Cyber Security: International regulations,Eneken Tikk / EST,Importance of Legal Framework,Law takes the principle of territoriality as point of departure; Cyber security tools and targets are physical-boundary-independent; Agreements between nations create a general common basis for cyber security measures,Cyber Security Legal Framework,International Agreements EU Legal Framework Bilateral Agreements National law Internal regulations,Development of International Law,Cyber Security is a rather new area for law*.Over the years, the international co-operation on cybercrime has been very active and comprehensive.The international level of consensus on criminal law has, however, not been achieved.,International Activities / UN,General Assembly Resolutions on: Developments in the Field of Information and Telecommunications in the Context of International Security Combating the Criminal Misuse of Information Technology Creation of a Global Culture of Cybersecurity Creation of a Global Culture of Cybersecurity and the Protection of Critical Information Infrastructures.,Other International Activities,ITU - Global Cybersecurity Agenda (GCA)INTERPOL - Coordinating law-enforcement agencies and legislationsNATO - Cyber Defense Policy and ConceptG8 High Tech Group Recommendations and Best PracticesOECD, several regional organizations,Council of Europe,Convention on Cybercrime (C3)opened for signature 2001 entry into force 2004 open to MS and non-MS 46 member states,C3: Substantial criminal law,Article 2 Illegal access Article 3 Illegal interception Article 4 Data interference Article 5 System interference Article 6 Misuse of devices Article 7 Computer-related forgery Article 8 Computer-related fraud Article 9 Offences related to child pornography Article 10 Offences related to infringements of copyright and related rights,C3: Procedural Issues,Preservation and disclosure of traffic data Search and seizure of stored computer data Real-time information collection Interception of computer data Jurisdiction issues Extradition Mutual assistance 24/7 Network,Council of Europe,Convention on the Prevention on Terrorism opened for signature 2005 entry into force 2007 31 member states,Some observations,Soft law or insufficient number of states parties Different views as to whether there are gaps in international law in general Difficult to achieve additional consensus Focus to be put on ensuring the effective implementation of the conventions,European Union,Directives:Personal Data Protection Data Retention Electronic Communications ISP liability Information Society Services Spam Critical Infrastructure Protection*,Some observations,Focus on common market No direct effect on national security issues Common nominator for all Member States legal systems,European Union,Framework Decisions:Council Framework Decision 2002/475/JHA of 13 June 2002 on combating terrorism Council Framework Decision 2005/222/JHA of 24 February 2005 on attacks against information systems,2005/222/JHA vs C3,Article 2 Illegal access to information systemsArticle 3 Illegal system interferenceArticle 4 Illegal data interference,Article 2 (Illegal access)Article 5 (System interference)Article 4 (Data Interference),Estonian proposal,Article 7 Aggravating circumstancesNew paragraph 3: All member states must take the appropriate measures to ensure that offences listed in articles 2-4, directed against critical infrastructures or disturbing the provision of public services, be punishable with criminal penalties of a maximum of at least between two and five years imprisonment.,More on cooperation and law,Bilateral agreements provide legal basis for mutual cooperation (investigation, prosecution, extradition etc.) Countries with no legal coverage in the field are a good “jurisdiction shopping forum” International discussions do not stand in court, different arguments and legal schools need to be balanced Law is important, but secondary means in ensuring effective cyber security,Estonian Lessons Learned,Adding the critical infrastructure protection context to computer-related crime provisions of the Penal Code Criminalizing preparation of computer-related crime Viewing computer-related crime as terrorist crime Defining critical information infrastructure More specific regulation on ISP liability,Any further questions?,Eneken Tikk eneken.tikkmil.ee +372 50 722 70,