Law Association of Trinidad and Tobago LATT Corporate

Law Association of Trinidad and Tobago (LATT) Corporate Commercial Law Webinar Cybercrime Legislative Requirements Presented by Tira Greene Legal Consultant tiragreene@gmail. com

The State of Cybercrime “Cybersecurity Are We Ready in Latin America and the Caribbean? 2016 Cybersecurity Report” (OAS and IDB) which analysed 49 indicators noted that: “Four out of five countries do not have cybersecurity strategies or critical infrastructure protection plans. Two out of three do not count on command centers and cybersecurity control. The vast majority of prosecutors lack the legal capacity to pursue cybercrime actions. ” https: //publications. iadb. org/en/publications/english/document/Cybersecurity-Are-We-Ready-in-Latin-America-and-the. Caribbean. pdf 2

CARIFORUM Cybercrime Statutes • Most CARIFORUM Member States have made efforts at legislating to criminalise cybercrime • Variations at both the level of the existence of legislative provisions as well as where provisions exist, differences between them • The UNDOC Report noted that while high-level consensus exists as it relates to the wide scope of criminalization, detailed review of the provisions show variance in several offences • Sometimes mere access is is criminalized as opposed to the requirement for the intent to cause loss or damage. • Same applies to interference • Illegal access to computer systems and data, vary with respect to the object of the offence (data, system, or information). 3

CARIFORUM Cybercrime Statutes Laws and regimes relating to Child Pornography and Electronic Evidence have even wider differences in the existence of actual legislation and procedures While offences relating to child pornography have been widely criminalized, there are differences regarding the definition of ‘child’, limitations in relation to ‘visual’ material or exclusion of simulated material, and acts covered and the criminalization of possession and access also differ among countries 4

Cybercrime Statutes: Need for harmonisation Many countries base their mutual legal assistance regime on the principle of “dual criminality”. Investigations on a global level are generally limited to those crimes that are criminalised in all affected countries. These differences may have repercussions on findings of dual-criminality between countries and therefore an impediment to mutual legal assistance requests, which are essential to combat transnational cybercrime. 5

Cybercrime Statutes: Need for balance: Freedom of Expression & Safeguards From Abuse Countries have also responded to crimes committed via new technologies like Over The Top (OTT) services, social media and user-generated internet content with greater regulation. International human rights law also requires criminalization of some extreme forms of expression (incitement to genocide, hatred constituting incitement to discrimination, hostility or violence, incitement to terrorism, and propaganda for war) 6

Use of electronics ubiquitous

Electronic Evidence Litigants and prosecutors need the best/most probative evidence to support their legal positions. The best evidence may be digital evidence In cyberattacks the only evidence will be digital emails, server logs, documents on computer, or smartphone, instant messages, websites Storage on phones, servers, routers, digital directories, “clouds” and server farms Digital evidence can sometimes be the best evidence available in terms of evidential weight 8

Electronic Evidence – Budapest Convention • Article 14 • each Party shall apply the powers and procedures referred to in paragraph 1 of this article to: • the criminal offences established in accordance with Articles 2 through 11 of this Convention; • other criminal offences committed by means of a computer system; and • the collection evidence of in electronic form of a criminal offence • Majority of Member States do not have any law with a general statement on the admissibility of electronic evidence – In order to comply with the Budapest Convention, electronic evidence must be collected in the context of expedited preservation of computer/digital data and of traffic data, production orders, search and seizure, real-time collection of traffic data, and interception of content data. 9

Electronic Evidence Laws Legal requirements for proving that a computer was operating properly, archaic requirements dealing with a networked system and how to prove data is business records. In 2011 -2012 Singapore looked at removing anachronistic provisions from its Evidence law, and codified the presumption that the device or process produced or accurately communicated the electronic record. Recommend general admissibility, removal of anachronistic provisions and the codification of the presumption that the device or process produced or accurately communicated the electronic record. 10

Data Protection Data protection encompasses protecting the fundamental right to respect for privacy, a right enshrined in the Constitutions of many CARIFORUM Member States as well as in several international and regional instruments. Today, massive amounts of data including personal information is automatically collected, processed and stored. New privacy issues with COVID 19 such as contact tracing. Data protection laws are required to provide rules for such collection, storage and use, both by public and private sector entities. 11

Data Protection Identity Theft GDPR Biometrics 12