Legislative Observatory
European Parliament
Please fill in this field to find a procedure

Fight against cybercrime

2017/2068(INI)

The European Parliament adopted by 603 votes to 27, with 39 abstentions, a resolution on the fight against cybercrime.

Background: Europol's assessment of the threat posed by organised crime on the Internet (IOCTA) of 28 September 2016 indicated that cybercrime (zombie networks and malware etc.) is increasing in intensity, complexity and scale. 80% of companies in Europe have experienced at least one cybersecurity incident.

Children are particularly vulnerable to the risk of being groomed by paedophiles and other forms of online sexual exploitation. A considerable number of cybercrimes remain unprosecuted and unpunished.

Given the cross-border nature of cybercrime as well as the common cybersecurity threats faced by the EU, Parliament called for enhanced cooperation and information exchange between police and judicial authorities and cybercrime experts is essential for conducting effective investigations in cyberspace and obtaining electronic evidence.

On a general level, Members suggested streamlining common definitions of cybercrime, while stressing that the fight against cybercrime should be first and foremost about safeguarding and hardening critical infrastructures, including, among others, energy and electricity supply and financial structures. They strongly condemned any system interference undertaken or directed by a foreign nation or its agents to disrupt the democratic process of another country.

Parliament also recommended:

  • adopting an action plan for the protection of children’s rights online and offline in cyberspace;
  • putting in place all the necessary legal measures to combat the phenomenon of online violence against women and cyberbullying;
  • giving Eurojust and Europol the means to improve the identification of victims and fight criminal networks of sexual offenders and accelerate the detection, analysis and reporting of child pornography material both online and offline;
  • ensure that illegal online content is removed immediately by legal means.

Prevention: in the context of EU's cybersecurity strategy review, the Commission is invited to:

  • identify network and information security vulnerabilities of European Critical Infrastructure, promote the development of resilient systems and assess the situation with regard to the fight against cybercrime in the Union and the Member States;
  • launch awareness-raising, information and prevention campaigns (with educational programmes) to ensure that all citizens, in particular children and other vulnerable users, but also central and local governments, and private sector actors, especially SMEs, are aware of the risks posed by cybercrime;
  • promote security measures such as encryption and anonymisation tools.

Member States should intensify the exchange of information, through Eurojust, Europol and ENISA, as well as best practice sharing via the European CSIRT (Cyber Security Incident Response Teams) and the CERTs (Computer Emergency Response Teams). They should also invest in education as a solution to the lack of qualified IT professionals working on cybersecurity.

Enhance the responsibility of service providers: Members called for closer cooperation between competent authorities and service providers to accelerate mutual legal assistance. Providers of electronic communications services established in a third country should designate in writing representatives in the Union.

In view of the growing accessibility of Internet of Things (IoT) devices, Members stated that attention must be paid to the safety of all devices and to promote the security by design approach. They stressed the need to protect law enforcement databases from security incidents and unlawful access. They also encouraged service providers to adhere to the Code of Conduct on Countering Illegal Hate Speech Online.

Member States are urged to set up CERTs to which businesses and consumers can report malicious emails and websites as foreseen by the network and information security Directive (NIS).

Strengthening police and judicial cooperation: Parliament stressed the need to allow law enforcement authorities to have lawful access to relevant information, in the limited circumstances where such access is necessary and proportionate for reasons of security and justice.

Member States should not to impose any obligation on encryption providers that would result in the weakening or compromising of the security of their networks or services, such as the creation or facilitation of ‘back doors’. Feasible solutions must be offered where finding them is imperative for justice and security.

According to Members, lawful interception can be a highly effective measure to combat unlawful hacking, on condition that it is necessary, proportionate, based on due legal process and in full compliance with fundamental rights and EU data protection law and case law.

Electronic evidence: Parliament called for a common European approach to criminal justice. It stressed the need to find means to secure and obtain e-evidence more rapidly, as well as the importance of close cooperation between law enforcement authorities, third countries and service providers active on European territory.

The Commission should propose a European legal framework for e-evidence including harmonised rules to determine the status of service providers, whether domestic or foreign, and oblige them to respond to requests from other Member States. This framework should provide for adequate safeguards concerning the rights and freedoms of all parties concerned.

Lastly, Parliament deplored the absence of binding international legislation on cybercrime and urged the Member States and the European institutions to work towards establishing a convention on the matter.