A/CONF. 187/10 criminal provisions where the distribution of such material 26. Criminal investigations in an electronic environment is not already illegal. Many States are preparing or have require technical expertise, appropriate procedures and enacted child pornography laws. National and international sufficient legal authority. The 1989 and 1995 police authorities have also given high priority to the Recommendations of the Council of Europe(r(1989)9en investigation of child pornography R(95)13)stressed the need for national law enforcement 23. As regards offences that involve material relating to authorities to deploy specialized computer crime units the incitement of hate or discrimination. for various These units should be adequately staffed and provided with reasons, there is less global consensus about whether the appropriate equipment and software tools. Training distribution. The situation may change as the awareness of personnel and with up-to-date technical knowledge. Many the international community is raised about the negative kind. A number have produced manuals with technical, effects of such behaviour forensic and procedural instructions on how an 24. The distribution of illegal materials has caused a investigation should be carried out to reduce loss of discussion about the role and responsibilities of Internet evidence and to secure its admissibility in court service providers. Apart from a few legislative initiatives to define and to delineate the duties of care of providers 27. Some national police units"patrol"the Internet and there is a tendency internationally as well as nationally, to specific software tools have been developed to detect give Internet service providers a legal status similar to that crimes such as hacking or distributing child pornography of traditional telecom operators. This means that Internet The European Union partly funded the development by providers generally have no legal obligation to monitor or Swedish police of software to trace child pornography(see possiblyblocktrafficthatistransferredbymeansoftheir<http:/ww.techweb.com>).giventheenormousamount computer systems. Nevertheless, an Internet service f information available in international computer provider generally is required to take all reasonable steps networks, the development of software tools such as those to prevent further distribution of illegal material once based on pattern recognition seems indispensable aware of its nature. Other aspects of the application of 28. There are two methods of obtaining data from a domestic law to Internet service providers may also be computer system, based on technical and legal criteria. In unclear. This includes the extent of possible civil liability the first, data are obtained as part of a search of premises for the transmission of illegal content, and the extent to or the place where the system is located. The second which an Internet service provider has an obligation to involves the interception or monitoring of data transmitted cooperate with law enforcement authorities by providing from, to or within the system. Legal powers for searching information for a particular criminal investigation or other premises are not discussed here. It is assumed that the legal assistance powers will encompass the authority to search a computer system at a given location. Interception may be done by technical means from the outside of a system or by means IV. Criminal investigations of cyber of elements incorporated within the system for that crime 29. Generally, traditional criminal procedural law 25. As stated, cyber crime can be any crime committed provides for the seizure and freezing of entire computer by electronic means, or committed in part or entirely in an systems, as it provides for any other evidence. Where this electronic environment. Criminal investigations in an is not feasible, however, there may not be adequate legal electronic environment are directed against such crimes. powers to investigate the content of a computer system Other crimes, however, can also leave traces or evidence against the will of the right holder(s). The seizure of an in the electronic environment. Criminal investigations in entire computer system may not be technically feasible, or lectronic environments will therefore not be limited to it may be disproportionate owing to a multi-user cyber crime in the sense used in the previous chapter, but environment and a multi-user interest in the data content will encompass the investigation of any crime for which Attempts to secure data for particular investigations may (potential) evidence needs to be secured in an electronic find traditional powers insufficient owing to: (a) problems nvironment related to obtaining access to the computer system; (b)theA/CONF.187/10 7 criminal provisions where the distribution of such material is not already illegal. Many States are preparing or have enacted child pornography laws. National and international police authorities have also given high priority to the investigation of child pornography. 23. As regards offences that involve material relating to the incitement of hate or discrimination, for various reasons, there is less global consensus about whether the criminal laws should be used against expression or distribution. The situation may change as the awareness of the international community is raised about the negative effects of such behaviour. 24. The distribution of illegal materials has caused a discussion about the role and responsibilities of Internet service providers. Apart from a few legislative initiatives to define and to delineate the duties of care of providers, there is a tendency internationally as well as nationally, to give Internet service providers a legal status similar to that of traditional telecom operators. This means that Internet providers generally have no legal obligation to monitor or possibly block traffic that is transferred by means of their computer systems. Nevertheless, an Internet service provider generally is required to take all reasonable steps to prevent further distribution of illegal material once aware of its nature.6 Other aspects of the application of domestic law to Internet service providers may also be unclear. This includes the extent of possible civil liability for the transmission of illegal content, and the extent to which an Internet service provider has an obligation to cooperate with law enforcement authorities by providing information for a particular criminal investigation or other assistance. IV. Criminal investigations of cyber crime 25. As stated, cyber crime can be any crime committed by electronic means, or committed in part or entirely in an electronic environment. Criminal investigations in an electronic environment are directed against such crimes. Other crimes, however, can also leave traces or evidence in the electronic environment. Criminal investigations in electronic environments will therefore not be limited to cyber crime in the sense used in the previous chapter, but will encompass the investigation of any crime for which (potential) evidence needs to be secured in an electronic environment. 26. Criminal investigations in an electronic environment require technical expertise, appropriate procedures and sufficient legal authority. The 1989 and 1995 Recommendations of the Council of Europe (R (1989) 9 en R (95) 13) stressed the need for national law enforcement authorities to deploy specialized computer crime units. These units should be adequately staffed and provided with appropriate equipment and software tools. Training programmes should ensure the availability of trained personnel and with up-to-date technical knowledge. Many States have already created computer crime units of this kind. A number have produced manuals with technical, forensic and procedural instructions on how an investigation should be carried out to reduce loss of evidence and to secure its admissibility in court. 27. Some national police units “patrol” the Internet and specific software tools have been developed to detect crimes such as hacking or distributing child pornography. The European Union partly funded the development by Swedish police of software to trace child pornography (see <http://www.techweb.com>). Given the enormous amount of information available in international computer networks, the development of software tools such as those based on pattern recognition seems indispensable. 28. There are two methods of obtaining data from a computer system, based on technical and legal criteria. In the first, data are obtained as part of a search of premises or the place where the system is located. The second involves the interception or monitoring of data transmitted from, to or within the system. Legal powers for searching premises are not discussed here. It is assumed that the legal powers will encompass the authority to search a computer system at a given location. Interception may be done by technical means from the outside of a system or by means of elements incorporated within the system for that purpose. 29. Generally, traditional criminal procedural law provides for the seizure and freezing of entire computer systems, as it provides for any other evidence. Where this is not feasible, however, there may not be adequate legal powers to investigate the content of a computer system against the will of the right holder(s). The seizure of an entire computer system may not be technically feasible, or it may be disproportionate owing to a multi-user environment and a multi-user interest in the data content. Attempts to secure data for particular investigations may find traditional powers insufficient owing to: (a) problems related to obtaining access to the computer system; (b) the