European Council: Creating hacking tools should be criminal across the EU
The making of hacking tools and computer viruses should be a criminal act across Europe, EU ministers have said.
The EU’s Council of Ministers has backed the extension of criminal sanctions to tool—makers in response to European Commission plans to update EU laws tackling attacks against computer systems.
Responding to European Commission plans to create a new anti-hacker Directive, the Council has said that the making of hacking tools should be criminalised, adding this to the list of currently criminal practices.
“The following new elements [should include] penalisation of the production and making available of tools (eg, malicious software designed to create ‘botnets’ or unrightfully obtained computer passwords) for committing the offences [of attacks against computer systems],” the Council of Ministers said in a statement (pages 18-19 of 38-page/176KB PDF).
“The term botnet indicates a network of computers that have been infected by malicious software (computer virus),” the Council statement said.
“Such network of compromised computers (‘zombies’ may be activated to perform specific actions such as attacks against information systems (cyberattacks). These ‘zombies’ can be controlled – often without the knowledge of the users of the compromised computers – by another computer,” the Council statement said.
The creation of the kinds of tools outlined in the new plans is already a criminal offence in the UK. The Computer Misuse Act says that making, supplying or obtaining articles for use in hacking is a criminal offence and carries a maximum prison term of up to two years and a fine.
Under the Act a person is guilty of an offence if he “makes, adapts, supplies or offers to supply any article intending it to be used to commit, or to assist in the commission of, [a hacking offence].” The word “article” is defined in the Act to include “any program or data held in electronic form”.
Illegal interception of computer data will also become a criminal offence under the Council’s plans, the statement said.
The proposals also suggest that there should be an obligation for EU countries to report computer system attacks within eight hours to existing contact points to improve European cooperation in criminal matters.
It should be a mandatory requirement for EU countries to collect basic statistical data on cybercrimes, the Council also said in its proposals.
The new measures should add to existing laws for penalising computer system attacks, the Council said.
“The new rules would retain most of the provisions currently in place – namely the penalisation of illegal access, illegal system interference and illegal data interference as well as instigation, aiding, abetting and attempt to commit those criminal offences,” the Council said in its statement.
Criminal penalties for computer system attacks should be increased, the Council said.
“The new rules would raise the thresholds if the attack has been committed by an organised criminal group, or has caused serious damage, eg, through the use of a ‘botnet’, or has affected a critical IT system, to a maximum term of imprisonment of at least five years,” the Council said.
General cases of computer system attacks should result in offenders facing a maximum jail sentence of at least two years, and punishment for offences committed against a “significant number” of systems should be a maximum of at least three years jail time, the Council said.
“These new forms of aggravating circumstances are intended to address the emerging threats posed by large scale cyberattacks, which are increasingly reported across Europe and have the potential to severely damage public interests,” the Council said in its statement.
The Council, which is formally called the Council of the European Union, is made up of 27 ministers representing each EU state. Ministers share law-initiating duties with members of the European Parliament. The Council will use the general proposals as the basis of negotiations with the Parliament over what exactly should be included in the new laws, the Council’s statement said.
The UK and Ireland must implement the new rules of the new Directive into national law but Denmark will not be bound by them, the Council said.