Convention on Cybercrime (Budapest Convention)

One of the first international agreements concerning cybersecurity, the Convention on Cybercrime (Budapest Convention) addresses various facets of criminal activity in cyberspace, specifically around “computer-related…, content-related…, and copyright… related rights.” It mandates that parties enact laws restricting illegitimate access, interception, interference, and/or misuse of computer systems/data. Additionally, it requires parties to prohibit “computer-related forgery,” fraud, and the creation/dissemination/possession of child pornography. Finally, the convention requires that parties take actions to protect intellectual property rights, criminalizing infringement of copyright or related rights. Further punishments are attached to aiders and abettors of crimes mentioned above.

Budapest specifies that enforcement of the aforementioned prohibitions should be conducted in a manner consistent with “the adequate protection of human rights and liberties.” To that end, the convention specifies that parties must develop procedures empowering authorities to access computer data, either directly or from “service providers.” Similarly, authorities should be able to seize computer data, either virtually or physically, as well as be able to “collect… traffic data” in real-time. The convention directly ties these enforcement abilities to the territorial sovereignty of the parties, suggesting that they can only assume control over matters “in [their] territory [or] on board a ship [or aircraft] flying the flag of that Party.”

Internationally, the convention provides for cooperation between party states. Specifically, it identifies the criminal offences as basis for extradition under any preexisting agreement. Short of extradition, parties must assist one another in “investigations or proceedings”; this assistance may be spontaneous.