EU Directive helps the fight against crime

With the deadline now passed for the introduction of the EU’s directive to counter attacks against information systems, more types of cyber crime than ever before are now classed as illegal. 

Last September saw the deadline for the introduction of EU-wide rules to counter attacks against information systems.

The EU Directive on attacks against information systems will make illegal access, system interference and/or interception, criminal offences across the EU. Creators of ‘botnets’ and authors of malware can now also expect to face criminal sanctions for their actions. The European Agenda on Security lists cyber crime as one of the three top priorities for the current mandate of the European Commission in the field of security.

Cyber crime continues to figure prominently on the agenda of the commission. The two flagship strategies, the European Agenda on Security and the Digital Single Market Strategy, highlight the need to better address cyber threats that may also impact upon the EU’s commitment to the highest standards of privacy and data protection.

Cyber crimes create significant costs to the EU economy and as more services move online, these costs increase. The concerns of users about online safety have risen in recent years, as the most recent Eurobarometer on cyber security shows. According to the Eurobarometer, 85 per cent of internet users feel that the risk of becoming a victim of cyber crime is increasing. 73 per cent also state that they are concerned that their online personal information is not kept secure by websites. When using the internet for online banking or shopping, 42 per cent of users are worried about the security of online payments. Because of security concerns, 13 per cent of users suggested they were less likely to buy goods online and 12 per cent are less likely to bank online.

Rates of victimisation have also increased. 14 per cent of internet users have not been able to access online services because of cyber-attacks, 12 per cent have had their social media or email account hacked, and 16 per cent of internet users who buy online goods or services have experienced online fraud. Across the EU, 8 per cent of internet users have fallen victim to ransomware, malware that hijacks a device and is only removed through payment of a fee, 8 per cent say they have been a victim of credit card or banking fraud online while 7 per cent say they have experienced identity theft.

The directive enables a more effective response to this threat across the EU by harmonising criminal rules on attacks against information systems and introducing a new offence of creating tools used for committing offences, such as malware. It also reinforces cooperation between the judiciary and the police of member states, introducing the obligation for member states to make better use of the existing 24/7 network of contact points by treating urgent requests in a specified timeframe.

Speaking about the directive’s role in strengthening cyber security provisions the European Commissioner for Migration and Home Affairs, Dimitris Avramopoulos said: “Cyber criminals violate the fundamental rights of EU citizens and harm our economy. Users have a right to feel safe online, and perpetrators must not feel that they can act with impunity. We need to strengthen the trust in online services that is essential for the Digital Single Market. The implementation of the directive is a key step towards closer cooperation across the EU.”

 With this directive now enforced the EU’s plans for future initiatives include reviewing the applicable legal framework for specific offences such as fraud and counterfeiting of non-cash means of payments; analysing obstacles to criminal investigations on cyber crime, and rules on access to evidence and information, with a view to enabling a more effective law enforcement response.