3 Attacks against information systems
| (32004)
14436/10
COM(10) 517
+ ADDs 1-2
| Draft Directive on attacks against information systems, repealing Council Framework Decision 2005/222/JHA
Commission staff working documents: Impact assessment and summary of impact assessment
|
| Legal base | Article 83(1) TFEU; co-decision; QMV
|
| Document originated | 30 September 2010
|
| Deposited in Parliament | 5 October 2010
|
| Department | Home Office
|
| Basis of consideration | Minister's letter of 31 January 2011
|
| Previous Committee Report | HC 428-vi (2010-11), chapter 6 (3 November 2010)
|
| To be discussed in Council | No date set
|
| Committee's assessment | Legally and politically important
|
| Committee's decision | Not cleared; opt-in decision recommended for debate in European Committee B
|
Background and previous scrutiny
3.1 In 2005, the Council adopted a Framework Decision requiring
Member States to criminalise unauthorised access to, or interference
with, information systems and computer data. The UK is bound by
the Framework Decision and the offences and penalties it prescribes
are reflected in the Computer Misuse Act 1990.
3.2 Since the adoption of the Framework Decision
in 2005, the Commission believes that the incidence of large-scale
attacks against information systems has increased significantly
and that new and more sophisticated tools have emerged which have
the potential to infect significant numbers of information systems
and cause considerable damage. It suggests that the Framework
Decision does not fully address the potential threat posed to
society by large scale attacks, such as occurred in Estonia in
2007 when important parts of the critical information infrastructure
of government and the private sector were taken out for several
days.
3.3 The Commission has therefore proposed repealing
the 2005 Framework Decision while incorporating most of its provisions
in a new draft Directive and including some additional elements
to strengthen Member States' capacity to prevent and prosecute
large-scale attacks against information systems. The purpose and
content of the draft Directive, and the Government's views on
it, are set out in our Sixth Report of 3 November 2010. The Parliamentary
Under-Secretary of State for Crime Prevention (James Brokenshire)
told us in his Explanatory Memorandum of 13 October 2010 that
significant new legislation would not be needed to implement the
draft Directive in the UK as most of the offences described are
already included in the Computer Misuse Act 1990. However, some
changes were likely to be required in the following areas, although
the need for and extent of any change would depend on the outcome
of negotiations:
- making the creation, possession
and distribution of tools or devices for the purpose of illegal
interception of information systems a criminal offence;
- increasing the level of criminal penalties; and
- extending the basis for exercising criminal jurisdiction.
3.4 We considered that the legal base proposed
for the draft Directive was appropriate, that large-scale attacks
against information systems were likely to have a cross-border
dimension and that there was therefore a case for further EU action
to respond to new methods and tools for committing cyber crime.
However, we expressed concern that the language proposed in the
draft Directive for establishing criminal liability was imprecise
and inappropriate and also asked the Minister to explain what
implications the draft Directive would have for existing UK rules
on jurisdiction.
3.5 In his letter of 17 November 2010, the Minister
told us that he shared our concern about the imprecise wording
of the some of the Articles in the draft Directive and that he
would endeavour to secure their amendment or removal in the course
of negotiations. He explained that jurisdiction for offences committed
under the Computer Misuse Act 1990 requires the offender or the
offence to have a link to the UK which is greater than that envisaged
in the draft Directive. He added that the Government would not
wish to see any reduction in this link and would therefore seek
appropriate amendments during negotiations. The Minister also
told us that, if the Government decided to opt into the draft
Directive, it would have to notify the Justice and Home Affairs
Council by 23 December.
The Minister's letter of 31 January 2011
3.6 The Minister informs us that the Government
has decided to opt into the draft Directive and says that he will
ensure that the concerns raised by the Committee in its earlier
Report will be reflected in the UK's negotiating mandate.
Conclusion
3.7 When we considered the draft Directive
last November, the Government told us that it was too early to
make a decision on whether it should opt into the draft Directive.
In reaching its decision, the Government would consider, in particular,
the impact of the draft Directive on the security of the UK, civil
liberties, the integrity of the UK's common law system and the
control of immigration. The Minister indicated that the draft
Directive would be unlikely to have a significant impact on the
UK's national security or on civil liberties. Nor did he consider
that the draft Directive raised concerns relating to the balance
of EU and UK competence in this area of criminal activity. Although
the criminal penalties proposed for some offences would conflict
with sentences prescribed by UK law, the Government would seek
to address this in negotiations if it decided to opt in.
3.8 We would have welcomed a clearer indication
from the Government in its Explanatory Memorandum of its views
as to whether or not it intended to opt in. We also think that
the Government should have informed us of its decision sooner,
rather than waiting for one month to elapse. We ask the Minister,
in future, to inform the Committee in advance if he intends to
make an oral statement to the House on the Government's decision
to opt into a proposal.
3.9 It is evident that the draft Directive
will, unless amended in the course of negotiations, require some
change to existing criminal law in the UK. We think, therefore,
that the Government's decision to opt in should be debated in
European Committee B. We intend to hold the draft Directive under
scrutiny and welcome the Minister's assurance that he will keep
us informed of progress of negotiations.
| 
