|Henrik W.K.Kaspersen 
The Cyber Crime Convention of the Council of Europe was opened for signature on November 23, 2001. Next month the Council of Ministers will adopt the First Additional Protocol to the Cyber Crime Convention, which is directed at the criminalisation of racist and xenophobic conduct in computer networks. The protocol not only provides for a harmonised approach with regard the criminalisation of such harmful conduct, it also makes the investigative powers of the Cyber Crime Convention applicable to the investigation of racist and xenophobic crimes in electronic environments. The Cyber Crime Convention contains a number of new investigative measures, in particular directed at investigations in electronic communication networks, which enable mutual assistance in a modern, flexible, and - if necessary - expedited way.
This paper will deal with the phenomenon of racism and xenophobia in Europe and the role of the international electronic communication facilities. Further, the content of the first additional Protocol will be discussed, against the background of the European human rights tradition, in particular other fundamental rights, such as freedom of speech. After presenting an outline of the Cyber Crime Convention, the relevant investigative powers will be discussed as well as the possibilities of mutual assistance.
Racism - today usually referred to as racism and xenophobia - is a global phenomenon that deserves global attention and countermeasures. Two very important achievements and events should be mentioned here. The enactment of the UN-Convention CERD in 1965 and its related institutions, as well as the World Conference against racism in Durban, September 2001. The fact that the conference could be organised in a place where racial discrimination previously had been institutionalised, gives at least the impression that some progress has been made.
In post-war Europe, it seemed that racism could be mainly identified with pro-Nazi-attitudes and anti-Semitism. Today still many of the racist and xenophobic resentments come down to anti-Semitism, in particular nurtured by the ever-lasting conflict between Israel and the Palestinians. In fact, also other groups in Europe - not only during World War II - were victim of harmful acts of discrimination and they still are, like the Gypsies and homosexuals. During the last decades of the twentieth century, however, the growing flow of migrants from countries from outside Europe has created a new breeding ground for racial and xenophobic resentments towards a new group of easy victims. Migration became a big issue during the elections in some European Countries, resulting in a strong move to right-wing political parties.  Public attention for the issue of racial discrimination and xenophobia therefore has been revitalised and is broadened in scope. The concept of racism has not been changed, but the manifestations of this attitude are more evil and obtrusive than before.  Racist and xenophobic attitudes today are (more) manifest towards certain social groups. 
Statistics are - as usual - a complex matter, because it is not clear what to measure and what statistics can tell us here. The best one can say is that it comes down to counting the number of reported incidents, categorised according to subject matter or type of victim and possibly the medium involved. Where monitoring groups have been established this number is higher than in countries where no such groups exist. In general, victims rarely report cases to the police. From available statistical material it can be concluded that at least the volume of racist and xenophobic material is increasing seriously, in particular in connection with the Internet. The European Monitoring Centre on Racism and Discrimination further admits that it is even problematic to provide an overview of racial crimes of all fifteen EU-member states since not all those member-states distinguish racial crimes from other crimes, law enforcement authorities may not have the same priorities concerning the investigation and prosecution of such crimes, there is no common understanding of what crimes under the notion of racial crimes should be considered and further, most of the information is collected by NGO's, ethnic minorities or similar groups which makes it difficult to compare the results. The national reports anyway show a considerable and still growing number of serious incidents, from racist murder cases to other incidents. 
In these modern times, the Internet has become an indispensable and important means of communication. Also racists and racist groups have discovered the benefits of the Internet as well. Not surprisingly a strong increase of racist and xenophobic propaganda on the Internet has been reported. Actually, for racist groups the Internet is essential because:
Racist groups use the Internet in particular for:
On the other hand the Internet can be considered a very important facility to combat racial and other forms of discrimination as well, as a source of information and means of co-ordinating international action.
At the international level, the Council of Europe, as the organisation around the human rights treaty of Rome, has taken its responsibility concerning the combating of racism, discrimination and intolerance and has established a number of important organisations and activities, which involve monitoring developments, providing for statistical and other information, developing educational programs and other practical measures, including regulation.  Also in the frame of the European Union, since the Amsterdam Treaty, respect for human rights has become an essential aspect of legislative and other actions of the European institutions. 
Art. 14 of the Rome Convention (ECHR) prohibits discrimination where it would come to the denial of any of the human rights as formulated in the Convention. Although the article contains many factors on which discrimination can be based, the scope of the article was esteemed too narrow, because it may interfere with other (fundamental) rights that are not included in this Human Rights Convention. For this reason, recently the 12th Additional Protocol to the Convention was adopted and opened for signature.  The effect of the additional protocol is that any act of discrimination would constitute an unlawful interference with human rights. 
In connection with Article 14 of the ECHR the European Court of Human Rights states that not every distinction or difference of treatment amounts to discrimination. The Court held that: "a difference of treatment is discriminatory if it 'has no objective and reasonable justification', that is, if it does not pursue a 'legitimate aim' or if there is not a 'reasonable relationship of proportionality between the means employed and the aim sought to be realised'". 
Further, the Human Rights Court deals with the question of whether prohibitions of racist propaganda by a State Party are in line with article 10 ECHR concerning freedom of expression.  In general, the court recognises that freedom of expression constitutes one of the essential foundations of a democratic society. And further, the Court states that information and ideas that offend, shock or disturb the State are in principle protected by article 10 (Handyside case ). In the Wingrove case  the Court stated that "No restriction on freedom of expression, whether in the context of religious beliefs or in any other, can be compatible with Article 10 unless it satisfies, inter alia, the test of necessity as required by the second paragraph of that Article.
In the Jersild judgement  the Court took into account that audio-visual media may have a greater impact than the traditional paper media. Where the rights of others are concerned the exercise of freedom of expression brings duties and responsibilities. Further, the Court found that the form in which information and ideas are disseminated might be protected under article 10 ECHR. 
In applying article 10 ECHR the Court examines whether the measure taken is necessary in a democratic society (involves the proportionality test) for a legitimate aim - as enumerated in paragraph 2 of article 10 ECHR - if the prohibition is regulated clearly and thus foreseeable. The Court accepts a certain margin of appreciation for the Member Sates in order to justify diversities in cultural and societal values between the State Parties. From the case law of the Court it can be concluded that prohibition by a State Party of the dissemination of all ideas based upon racism or xenophobia is not incompatible with the right to freedom of opinion and expression. Where racist and xenophobic issues were involved, freedom of expression only in a limited number of cases prevailed.
3.1 Criminal law
After this broad and general introduction I would like to limit the object of my address in two ways. The first limitation was already that I would deal only with the dissemination of racist and xenophobic acts in the Internet environment; the second limitation is that I will only deal with criminal repression of such acts.
Legislators may choose to enforce legal standards by means of criminal law. Criteria for criminalisation could be the harm of the conduct, the impact it has on society as a whole and the need for effective means of investigation. Further, criminal law may be applied because of the available sanctions and measures (imprisonment!). Since criminal provisions should be clear and precise because of the lex certa principle, criminalisation of certain conduct may not be indicated. These criteria, if accepted in all European States at all, have lead to a patchwork of national criminal provisions, different in scope and content. Racial and xenophobic discrimination is no exception to that rule.
In the frame of the Council of Europe the First Additional Protocol concerning criminalisation of Racist and Xenophobic propaganda over the Internet  is about to be enacted. Prior to the Protocol, the Council of Europe enacted the legal instrument of the Cybercrime Convention of which the First Additional Protocol is meant to become part of.  The protocol will be discussed first. The Cybercrime Convention and the relation to the protocol will be discussed thereafter.
3.2 Origin of the Protocol
During the negotiations around the Cyber Crime Convention, Parties were highly divided whether the Convention should contain a criminalisation of the dissemination of racist and xenophobic material in computer networks. In Europe the general opinion is that art. 10 ECHR in principle allows for the application of criminal law in these matters under the circumstances given in section 2 of the Article. The extent to which criminal law should be applied, however, is left to the appreciation of the individual member state and is very much related to the way freedom of expression is given shape in the Constitution or other regulation of that Party. Other non-European Parties, such as the USA, for that reason are even not able to criminalise if the conduct does not imply an immanent threat or violence. This diversity is very well reflected in the number and nature of reservations to the CERD-Convention of 1965 , of which the ratifying parties so far withdrew none. Therefore, it was decided to take more time and develop a separate instrument in the form of the first additional Protocol that would allow Parties to a separate decision to sign the Convention and the Protocol or only the Convention.
The Protocol was negotiated from the end of 2001 until April 2001. The text was adopted by the CDPC  in June 2002 and was discussed by the Parliamentary Assembly of the Council of Europe in last September. The Assembly has the right to propose amendments to the text, and it did. Those amendments were discussed in the meeting of the Ambassadors in their meeting of October 16 and rejected. The text of the Protocol is now ready for adoption by the Committee of Ministers, the highest institution of the Council of Europe, in the coming meeting of November 6 and 7 2002 in Strasbourg. The Protocol will be open for signature in January 2002 at the earliest. The Protocol, of course, can only be signed by parties to the Cybercrime Convention.
3.3 Meaning of the Protocol
The Protocol is intended to amend Chapter II of the Cyber Crime Convention, which contains a number of cyber crimes offences. The Convention discerns four types of such crimes: c.i.a-offences (directed against computer systems and their content); computer-related crimes (computer system is instrument); intellectual property crimes; and content-related crimes (computer system is the environment of the crime). In the latter category one finds the production and dissemination of child porn (art. 9). The dissemination of racist and xenophobic expressions fits in the latter category. For other content-related offences the development of other additional protocols is possible, such as harmonised offences concerning illegal gambling or offering of medicaments without medical prescription.
The protocol determines which racist and xenophobic acts have to be criminalised by the State Party involved. Thereto it defines a number of offences that will be discussed below. The protocol also - and that is a key function - makes the procedural investigative measures as well as the instruments for international co-operation available to the investigation of the racist and xenophobic offences as defined in the protocol. By harmonising the criminalisation of racist and xenophobic acts the condition of dual criminality - still the usual condition for mutual assistance - is fulfilled.
3.4 Content of the Protocol
3.4.3 Definition of propaganda material
Racist or xenophobic material in this definition is not restricted to writings or documents. It may include any carrier containing data by which thoughts and theories are expressed. The material thereto may consist of text, images, sound, multimedia (including video games) or other formats. The definition does not say that the material must be directly processable by a computer system but this follows from the individual offences which all contain the wordings computer system.  The definition does not require that the content of the material should be directly accessible (e.g. readable).
Under the definition is comprised propaganda material that propagates certain behaviour. Given the detestable nature of the theories and thoughts, seemingly neutral 'advocating' is included under 'propagation,' where 'incitement' as a well-known criminal notion represents the most serious category. The behaviour that is propagated is to be distinguished in hatred (feelings), discrimination (attitude) and violence (acts). The Protocol puts those notions together on a scale of intensity or seriousness. The victims of such propagation can be an individual person or a group of persons. Legal persons are in principle not envisaged here. The subjective factors upon which the hatred, discrimination and violence are based are enumerated in the definition. It should be borne in mind that those factors have a subjective nature and may not correspond with objective definitions or the facts of the case. Only a selected number of those subjective criteria have been taken up in the definition. These notions nevertheless should be given a broad interpretation. Other notions, if included in the definition, would lead to unjustified criminalisation (over-criminalisation). Religion has therefore been taken up but in a qualified form where other notions like e.g. language are left out because this is not a factor that under all or most circumstances would lead to criminal conduct.
In particular concerning discrimination many other factors have left out such as age, gender, sexual preferences etc. because in that area most parties will not deal with such conduct in criminal law. The definition intends to draw a line between conduct that is illegal but not criminal and conduct that should be criminally sanctioned.
Art. 3 criminalises the distributing or otherwise making available to the public through a computer system of material as defined by art. 2. In the following articles three notions have been incorporated that were applied in the Cyber Crime Convention and that should be interpreted in the same manner as in the frame of the Cyber Crime Convention.  The notion 'without right' means that the conduct is illegal and is not justified. The term 'right' refers to any positive authority or absence of criminal liability. The precise meaning has to be determined by the implementing Party. All the offences require that the conduct is committed intentionally. Likewise as in the Cyber Crime Convention the interpretation of intent necessarily is left to State Parties , and therefore may include dolis eventualis. Further a computer system is defined in art. 1 under a of the Cyber Crime Convention. This article does not intend to provide for a precise legal definition of such systems but is mainly intended to indicate that a computer system can consist of a stand-alone system (from PC to mainframe) of a computer network (physical or virtual). E.g. the Internet is a computer system in the sense of the definition of art. 1 CCC. 
The production and mere possession of racist and xenophobic material is not criminalised. It is also not illegal to procure oneself with such material, e.g. by downloading from a particular web site. Distribution or otherwise making available private communications, (e.g. by e-mail) as long the effect of such communication is not that the material is sent to multiple receivers. Posting the material in a newsgroup or in a Chat-session has to be considered as distribution or making available to the public. 
Para 2 of Article 3 provides for restricted reservation possibilities. Para 2 sees in particular to those countries where the dissemination of any discriminatory material is not criminalised but nevertheless is restrained on the basis of administrative and civil law, provided that there are adequate sanctions and remedies.
In addition para 3 allows a partial reservation for those countries where constitutional or other fundamental rules concerning freedom of expression would stand in the way to criminaling the dissemination of discriminatory material. 
Art. 4 deals with racist and xenophobic motivated threats against individuals or groups of individuals. The threat must involve the commission of a serious crime. It is left to the implementing Party to define a serious crime. Not all crimes are appropriate to make part of a threat, seriousness often is related to the level of the maximum penalty, and sometimes certain types are appointed as serious crimes when committed in association or under aggravating circumstances. Any attempt to harmonise here would only lead to a shallow common result and should therefore be left to the discretion of the individual State Parties. In general, it may be expected that threats are covered by existing law. The presence of this article in the Protocol invites the State Parties anyway to criminalise threats motivated by racial and xenophobic considerations or, maybe, consider racial and xenophobic motivation as aggravating circumstances. 
Art. 5 deals with racist and xenophobic motivated insults through a computer system. In the frame of the article insulting means causing prejudice to the honour or dignity of a person. The expression therefore needs to be offensive, contemptuous or invective.  The insult must be done in public. i.e not as a part of a private or confidential e-mail communication. Since not all State Parties would like to criminalise all aspects of the conduct, in particular in relation to discrimination, a limited reservation is possible.
Art. 6 deals with the denial or gross minimisation of acts of genocide or crimes against humanity as defined in the relevant UN-instruments. This behaviour is assumed to be deeply insulting to victims, their relatives or other survivors of such crimes. State Parties that included such a provision in their law do not yet refer to the general notions of genocide or crimes against humanity but to the holocaust. Given the fact that genocide and crimes against humanity motivated by racism and xenophobia have and are being committed after W.W. II, the provision was given a more general structure. It is important that the facts of genocide or crimes against humanity have been established by independent scientific or equivalent research. It was thought that there should be reference to the international court dealing with the prosecution of such crimes as being the proper body to establish the criminal facts submitted to its jurisdiction. In order to avoid international disputes the requirement is that the State Party that has implemented article 6 in its national law has recognised the jurisdiction of the international court. Of course, it is not contrary to article 6 if the State Party would not raise such a condition or refers to other sources of independent research provided that no contradiction occurs with the scope and drift of article 6. In the article it is still explicitly referred to the Nuremberg Tribunal because for the time being in most cases it will still concern denial or gross minimisation of the holocaust. The article provides for a limited reservation possibility. The provision is in line with a prior decision of the Human Rights Court that denial or revision of clearly established historical facts - such as the Holocaust - should not be protected under the freedom of expression of art. 10 ECHR. 
At this point I allow myself some observations on Jones v. Toben in the light of article 6. Actually, the RDA does not contain a specific provision like art. 6. Therefore the motive to insult and its likely effect have to be established. Under art. 6 Prot. this not necessary since this is implicit. The case concerned publication of material on a web site denying or minimising the holocaust. I cannot comment on procedural issues or relationships between different Australian Statutes. It should also be taken into account that Jones v. Toben is a civil case because the Racial Discrimination Act does not provide for criminal prosecution and sanctions. Important is that the Federal Court accepted that a complaint could also be filed by a person or institution who is not directly a victim but who has interest that the standards of the RDA are maintained.  Under criminal law this would not be different, because anybody who is aware of a crime is entitled the report the crime to the police of the prosecution service, unless the law determines that prosecution is only possible on complaint of the victim. This usually is not the case with racist and xenophobic crimes.
Some of the observations of the court are related to the nature of the factors in the definition of article 18C RDA. Here Jews are being considered as a group with a common ethnic origin. As defended supra with regard to article 2 Prot. - factors on which discrimination is based should not be understood as scientific terms but as subjective criteria in the mind of the offender. Questions of whether the tortuous act is directed against Jewish people as a race or as a group with a common ethnic origin therefore become less relevant .
The court also examines whether it is reasonably likely that the material in question is offensive, insulting, humiliating or intimidating (see paragraphs 82 ff). It should be stressed that most European criminal laws would not require such conditions to be fulfilled, but I assume that this is a matter of common law principles that requires that mens rea has to be demonstrated, as is also foreseen in the reservation possibility for the article under its paragraph 2.  Under most European continental criminal law systems these effects or intent need not be demonstrated although it may have to be established that the conduct was intentional and without right, i.e. without any legal justification. Such could be the case e.g. in the course of a scientific debate on the basis of newly discovered evidence. In most denial cases, however, the material is presented as being scientific but in fact never meets the relevant standards. Similar considerations can be found in Jones v Toben (see paragraph 101 ff) on the basis of section 18 D RDA, in particular if the publication is done in good faith. The court states that as section 18(1) of the RDA requires that the publication was reasonably likely to offend and that the publication was done in order to offend (par 83 ff) it is not necessary that a particular individual person is offended or insulted by the denial. It is the same in article 6 of the Protocol.
Para 72 ff refers to art. 18C(2) RDA and specifies that an act is not done in private if it a) causes words, sounds, images or writing to be communicated to the public. I have no knowledge of the understanding of the notion 'communication to the public', but I assume that this condition easily can be fulfilled in relation with the WWW. On the Internet, it is in fact the receiver of certain data who takes the initiative that certain data are being communicated to him, but the intentional offering of such information by the defendant is a conditio sine qua non for it to happen. The outcome is the same as 'communication to the public' in relation to traditional mass media and therefore can be considered to be subsumed under that term with reference to the adagium that the on-line rules in principle should not differ from off-line rules.
One final remark on the obligation of the respondent to be restrained from the publication of ii) any other material with substantially similar content; and iii) any other material which conveys the following imputations or any of them. Such a measure would under European law possibly fail the necessity test under art. 10, para 2 ECHR, if it would not become clear that the defendant would continue to publish the same material in a different way or at a different time. The same goes for the restraining order for other future material that would contain statements as presented in the verdict. Since the conduct is to be criminalised, direct and effective measures with adequately prevent similar future publications by the defendant or other persons.
A last remark on the Protocol: Article 7 can include the intentional aiding and abetting to the crimes defined in article 3-6. State Parties may individually determine that attempts to commit one of the offences is also punishable.  Thus, service providers may be liable for the hosting of criminal content if they would intentionally aid or abet the crime. In this respect the Cybercrime Convention does not contain specific rules of criminal liability for (Internet) service providers. The reasons are the (civil) rules laid down under the European E-commerce Directive that prevented the adoption of specific (other) criminal liability rules or relating obligations under the Convention. 
4.1 Aims of the Cybercrime Convention
The development of the Cyber Crime Convention serves four different aims:
4.2 Substantive law issues
Cyber crime offences are distinguished in four categories:
The offences will not be discussed here.
4.3 Procedural issues
4.3.2 Measures concerning the gathering of stored computer data
Article 19 of the Convention stipulates that computer data may be searched and possibly seized if necessary to serve as evidence. Seizure would usually come down to making a copy of the data under such circumstances that the integrity of the copy can be established. A number of additional measures must ensure the accessibility of such data, like the obligation to provide access to the location and to the content of the data sought. If appropriate, the authority extends to the removal or blocking of the data, e.g. where it would amount to a criminal act or give rise to a criminal act if the information was left in place. In case of racist propaganda art. 19 would provide for the authority to remove the material from the computer system of the suspect.
Article 19 does not regulate how physical access can be obtained to a computer system. Domestic law will provide for the classical authorities to search premises and thereby obtain access to or control over a computer system. Paragraph 2 empowers law enforcement authorities to do investigations in connected computer systems, provided that the access to the other system has been authorised to the user whose system is under investigation.
If it is clear what specific data are needed for a criminal investigation and under the control of which person- not being the suspect- the data are, the person concerned may be ordered to produce the data. Article 18 provides for such authority. Any effort to select the data may be required. The power does not extend to the elaboration of data held by the person concerned such as applying data mining of files or data bases in order to provide the required information. The power is essential to obtain information from service providers about technical addresses and subscriber information (see hereafter).
4.3.3 Flowing data
4.3.4 Preliminary measures
4.4 International co-operation
The Cybercrime Convention supplements the existing instruments for mutual assistance. It makes the measures of the procedural part available for mutual assistance. If no mutual assistance instrument is in place between Parties the Cybercrime Convention itself provides the legal basis for co-operation. Art. 35 requires that a 24/7 network be established in order to facilitate expedited mutual assistance.
The Cybercrime Convention also reflects the present thinking about international law and jurisdiction. Art. 32 stipulates the cases in which national criminal investigations may have effect in the territory of another Party. Transborder investigations are allowed when it concerns publicly available information (e.g. on a web-site) or when a person voluntarily consents to access information stored in another country. Under circumstances, execution of art 18 may have legitimate transborder effects, when the ordered person is under the jurisdiction of one Party and the ordered data under control of that person are located in another Party. The search under article 19 of data in a computer network cannot be extended to systems located in the jurisdiction of other countries. In such cases mutual assistance has to be sought, if appropriate, on an expedited basis.
4.5 Framework nature
Because of what can be called "technological turbulence", fast and unpredictable development of new technologies and its applications, it is unlikely that the Cybercrime Convention is able to catch up with future developments without adaptation. Thereto is foreseen is a flexible way of amending the Convention by means of additional Protocols in periodical consultation of the Parties to the Convention (article 46). The first meeting of the Parties is foreseen in 2004, when the Convention will be in force anyway and when it is useful to exchange and discuss information on the implementation of the Convention in the national laws. Another important issue is that reservations will be subject to regular review. The Secretary-general will periodically invite Parties that made use of reservations to motivate why the reservation should remain in place (article 43, para 3).
1. The author is Director of the Computer/Law Institute, Vrije Universiteit Amsterdam the Netherlands. He chaired the expert committees of the Council of Europe that drafted the Cyber Crime Convention and its first additional Protocol on Racism and Xenophobia.
10. It should be stressed that the ECHR is in principle directed towards the State Parties that undertake obligations to respect the rights of their citizens. It is, however, accepted in most jurisdictions that the ECHR also affects horizontal relationships between citizens mutually.
© Human Rights and Equal Opportunity Commission, 2003. Feedback Welcome - email: email@example.com