Research on Legislation in Data Privacy, Security and the Prevention of Cybercrime
Total Page:16
File Type:pdf, Size:1020Kb
International Telecommunication Union Research on legislation in data privacy, security and the prevention of cybercrime Contact information: Alexander Ntoko Chief, E-Strategies Unit Telecommunication Development Bureau International Telecommunication Union Place des Nations 1211 Geneva 20 Switzerland E-mail: [email protected] Website: www.itu.int/ITU-D/e-strategy Research on legislation in data privacy, security and the prevention of cybercrime on legislation in data privacy, Research Printed in Switzerland Geneva, 2006 International Telecommunication Union Research on legislation in data privacy, security and the prevention of cybercrime © ITU, 2006 International Telecommunication Union Place des Nations CH-1211 Geneva, Switzerland First printing 2006 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior written permission of ITU. The views expressed in this paper are those of the author and do not necessarily represent the opinions of ITU or its membership. The terms and definitions used are the author’s own and can on no account be regarded as replacing the official ITU definitions. Denominations and classifications employed in this publication do not imply any opinion on the part of the International Telecommunication Union concerning the legal or other status of any territory or any endorsement or acceptance of any boundary. Disclaimer This report is the result of research and analysis carried out by Ms Michela Menting Yoell as part of her internship at the ITU/BDT E-strategies Unit for a Master of Laws (LL/M) law degree, with the objective of providing some guidelines to developing countries on legislation in data privacy, security and prevention of cybercrime. The opinions expressed are those of the authors and do not engage ITU in any way. FOREWORD Within the framework of the WTDC-02 Istanbul Action Plan Programme 3 (E-Strategies and E-Services/Applications), ITU is mandated to assist Member States in developing laws and model legislation for e-services, prevention of cybercrime, security and data privacy. Within this context, Ms Michela Menting Yoell undertook research as an intern in the ITU/BDT E-Strategies Unit as part of her postgraduate work for a Master in Law (LLM) in information technology, media and e-commerce at the University of Essex in the United Kingdom. The result of this internship is this report on Research on legislation in data privacy, security and the prevention of cybercrime, which is aimed at assisting developing countries through the case studies included herein, analysis and research to provide guidelines on legislative issues that are part of the mandate of Programme 3. Foreword iii ABSTRACT The information age has made the public and private sectors of modern society increasingly dependent on technology, in which telecommunications play a vital role. Over the past thirty years, developed nations’ transit from the industrial era to the new information age has enabled them to develop the nascent technology and produce ever greater quality in standards and value. The past decades have also delivered many opportunities in which the flaws and faults of the system have been exploited and mended, by hackers and legitimate users alike. The new society has engendered new types of crimes, such as phishing and botnets, and facilitated the commission of old crimes, for example the violation of intellectual property rights, with new technology facilitating breaches of copyright in music, films and software. As society grows ever more reliant on these technologies, so does the concern for security, especially in cyberspace. The emancipation of the internet has leaped ahead of the judicial system, but the authorities have taken heed and the wheels of the legal machine have started turning. The difficulty, however, has been that the internet-based society has no physical boundaries and thus much traffic escapes national supremacy. Therefore, looking to an international framework would immensely facilitate regulation in this area. The European Union has enabled harmonized implementation of regulation on electronic commerce through directives in almost all European countries, with non- member countries aligning themselves with the EU movement. As founding father to the internet, the US has both important knowledge and experience in the legal field of cybersecurity, with significant influence in the area. Developing countries are jumping onto the bandwagon. However, many of those countries are coming straight from an agricultural society and, with the technological know-how of developed nations, are starting to create the infrastructure needed to support a technology-based society. The problem is nonetheless that many have neither the expertise nor the experience to deal with the legal and policy issues necessary. In order to promote the develop- ment and use of technologies and the internet, security must be assured, especially for e-commerce businesses. The International iv Abstract Telecommunication Union’s Development Bureau mandate is to assist such developing countries to acquire the knowledge and develop the founding blocks for an information society. One of these founding blocks is cybersecurity. In order to compile general but adequate guidelines on such a vast area, research on existing legislation in developing countries and multinational frameworks is examined on both a content level, encompassing intellectual property, digital rights management and anti-circumvention, and a network security level, incorporating areas such as technical standards and integrity of data, with a close look at the security of information infrastructure (privacy and data protection) and computer-related crimes (spamming and identity theft), among other topics. Abstract v ACKNOWLEDGEMENTS I would like to thank Professor Rohan Kariyawasam, Law Lecturer at the University of Essex in the United Kingdom, and Alexander Ntoko, Chief of ITU/BDT E-Strategies Unit, for supervising my work, Bogdan Manolea, legal advisor at INTERNEWS in the RITI dot-Gov project at Romanian Information Technology Initia- tive (www.legi-internet.ro/en/index.htm) for his contribution on Romania, and Peter Menting, Lawyer for the International Counsel Bureau in Kuwait, for editing of the report. Michela Menting Yoell vi Acknowledgements TABLE OF CONTENTS Page Introduction........................................................................ 1 Intellectual property rights ............................................... 9 Copyright and digital rights management............................ 9 United States................................................................. 11 European Union............................................................ 15 Canada ......................................................................... 18 Trademark and domain name............................................... 20 International.................................................................. 21 United States................................................................. 24 European Union............................................................ 27 United Kingdom ........................................................... 28 Europe........................................................................... 29 Hypertext linkages, framing and metatagging ..................... 29 Hypertext linking.................................................................. 29 United States................................................................. 30 Europe........................................................................... 30 Japan… ......................................................................... 31 Germany ....................................................................... 32 Framing................................................................................ 33 United States................................................................. 33 Metatagging ......................................................................... 34 Network Security................................................................ 37 Authentication...................................................................... 37 International.................................................................. 40 European Union............................................................ 44 Table of contents vii Page United Kingdom ........................................................... 47 Europe........................................................................... 51 United States................................................................. 53 Argentina ...................................................................... 54 Access Control and Communication Security ..................... 56 Council of Europe......................................................... 57 European Union............................................................ 60 United Kingdom ........................................................... 61 United States................................................................. 65 Australia........................................................................ 66 Security of information infrastructure ............................ 69 Integrity of data: data security, privacy and confidentiality ............................................................. 69 Council of Europe......................................................... 70 United Nations.............................................................