Combatting Cybercrime Tools and Capacity Building for Emerging Economies Page 1 | Chapter 01 |  Table of Contents Some Rights Reserved This work is a product of the staff of The World Bank with external contributions. The findings, interpretations, and conclusions expressed in this work do not necessarily reflect the views of The World Bank, its Board of Executive Directors, or the governments they represent. The World Bank does not guarantee the accuracy of the data included in this work. The boundaries, colors, denominations, and other information shown on any map in this work do not imply any judgment on the part of The World Bank concerning the legal status of any territory or the endorsement or acceptance of such boundaries. Nothing herein shall constitute or be considered to be a limitation upon or waiver of the privileges and immunities of The World Bank, or of any participating organization to which such privileges and immunities may apply, all of which are specifically reserved. Rights and Permission This work is available under the Creative Commons Attribution 3.0 IGO license (CC BY 3.0 IGO) http://creativecommons.org/licenses/by/3.0/igo. Under the Creative Commons Attribution license, you are free to copy, distribute, transmit, and adapt this work, including for commercial purposes, under the following conditions: Attribution — Please cite the work as follows: World Bank. 2016. Combatting Cybercrime: Tools and Capcity Building for Emerging Economies, Washington, DC: World Bank License: Creative Commons Attribution 3.0 IGO (CC BY 3.0 IGO) Translations — If you create a translation of this work, please add the following disclaimer along with the attribution: This translation was not created by The World Bank and should not be considered an official World Bank translation. The World Bank shall not be liable for any content or error in this translation. Adaptations — If you create an adaptation of this work, please add the following disclaimer along with the attribution: This is an adaptation of an original work by The World Bank. Views and opinions expressed in the adaptation are the sole responsibility of the author or authors of the adaptation and are not endorsed by The World Bank. Third Party Content — The World Bank does not necessarily own each component of the content contained within the work. The World Bank therefore does not warrant that the use of any third- party-owned individual component or part contained in the work will not infringe on the rights of those third parties. The risk of claims resulting from such infringement rests solely with you. If you wish to re-use a component of the work, it is your responsibility to determine whether permission is needed for that re-use and to obtain permission from the copyright owner. Examples of components can include, but are not limited to, tables, figures, or images. All queries on rights and licenses should be addressed to World Bank Publications, The World Bank, 1818 H Street, NW, Washington, DC, 20433; USA; email: [email protected]. © 2016 International Bank for Reconstitution and Development/The World Bank 1818 H Street, NW, Washington, D.C., 20433 Telephone: 202-473-1000; Internet: www.worldbank.org Acknowledgments This Toolkit was developed under a project, “Combating Cybercrime: Tools and Capacity Building for Emerging Economies” (“Project”), financed by a grant from the Korean Ministry of Strategy and Finance under the Korea-World Bank Group Partnership Facility (KWPF) Trust Fund. The team gratefully acknowledges financial support from the Korean Ministry of Strategy and Finance that made this Project possible. The Project team was headquartered in the World Bank, and Youngdae Kim, Seokjo Yang, Heesuk Lee and Seungjin Choi. included the following participating organizations: the Council Luc Dandurand, Marco Obiso, Preetam Maloor and Rosheen of Europe (CoE), the International Association of Penal Law Awotar-Mauree of ITU; Francesca Bosco and Arthur Brocato of (AIDP), the International Telecommunication Union (ITU), the UNICRI; Sadie Creese, Eva Ignatuschtschenko and Lara Pace of Korea Supreme Prosecutors Office (KSPO), the Oxford Cyber- Oxford; Cecile Barayre of UNCTAD; Alexander Seger and security Capacity Building Centre (Oxford), the United Nations Betty Shave of CoE, and Neil Walsh, Dimosthenis Chrysikos, Conference on Trade & Development (UNCTAD), the United and Bilal Sen, of UNODC. Nations Interregional Crime and Justice Research Institute The Team would also like to express its gratitude to peer (UNICRI), and the United Nations Office on Drugs & Crime reviewers, Professor Ian Walden, Queen Mary University of (UNODC). London, and Steven Malby of the Commonwealth. The team is The Project team at the World Bank was led by David Satola also grateful for the time, consultations and valuable inputs and included Seunghyun Bahn, Nigel Marc Bartlett, Jinyong received from staff at INTERPOL’s Global Complex for Chung, Conrad C. Daly, Heike Gramckow, Theodore Innovation in Singapore including Madan Oberoi, Mustafa Christopher Kouts, James Neumann, Seunghwan Park, Marco Erten, Steve Honiss, Silvino Schlickmann and Tomas Herko. Nicoli, Diana Norman, Elizabeth Anne Norton, Sandra Sargent, The Toolkit and Assessment Tool were also the subject of Janice Kim Song, Emilio C. Viano, Georgina Weise, Christiaan several consultation events, conferences and workshops held van der Does de Willebois, Stuart Yikona and Keong Min Yoon. at or with the sponsorship of the CoE, Europol, Interpol, ITU, The Team owes a special debt of gratitude to Hyunji Song, for the Korea Institute of Criminology, UNCTAD, UN and Central her unflagging commitment and contributions to this project Bank of Qatar. The team thanks the participants in all of these too numerous to mention here. Without her research and events and at these organizations for the opportunities to raise organizational skills, initial drafting efforts and intellectual awareness of this Project and for helpful comments and guidance, this Project could not have been realized. suggestions. The contributions of the following people from the The team apologizes to any individuals or organizations participating organizations are recognized. From KSPO, inadvertently omitted from this list. Table of Contents 01. Introductory Part 6 06. Capacity Building 182 An overall introduction to the Toolkit, View An overview of capacity building issues View highlighting some of the main the issues around Print for policy makers and legislators, law Print cybercrime and describing some of the main enforcement, consumers and cooperation challenges to fighting cybercrime. with the private sector. 02. Foundational Considerations 51 07. In-Country Assessment Tool 221 An overview describing what is meant by View An overview of various existing tools to assess View “cybercrime” and the discusses what “basics” Print cybercrime preparedness and an introduction of Print regarding procedural, evidentiary, jurisdictional the Assessment Tool enabling users to determine and institutional issues. gaps in capacity and highlight priority areas to direct capacity-building resources. 03. National Legal Frameworks 131 08. Analysis and Conclusion 228 An overview of substantive criminal aspects View Concluding thoughts on evolving best practices View of cybercrime and how they are expressed in Print in combatting cybercrime. Print national legal frameworks. 04. Safeguards 144 09. Appendices 229 An overview examining procedural View View “safeguards” of due process, data protection/ Print Print privacy and freedom of expression as they relate to cybercrime. 05. International Cooperation 152 10. Bibliography 336 An introduction to both formal and informal View View aspects of international cooperation to combat Print Print cybercrime. Abbreviations & Acronyms ACHPR African Commission on Human and Peoples’ Rights IoT Internet of Things ACHR American Convention on Human Rights ISP Internet Service Provider APEC Asia-Pacific Economic Cooperation IT Information Technology ASEAN Association of Southeast Asian Nations ITU International Telecommunication Union ATM Automated Teller Machine J-CAT Joint Cybercrime Action Taskforce CCIPS Computer Crime and Intellectual Property Section JIT Joint Investigation Team CERT Computer Emergency Response Team (or JPIIT KSPO’s Joint Personal Information Investigation Team “Computer Emergency Readiness Team” KSPO Korean Supreme Prosecutor’s Office CFTT Computer Forensics Tool Testing MA Mutual Assistance CIS Commonwealth of Independent States MLA Mutual Legal Assistance COMESA Common Market for Eastern and Southern Africa MLAT Mutual Legal Assistance Treaty CoE Council of Europe MSN Microsoft Service Network CSIS Center for Strategic and International Studies NCB National Central Bureau DDoS Distributed Denial of Service NCFTA National Cyber-Forensics & Training Alliance EC3 European Cybercrime Centre NCIJTF FBI’s National Cyber Investigative Joint Task Force ECHR European Convention on Human Rights NCRP National Central Reference Points ECtHR European Court of Human Rights NIST U.S. National Institute of Standards and ECJ European Court of Justice Technology ECOWAS Economic Community of West African States OAS Organization of American States ECTF U.S. Secret Service’s Electronic Crimes Task Force OCSI U.K. Office of Cyber Security and Information ENISA European Network and Information Security Agency OECD Organization for Economic Co-operation and EJN European Judicial Network Development EU European Union OECS Organization