UNODC International Cooperation and

Assistance in Cybercrime Matters

To integrate cybercrime and electronic evidence related issues in broader UNODC mandates of • Supporting Member States with ratification and

implementation of international treaties • Research and analytical work to increase knowledge

and understanding of crime-related issues • Promoting international cooperation • Enhancing Member States’ capacities to counteract

illicit drugs, crime and terrorism

UNODC Approach

Intergovernmental Expert Group - Study

• Mandate: General Assembly Resolution 65/230 • Responses from 69 Member States (13 from the Americas) • Private Sector, Academia, Intergovernmental Organizations • Open source documents

Commission on Crime Prevention and Criminal Justice (CCPCJ) Resolution 22/8 (2013) • Requests UNODC to serve as a central data

repository of cybercrime laws and ‘lessons learned’

• With a view to facilitating the continued assessment of needs and criminal justice capabilities and delivery and coordination of TA

• Will be integrated into SHERLOC knowledge management portal

Global Cybercrime Repository

0%

2%

4%

6%

8%

10%

12%

14%

16%

Email account

hacked

Responded to

phishing

attempt

Identity theft Online credit

card fraud

Burglary Robbery Car theft

% r

esp

on

de

nts

re

po

rtin

g vi

ctim

izat

ion

in

las

t ye

ar,

20

11

or

late

st a

vaila

ble

ye

ar

Figure 2.4: Cybercrime and conventional crime victimization

HDI < 0.8 (8 countries)

HDI > 0.8 (13 countries)

Source: UNODC elaboration of Norton Cybercrime Report and crime victimization surveys.

Cybercrime Victimization

Transnational Dimension of Cybercrime

0

10

20

30

40

50

60

70

80

90

Europe (8) Asia &Oceania (7)

Africa (6) Americas (7)

%

Figure 7.1: Percentage of cybercrime acts involving a transnational dimension

Source: Study cybercrime questionnaire. Q83. (n=28)

Electronic Evidence

Company records:

• Corporate structures • Contracts • Directors

Bank accounts:

• Account statements • Details of beneficial owners • Wire transfer payments

Communications data:

• Emails confirming ownership of IP addresses

• Emails evidence fraud scheme

Servers:

• Contracts • Wire transfer

payments

Victims:

• Analysis of malware

• Which countries have jurisdiction to prosecute?

• What is the basis of jurisdiction?

• Where could prosecution best take place?

• Can nationals be extradited? If not, what happens?

• Is there dual criminality?

• How can investigations best be coordinated?

• How can evidence be obtained?

• What evidence is needed?

• Do sufficient investigative powers exist in criminal procedure law?

• How can the criminal assets be identified and seized?

• How should victims (infected computers) be informed/treated?

International Cooperation Challenges

Means of Obtaining Extra-Territorial Evidence

73%

9%

8%

6%4%

Figure 7.4: Means of obtaining extra-territorial evidence

Formal MLA request

Informal police cooperation

Direct contact with service provider

24/7 network point of contact

Other

Source: Study cybercrime questionnaire. Q105. (n=56, r=221)

Legal Basis of MLA and Extradition Requests

19%

5%

57%

18%

1%

Figure 7.5: Legal basis of cybercrime extradition and MLA requests

Multilateral instrument

Regional instrument

Bilateral instrument

Reciprocity

Other

Source: Study cybercrime questionnaire. Q202-207 and Q227-232. (n=21, r=50)

Key Components of Cooperation

Central authority

Accurate preparation of requests

Starting point: intelligence

Intelligence requests

Informal pre-submission

contact

Legal basis and procedural

laws

The Big Picture – Modes of Cooperation

Set priorities

Collect

Evaluate

Collate Analyse

Infer

Use

Formal Investigation and Evidence

Collection

Mutual Legal Assistance Police Cooperation

Intelligence Cycle

Informal Police Cooperation

0% 20% 40% 60% 80% 100%

Africa (n=6)

Americas(n=8)

Asia & Oceania(n=17)

Europe(n=14)

Figure 7.11: Can assistance be provided informally, as well as

through a formal MLA request?

Yes

No

Source: Study cybercrime questionnaire. Q223. (n=45)

Forms of Informal Cooperation

3%

3%

3%

3%

10%

23%

35%

35%

39%

42%

Stored traffic data from a service provider

Seizure of computer hardware or data

Search for computer hardware or data

Provisional arrest of a suspect

Other (unspecified)

Expedited preservation of computer data

Conduct of a joint investigation

Identity or subscriber information for a suspect

General legal advice

General technical advice

Form

s o

f in

form

al c

oo

pe

rati

on

Figure 7.13: Forms of informal cooperation with law enforcement agencies

Source: Study cybercrime questionnnaire. Q106. (n=31, r=61)

Average Response Time Informal Cooperation

23%

19%

13%

32%

13%

0%

5%

10%

15%

20%

25%

30%

35%

1-2 2-5 5-10 10-30 >30

% o

f re

qu

est

s

Number of days

Figure 7.16: Average time for response to requests sent and received by focal point for cooperation in cybercrime cases

Source: Study cybercrime questionnaire. Q107. (n=25, r=47)

Red de Fiscales contra el Crimen Organizado – REFCO Belize, Costa Rica, Colombia, the Dominican Republic, El Salvador, Guatemala, Honduras, Mexico, Nicaragua and Panama (+ Bolivia, Peru) (Meeting in Costa Rica, December 2013) • MLA requests take btw. 0.5 and 7 working days • Legal processing (i.e. signatures) may take up to 22+ days • Translation and Authentication may take up more than a week

• Drug-related crime, especially money laundering • Challenge: no standard terminology • Need to strengthen research • Stronger involvement of judges necessary • Standard operating procedures for obtaining/handling digital evidence

Network of Prosecutors against Organized Crime

International Cooperation

• Defines traffic data, service provider, computer data, computer system, and subscriber information

• Covers requests for:

• expedited preservation and disclosure of computer data;

• Production of stored data;

• Search and seizure of data.

UN Model Law on Mutual Assistance in Criminal Matters (2007)

UN Convention against Transnational Organized Crime • Art. 15 – Jurisdiction • Art. 16 – Extradition • Art. 18 – MLA

International Drug Control Treaties i.e. UN Convention against Illicit Traffic in Narcotic Drugs and Psychotropic Substances, 1988

• Art. 3 – Offences and Sanctions (including technology-facilitated conduct)

• Art. 7 – MLA

International Cooperation

UNODC Mutual Legal Assistance Writer Request Tool (MLA Tool)

• Available upon request • Does not require prior experience • Helps to avoid incomplete requests • Information on treaties and nat. legislation

Upgrade and re-design • Increase usability • Include module on digital evidence • Create an application that does not require MS

Access • Link to CNA directory

UNODC MLA Tool

Objective: to assist and support Member States with preventing and combating cybercrime through a global, sustainable and holistic approach

UNODC Global Programme on Cybercrime

• Upon request • Pre-assessment process:

• Desk assessment • Pre-assessment mission

• Needs based • Local ownership • Sustainability – tied in with LE and

prosecution structures

UNODC Approach

• East Africa 2013

• In-depth country response capabilities assessment – Kenya • Regional joint training of Investigators and Prosecutors from 7

countries (Mobile & desktop forensics; Private sector participation; Specific prosecutorial training; Distance learning materials)

2014 • Regional conference for the East African region • Follow up in-country activities in Kenya

• Southeast Asia • Assessment of cybercrime response capabilities across the

region • Regional training workshops for LE, prosecutors, judges • Training modules for police academy in Viet Nam

Activities 2013/2014

Americas Establishment of National Police cybercrime unit in El Salvador

• Training on digital forensics and cybercrime investigation • Training of prosecutors on basic case strategy and handling of

digital evidence • Specialized training on crimes against children • Digital forensics lab • Cooperation with service providers • Support coordination with INTERPOL support networks • Advanced training • Development of curriculum for National Police academy

Further requests from the region, similar approach

Activities 2013/2014

UNODC - Contact

United Nations Office on Drugs and Crime (UNODC)

Division for Treaty Affairs, Organized Crime and Illicit

Trafficking Branch, Conference Support Section

cybercrime@unodc.org

Thank you!