance, which stipulates that a state may not need authorisation from another state when accessing publicly available data regardless of its geographical location; or when accessing, searching, copying or seizing data stored in a computer systems located in other state when the voluntary consent of a person who has lawful authority to disclose the data has been given. The last section provides for the consideration of the searching state to notify the searched state when data reveals a violation of criminal law or when it appears to be in the interest of the state in which the search is carried out.²⁰

3 The present

Currently, there are a number of international and regional instruments that address the question of jurisdiction in respect of crimes committed through the use of computers and internet. Most of these instruments are Council of Europe conventions, council framework decisions and directives containing specific provisions and guidelines on dealing and approaching jurisdictional issues when more than two countries are involved in criminal investigations.

Among some of the instruments of the Council of Europe providing guidance on the question on jurisdiction on crimes committed through the use of computers and internet are: (i) the Budapest Convention;²¹ (ii) the Council of Europe Convention on the Protection of Children against Sexual Exploitation and Sexual Abuse (better known as the Lanzarote Convention);²² the Council of Europe Convention on Action against Trafficking in Human Beings;²³ and the Council of Europe Convention on the Prevention of Terrorism.²⁴ These instruments contain inter alia provisions on jurisdiction allowing national courts of Member States to assert jurisdiction over criminal offences committed: (i) on that Member State’s territory; (ii) on board ships and aircrafts registered under the laws of a state; (iii) by one of a state’s nationals when the offence is committed outside the territorial jurisdiction of any state; as well as (iv) provisions to prosecute in the case of denial of extradition and (v) consultations mechanisms to determine and coordinate actions for prosecution and the avoidance of parallel proceedings.

In addition to the Council of Europe instruments, there are three Council Framework Decisions, the purpose of which is to unify national legal frameworks and strengthen judicial cooperative measures across the European Union. These also contain provisions on the adjudication of jurisdiction. Said Council Framework Decisions are the following:

• I. Council Framework Decision 2009/948/JHA of 30 November 2009 on prevention and settlement of conflicts of exercise of jurisdiction in criminal proceedings; ²⁵

• II. Council Framework Decision 2008/913/JAA of 28 November 2008 on combating certain forms of racism and xenophobia by means of criminal law;²⁶ and

• III. Council Framework Decision 2002/475/JAI of 13 June 2002 on combating terrorism.²⁷

One relevant aspect of Council Framework Decision 2002/475/JAI of 13 June 2002 on combating terrorism is that it seeks to centralise criminal proceedings in a single state, an objective which is highly important in order to avoid multiple investigations and positive jurisdictional conflicts among Member States.

In addition to the Council Framework Decisions, there are two European Union Directives that have recently replaced the Council Framework Decision on attacks against information systems as well as the Council Framework Decision on combating sexual abuse and child pornography. These instruments are:

I. Directive 2013/40/EU of 12 August 2013 on attacks against information systems and replacing Council Framework Decision 2005/222/JHA. This instrument contains a provision²⁸ on the assertion of jurisdiction in relation to offences concerning illegal access to information systems, system interference, data interference, illegal interception, tools used for committing offences, incitement, aiding and abetting and attempt when: (i) the offence is committed in whole or in part of their territory; (ii) by one of their nationals. Section 2 provides that when a state decides to assert jurisdiction based on territory, that state shall ensure that (a) the offender committed the offence physically present on its territory whether or not the offence is against an information system on its territory; or (b) the offence is against an information system on its territory whether or not the offender commits the offence while physically present in its territory. Section 3 of Article 12 sets out the obligation on a Member State to inform the Commission when it decides to establish jurisdiction over an offence committed outside its territory including the fact that (a) the offender has his habitual residence in its territory; (b) the offence is committed for the benefit of a legal person establish in its territory.

II. Directive 2011/92/of 13 December 2011 on combating the sexual abuse and sexual exploitation of children and child pornography, and replacing Council Framework Decision 2004/68/JHA. This instrument contains a provision²⁹ on the assertion by a Member State of jurisdiction and on the coordination of prosecution in relation to offences concerning sexual abuse, sexual exploitation, child pornography, solicitation of children for sexual purposes, incitement, aiding and abetting and attempt when: (i) the offence is committed in that Member State’s territory; and (ii) the offender is one of its nationals. A Member State is obliged to inform the Commission when it decides to establish jurisdiction over an offence committed outside of its territory where: (a) the offence is committed against one of its nationals or against a person who is an habitual resident in its territory; (b) the offence is committed for the benefit of a legal person established in its territory; or (c) the offender is an habitual resident in its territory. Section 3 of Article 17 allows a Member State to assert jurisdiction when the offence is committed by means of information and communication technology accessed from its territory whether or not the offence occurred on its territory.

Section 4 provides that for the prosecution of offences committed outside the territory of a Member State and when the offender is one of its nationals, each Member State shall take the necessary measures so that its jurisdiction is not subordinated and conditioned to criminal offence acts committed at the place where they were executed. Likewise, Section 5 provides that for the prosecution of offences committed outside the territory of a Member State and when the offender is one of its nationals, each Member State shall take necessary measures so that its jurisdiction is not subordinated and conditioned so that the prosecution can only be initiated following a report made by the victim or a denunciation from the state of the place where the offence was committed.

One common feature of these Directives is that they establish specific rules for the assertion of jurisdiction for extraterritorial crimes committed outside European Union Member States when the offender is one of the relevant Member State’s nationals. However, Directive 2011/92/ of 13 December 2011 goes a step further and expressly includes, as a requirement for the subordination of jurisdiction and the prosecution of offenders, a denunciation report made by the victim or a denunciation from the Sate of the place where the offence was committed, situations that are a necessary preconditions for the prosecution of offenders across the European Union.

The legal framework in Europe concerning the assertion of jurisdiction in respect of crimes committed against computer systems and attacks using the internet is perhaps one of the most comprehensive. Although it seeks to unify the national approaches on the assertion of jurisdiction for the prosecution of cybercrime in this region of the world, the reality is that there is not yet complete uniformity among the approaches adopted by each of the European Union Member States. National courts of European Union Member States continue to apply discretionary powers under national procedural criminal laws in order to prosecute crimes according to their own methodologies and legal traditions for cases dealing with internet crime or crimes committed using the support of information technologies.

3.1 Cooperation of communication and internet service providers with law enforcement

Another important factor for the assertion of jurisdiction over criminal proceedings is the preliminary identification and location of the offender or perpetrator of a crime through the cooperation of internet and access service providers with law enforcement authorities with or without mutual legal assistance instruments.³⁰ The information and evidence facilitated by internet service providers plays a crucial role in the subsequent determination of a national court to assert jurisdiction and prosecute cybercriminals.

It should be borne in mind that a large part of the evidence needed in criminal proceedings is hosted and preserved in different servers located or hosted in the cloud by Internet companies like Yahoo, Google, Microsoft and Skype and social network companies like Facebook and Twitter, which have established their own methodologies, criteria and cooperation procedures in order to disclose information and data to law enforcement authorities for the identification of possible suspects.³¹

Unfortunately, there are only very few public documented cases where internet and access service providers have facilitated cooperation with law enforcement authorities for the purposes of the subsequent assertion of jurisdiction in cases brought to the attention of national courts and for the purposes of dealing with investigations related to cybercrime.³² One example of a European country seeking clarification on the cooperation approach taken by internet service providers with law enforcement authorities for the identification of suspects and legal assistance on criminal investigations dealing with the use of internet is Belgium.

3.1.1 Belgium v. Yahoo, Inc.

In November 2007, the Public Prosecutor of Dendermonde in Belgium brought a direct order—without mutual legal assistance—against Yahoo, Inc. in accordance with Art. 46bis of the Code of Criminal Procedure³³ in order to obtain information linked to seven Yahoo e-mail accounts which had been used to commit and execute computer fraud and internet forgery affecting residents established in Belgium as described in Articles 496, 504 quater and 210 bis of the Criminal Code of Belgium.

The Public Prosecutor argued in his claim that the e-mail accounts in question were used within the Belgian national territory and that although Yahoo is a company legally established in the state of California, Yahoo should also be considered to have a presence within the Belgian national territory, both as a commercial company and as an electronic communication service operator through the internet. Among the data that the Public Prosecutor was requesting from Yahoo were (i) the full identification/registration data of the person who created and registered the account, including the IP address, date and time (+time zone) of the registration, (ii) the email address that was linked to the profile, and (iii) any other personal data or information that might lead to identification of the account users.

Yahoo refused to collaborate and facilitate the information linked to the e-mail accounts in question with the Belgian Public Prosecutor based on the provisions contained in the Electronic Communications Privacy Act (ECPA),³⁴ which among other conditions, set forth that the request should be made through the United States Department of Justice and arguing that the company was neither an operator of an electronic communications network nor a provider of an electronic communications service established in Belgium for the purposes of the interpretation and scope of Article 46 bis of the Code of Criminal Procedure.

The Belgian Public Prosecutor further argued in his initial claim that Yahoo should have been obliged to cooperate with criminal authorities in Belgium and that regulations like ECPA should not undermine the sovereign authority of the Belgian criminal codes and criminal proceedings. The Public Prosecutor resolved to impose a pecuniary fine amounting to 55,000 euros and a penalty payment of 10,000 euros for each day of delay in communicating the requested data to the Public Prosecutor.

In the final judgment of the Court of Appeals of Antwerp of November 20, 2013, the justices confirmed the opinion of the Court of First Instance of Dendermonde and found: (i) that Yahoo had a territorial presence in Belgium, (ii) that Yahoo is and should be considered a provider of electronic communications services within the meaning of Article 46 bis of the Code of Criminal Procedure, and therefore, (iii) that Yahoo should collaborate with investigative authorities in the facilitation of the information requested and (iv) levied a penalty of 44,000 euros against the company.³⁵

3.1.2 Microsoft Corporation v. Unites States of America

On December 4, 2013, a Magistrate of the Southern District Court of New York issued a search and seizure warrant to Microsoft Corporation requesting to produce and disclose content information (the message and subject line) and non-content information (sender address, recipient address and date and time of transmission) of an e-mail account belonging to a customer of Microsoft associated with its datacenter located in Dublin, Ireland under the Stored Communications Act (SCA) a legislation passed as part of the Electronic Communications Privacy Act of 1986 (ECPA)³⁶ and codified under Title 18 U.S.C. §§ 2701–2712. Microsoft produced the non-content data stored in the United States, but objected to disclose the content information of the email account supposedly stored in its datacenter located in Ireland.

The warrant was issued under Title 18 U.S.C. §2703(a), which requires the government to use the warrant procedures described in Rule 41 of the United States Federal Rules of Criminal Procedure.

Microsoft moved to quash the warrant for the content of data stored in Ireland on December 18, 2013. Among Microsoft’s main arguments are:

• (i) that the warrant issued by the Magistrate Judge would require an extraterritorial search and seizure of data stored in its datacenter located in Ireland.

• (ii) that a search of digital data occurs where the data is stored and not at the point from which the data is remotely accessed.

Microsoft also argued that since there is no authorisation for extraterritorial application in Rule 41 of the United States Federal Rules of Criminal Procedure, the United States government cannot execute a search and seizure in Ireland, and cannot achieve this end indirectly by forcing Microsoft Corporation to produce the data stored in its datacenter in Ireland since Federal courts do not have the legal authority to issue warrants for the search and seizure of property outside the territorial limits of the United States.³⁷

Further, Microsoft argues that the Magistrate Judge conclusion contravene the Fourth Amendment of the United States Constitution³⁸ and that his judgment could possibly lead to violation of international law and treaties, the territorial integrity of sovereign nations and circumvent the commitments made by the United States under current Mutual Legal Assistance Agreements designed to facilitate cross-border criminal investigations.³⁹

The Magistrate Judge rejected Microsoft’s motion to vacate the search and seizure order. Among the Magistrate Judge’s main arguments are:

• (i) that Microsoft analysis is ambiguous and inconsistent with the statutory language and the general structure of the SCA and its legislative history.

• (ii) that warrants issued under the SCA are “hybrids”, part warrant and part subpoena, and therefore, said legislation does not implicate or involve principles of extraterritoriality.

• (iii) a search warrant does not occur until the data is reviewed by law enforcement in the United States, so based on this presumption there are no extraterritoriality issues involved in the matter.⁴⁰

This case gained a high level of political attention in the United States and Europe and it was followed by a large number of amicus briefs (friends of the court briefs) mostly supporting Microsoft’s views and perspectives. The amicus briefs were filed by well known technology companies, internet service providers, public interest organizations, the Irish government, a member of the European Parliament, computer scientist and experts on international law.⁴¹

Microsoft appealed the judgment of the Magistrate Judge of the United States District Court for the Southern District of New York on December 18, 2014 and the matter is yet pending to be decided in the United States Court of Appeals for the Second Circuit.⁴²

The Microsoft case raises relevant issues of extraterritoriality, jurisdiction, cross-border access to data and conflicts of data protection laws between the United States and Europe. And in particular, the main question that it seeks to clarify is whether law enforcement authorities in the United States have the required statutory powers in order to compel communication and internet service providers to disclose content and personal information of digital communications stored in servers and data centers located abroad.⁴³

3.2 Cross-border access to data

Paradoxically, since the NSA revelations by Edward Snowden,⁴⁴ there is more general scrutiny on how law enforcement authorities access and monitor internet, but on the other hand, there is also strong pressing needs from LEAs to gain further access and preserve computer data for purpose of investigations related to cybercrime.⁴⁵

A number of countries, mostly signatories of the Budapest Convention, are currently evaluating whether a unilateral search of data located in a computer system or server located in another territory for purposes of a criminal investigation and to secure evidence should be permitted without the consent of the country of which data is being accessed and without the need of a search warrant.⁴⁶

There are different opinions and views on whether cross-border searches of data in computer systems located in foreign countries should be permissible.⁴⁷ Notwithstanding the discussion on the legality and permissibility of cross-border searches and access to data, some countries around the world have recently enacted laws and reform criminal procedural frameworks in order to allow LEAs access to data for the purposes of criminal investigations but with the limitation that the service provider be located in its territory.⁴⁸

Current practice shows that there are different approaches in some countries regarding how law enforcement access data unilaterally and without a formal mutual legal assistance request in order to obtain evidence located in computer or mobile systems in foreign countries.⁴⁹ In our view, such scenarios will possibly not change in the coming years unless further legal guidance and limits on such proceedings get the necessary general acceptance of countries worldwide.

One of the lessons learned from the Yahoo case in Belgium is that public prosecutors and judicial authorities currently face the challenge in obtaining data and information directly from a foreign service provider without the need to go through formal mutual legal assistance channels, a situation that could possibly hinder or delay the investigation of cybercrime and prosecution of cybercriminals in national courts.

Another lesson learned from the Microsoft vs. United States case is that search warrants or orders to compel internet service providers to disclose content information of customers can have meaningful ramifications and implication for Internet based companies and could potentially lead to conflicts of laws in the field of data protection.

4 The future

Predicting the future of cybercrime jurisdiction is not an easy task, but the success of criminal investigations will largely depend not only on ensuring the correct enforcement of existing jurisdictional principles and laws against cybercriminals, but particularly on the degree of technical formation and training of the judiciary, the facilitation of assistance of internet service providers with law enforcement authorities, the coordination of investigations both nationally and internationally and the aptitude and disposition of national courts to prosecute perpetrators regardless of their geographical location. These are, in our view, minimum requirements which countries should meet and have in place in order to be able to prosecute cybercriminals.

Discussions on cybercrime jurisdiction, currently show that there are major constrains with respect to the application of the principle of territoriality in virtual cyberspace due to the constant and dynamic movement of data across different servers located in multiple jurisdictions, a situation that has led international organisations to call for a ‘paradigm shift’ in order to allow the application of other jurisdictional principles so as to investigate and prosecute criminal conduct committed in cyberspace.⁵⁰ In this writer’s view, this so-called change of paradigm requires judicial authorities to explore new ideas, paths, and mechanisms to enforce substantial and procedural criminal legislation and to make the existent mutual assistance legal mechanisms to work on a more dynamic and flexible basis. The same discussion will continue to be raised in international fora, but its success will largely depend on a shift in the administration of the criminal justice system at national level.

While cloud services to storage data continue to grow and given that a great deal of information and digital evidence is stored in servers somewhere in the cloud, it is very likely that a number of scenarios will continue to be revisited in order to find balanced approaches for the application of existing international legal principles for asserting jurisdiction over cybercrime investigations.

One of these scenarios is the actual “loss of location” ⁵¹—whether in order to determine the exact location of data, the location of the storage media or even the country of residence of the cloud service provider—as a relevant factor to be considered for the purposes of obtaining evidence for criminal investigations.⁵²

Another scenario or proposed alternative for determining the jurisdiction to enforce a search or seizure of electronic evidence is “the power of disposal,⁵³ in order for law enforcement investigators to have access to data once the data is not longer used and needed by the data subject, an approach which in our view, however, will likely conflict with safeguards and data protection laws and regulations in the European Union⁵⁴ and other jurisdictions around the world.

Cybercrime is evolving and changing rapidly and the technical layers of the net are less noticeable in search engines since a great deal of illegal activity is moving to the so-called deep web,⁵⁵ which has seen considerable growth in recent years. There is therefore an urgent need for more proactive law enforcement authorities and judges, magistrates and prosecutors who can think outside the box and find practical and innovative solutions to investigate and prosecute criminal activities affecting companies, institutions and individuals as a result of conduct committed in cyberspace, and to facilitate international cooperation on a more dynamic basis within the limits of international law.

5 Conclusion

Illegal activities conducted through internet involve real individuals located in one or different countries and cause real damage to people, infrastructures and the economy as whole. Therefore states through their respective judicial legal systems shall procure to find links and connections to prosecute cybercriminals within their national legal frameworks. These may include the assertion of jurisdiction based: (i) on the location of the activity or where the conduct was committed (territoriality); or (ii) on the nationality of the perpetrator (active nationality principle); or (iii) where the effects and damage to the victims took place (passive nationality principle); or (iv) where the computer systems, storage servers or data centers may be located.

In our view, the principle of territoriality shall not continue to prevail in jurisdictional claims; the application of other principles should also be extended to assert jurisdictional claims.

Coordination of investigations and mechanisms for the centralisation of proceedings on criminal jurisdiction, as described and contained in some of the Council of Europe instruments and Council framework decisions, will play a key role in avoiding possible conflicts of jurisdictions and parallel proceedings in the prosecution of cybercriminals. Countries should prioritise their use.

The permissibility of cross-border access to data for criminal investigations will continue to raise concerns among states, and current practice shows not only a diversity of procedures conducted by law enforcement in each country to get access to evidence located in foreign servers but in particular a lack of uniformity among European Union Members regarding accessing computer data in other countries despite the applicable provisions of the Budapest Convention. This writer strongly believes that cross-border searches for the purposes of accessing data should be allowed as long as law enforcement authorities have established sufficient security safeguards in criminal investigations in order to protect the information and data of third parties, and as long as it has been proved that there are sufficient links to prosecute criminal conduct affecting national state infrastructures or victims of the state seeking to have access to such computer data.

Last, mutual legal assistance mechanisms and channels play an important role for the adjudication of criminal jurisdiction by national criminal courts and shall continue to serve as a cooperation vehicle between law enforcement and the private sector for requesting evidence for cross-border criminal investigations. However, we believe that internet companies making use of said mutual legal assistance channels should make them work on a more flexible basis in order to expedite legal proceedings for the purpose of securing and preserving evidence that will lead to the possible identification of perpetrators, and for the purpose of adjudication on jurisdiction by national courts.