Another offence defined in Directive 2013/40 is illegal system interference, which consists of seriously hindering or interrupting the functioning of an information system by inputting computer data, by transmitting, damaging, deleting, impairing, altering, or suppressing such data, or by rendering such data inaccessible, intentionally and without right (Article 4 of Directive 2013/40). This mostly includes activities involving logic operations directed against information systems, with a view to hindering or disrupting system functions by affecting the processing of the computer data of the software used for the purpose.

Under Article 5 of Directive 2013/40, Member States are obliged to criminalise logical attacks directed against computer data. The provision identifies illegal data interference as deleting, damaging, impairing, altering, or suppressing computer data in an information system, or rendering such data inaccessible. Such interference includes both deleting data and installing software on the compromised computer, facilitating further illegal activities (e.g. data theft), or carrying out a DDoS attack (Distributed Denial of Service) by using malware to connect a compromised computer to a botnet.

The first "new" prohibited act (in relation to Framework Decision 2005/222) was illegal interception, defined in Article 6 of Directive 2013/40 as intercepting, by technical means, non-public transmissions of computer data to, from, or within, an information system, including electromagnetic emissions from an information system carrying such computer data, intentionally and without right.

Another type of offence, which was not provided for in Framework Decision 2005/222, is referred to in Article 7 of Directive 2013/40. Under the said provision, Member States are required to criminalise the intentional production, sale, procurement, importing, possession, and distribution, or otherwise making available, of tools (colloquially referred to as "hacking tools") used, without right, to commit any of the offences referred to in Articles 3 to 6 of Directive 2013/40, in which such acts are performed with the intention to commit the said offences.

"Tools" means

In line with Article 9(1) of Directive 2013/40, the offences referred to in the said Directive (including incitement, aiding and abetting, and attempting to commit offences under Articles 4 and 5—see Article 8(1) and (2)), should be punishable by effective, proportionate, and dissuasive, criminal penalties. At the same time, it is stipulated that the offences referred to in Articles 3 to 7 of Directive 2013/40 (which means that it does not apply to incitement, aiding and abetting, and attempting to commit offences) should be punishable by a maximum term of imprisonment of at least 2 years, at least for cases which do not involve a minor (Article 9(2)).

Furthermore, Article 9 of Directive 2013/40 provides for a number of aggravating circumstances. However, they only apply to offences listed in Articles 4 and 5 (i. e. illegal system interference and illegal data interference). The first aggravating circumstance includes a situation in which a significant number of information systems have been affected through the use of a tool, referred to in Article 7 of Directive 2013/40, designed or adapted primarily for that purpose. In such an event, the perpetrator should be sentenced to a maximum term of imprisonment of at least 3 years (Article 9(3) of Directive 2013/40).

Under Article 9(4) of Directive 2013/40, aggravating circumstances, resulting in the possibility of the perpetrator's being sentenced for a maximum sentence of imprisonment of at least 5 years, include the commitment of offences within the framework of a criminal organisation, as defined in Framework Decision 2008/841/ JHA of the 24th of October 2008 on the combating organised crime,47 causing serious damage, and the committing of an offence against a critical-infrastructure information system.48

47Framework Decision 2008/841/JHA of 24 October 2008 on the fight against organised crime, OJ EU 2008 L 300/42. Pursuant to Article 1(1) of the said Decision, "criminal organisation" means a structured association, established over a period of time, of more than two persons acting in concert with a view to committing offences which are punishable by deprivation of liberty or a detention order of a maximum of at least four years, or a more serious penalty, to obtain, directly or indirectly, financial or other material benefit. "Structured Association" means an association which was not randomly formed for the immediate committing of an offence, nor does it need to have formally defined roles for its members, continuity of membership, or a developed structure (Article 1(2) of Framework Decision 2008/841). A solution similar to the one stipulated in Framework Decision 2005/222 was adopted in Directive 2013/40, under which the penalty provided in Framework Decision 2008/841 was not taken into consideration when establishing whether a given structured association can be considered a criminal organisation.

48Under Article 2(a) of Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures, and the assessment of the need to improve their protection, OJ EU 2008 L 345/75, the term critical infrastructure means an asset, system, or part thereof, located in Member States, which is essential for the maintenance of vital societal functions, and the health, safety, security, economic, or social well-being of people, and the disruption or

The last aggravating circumstance affecting penal liability (Article 9(5)) is a situation in which the offences referred to in Articles 4 and 5 are committed by misusing the personal data of another person (identity theft).49

The Directive was criticised for the failure to provide severe sanctions, especially in relation to acts, which can be classified as terrorist attacks against IT systems. This reservation can currently be considered outdated. Discussing the issue of making more stringent the penal liability of a perpetrator accused of an offence of a terrorist nature, one should take into account the legal regulations laid down in Directive 2017/541. Pursuant to point (i) of Article 3(1), in conjunction with Article 3(2) of the said Directive (see remarks above), illegal system interference as referred to in Article 4 of the Directive in cases in which Article 9(3) or points (b) or (c) of Article 9(4) of that Directive applies, and illegal data interference as referred to in Article 5 of that Directive, in cases in which point (c) of Article 9(4) of that Directive applies, constitute a terrorist offence. This means that terrorist offences should include acts involving illegal system interference committed with one of the aims listed in Article 3(2) of Directive 2017/541, with the use of one of the tools referred to in Article 7 of Directive 2013/40, designed or adapted primarily for that purpose, in which a significant number of information systems have been intentionally affected, or in which substantial damage has been inflicted. In addition, an unlawful act under Article 5 should be considered a terrorist offence if it has been directed against a critical-infrastructure information system.50

#### References

Adamski A (2000) Prawo karne komputerowe, Warsaw

Brenner SW (2010) Criminal threats from cyberspace crime, media, and popular culture. Preager Chałubińska-Jentkiewicz K (2019) Cyberodpowiedzialność. Toruń

Clough J (2013) Principles of cybercrime. Cambridge University Press, New York

Czechowski R Sienkiewicz P (1993) Przestępcze oblicza komputerów, Warsaw

Dudka K (1998) Kontrola korespondencji i podsłuch w polskim procesie karnym, Lublin

Fischer B (2000) Przestępstwa komputerowe i ochrona informacji, Kraków

Hołyst B (2009) Internet jako miejsce popełnienia przestępstwa, Prokuratura i Prawo, 4

Grabosky P (2006) Electronic crime. Pearson Prentice Hall, Upper Saddle River

destruction of which would have a significant impact in a Member State as a result of the failure to maintain those functions.

49See more Radoniewicz (2018), pp. 111–121.

50Cf. Radoniewicz (2016), pp. 267–268. For more details about combating cyberterrorism in UE, see Radoniewicz (2019b), pp. 193–205.

Wójcik JW (1999) Przestępstwa komputerowe. Część I. Fenomen cywilizacji, Warsaw

Filip Radoniewicz PhD; legal advisor; adjunct in the Department of Cybersecurity Law and New Technologies at the Institute of Law, War Studies University, Warsaw; expert at the Academic Centre for Cybersecurity Policy, (War Studies University) and in the Ministry of Justice; he worked as an assistant judge (in the Fourth Criminal and Sixth Penitentiary Department of the Regional Court in Lublin); graduate of post-graduate studies: "European Union Law" at the Jagiellonian University, "Human Rights and Freedoms", co-organized by the Institute of Legal Sciences of the Polish Academy of Sciences and the Helsinki Foundation for Human Rights, and "Computer Network Administration" at the Lublin University of Technology; author or co-author of approximately fifty publications, mainly in the field of broadly understood criminal law, new technology law and human rights. Selected publications: F. Radoniewicz (2016) Odpowiedzialność karna za hacking i inne przestępstwa przeciwko danym komputerowym i systemom informatycznym/Criminal liability for hacking and other offences against computer data and information systems/, Wolters Kluwer, Warszawa; Ustawa o krajowym systemie cyberbezpieczeństwa. Komentarz /Act on the National Cybersecurity System. Commentary/ (2019) ed. W. Kitler, J. Taczkowska-Olszewska, F. Radoniewicz, CH. Beck, Warszawa.

Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

## International Regulations of Cybersecurity

#### Filip Radoniewicz

Abstract There is no doubt that, due to the global nature of modern ICT networks, international cooperation plays a key role in ensuring cybersecurity, including in the fight against cybercrime.

This chapter describes initiatives taken within international organizations to ensure cybersecurity and the prevention of cybercrime. The presentation will start with the initiatives of the OECD and the Council of Europe. This is due not only to some kind of "Eurocentrism" but above all to the fact that these two organisations were the first to address cybersecurity and cybercrime issues. In addition, the Council of Europe Convention 185 on CyberCrime of November the 23rd, 2001, an international agreement concluded in the Council of Europe, is a milestone in the prevention of computer crime, remaining the only binding act of international law to combat it. Its importance is best demonstrated by the constantly growing number of signatories (and countries that model without signatures after the provisions, e.g. Pakistan) and the fact that international organisations, or recommend that their members accept (UN, G7/G8, European Union) or "copy" provisions, creating their own model legal acts (e.g. Commonwealth).

#### 1 General Remarks

Given the global character of modern tele-information systems, international cooperation undoubtedly plays an instrumental role in ensuring cybersecurity and combating cybercrime. Therefore, efforts to establish legal frameworks of the interstate cooperation aimed at ensuring computer data and information system security have been made on the international arena since tele-information became supranational. It should be stressed that, for any cybersecurity-oriented measures to be effective,

Akademickie Centrum Polityki Cyberbezpieczeństwa/Academic Center for Cybersecurity Policy, Akademia Sztuki Wojennej w Warszawie/War Studies University in Warsaw, Warsaw, Poland

e-mail<EMAIL_ADDRESS>
F. Radoniewicz (\*)

international cooperation must be pursued not only at the national level, but it must also involve private entities, representatives of the IT industry, and including in particular Internet service providers.

Initiatives launched by international organisations to ensure cybersecurity and to combat cybercrime are outlined below, starting with those devised by OECD and the Council of Europe. This line of presentation was motivated not only by the Eurocentric approach, but also by the fact that these two organizations had been the first to deal with cybersecurity and cybercrime issues. Furthermore, Convention on Cybercrime No. 185 of the Council of Europe of the 23rd of November 2001,1 being an international treaty drawn up within the Council of Europe, was a milestone in the field of combating computer crime. It has also served a binding international legal act adopted with this objective in mind. Its importance is best reflected in the still growing number of signatories (as well as non-signatories, which otherwise commit to follow its provisions, e.g. Pakistan) and in the fact that international organizations either recommend their members to adopt the Convention (the UN, G7/G8, the European Union) or "map" its content when drawing up their own governing agreements (e.g. The Commonwealth of Nations).2

#### 2 Organisation for Economic-Cooperation and Development

Recommendation C (92)1883 was the first document on cybercrime within the Organisation for Economic-Cooperation and Development (French: Organisation de coopération et de développement economiques, abbreviated as OECD), adopted on the 26th of November 1992 by the OECD Council. In 2000, following its revision, it was deemed indispensable to draw up entirely new guidelines.4 Work that was launched to this end took on momentum after 9/11, and eventually resulted in the formulation of the Recommendation of the Council Concerning Guidelines for the Security of Information Systems and Networks—Towards a Culture of Security,5 which replaced Recommendation C(92)188. For nearly 13 years, it was the landmark OECD legal act dealing with widely understood computer network security. It drew attention to the increasing role of, and the fact that national economies, international trade, as well as social, cultural and political life are becoming

1 https://www.coe.int/en/web/conventions/full-list/-/conventions/treaty/185, Accessed on 1 September 2020.

2 Cf. Chałubińska-Jentkiewicz (2019), pp. 261–262.

3 Recommendation of the Council concerning Guidelines for the Security of Information Systems of 26 November 1992 (C(92)188/FINAL).

4 Gercke (2011), Accessed on 1 September 2020.

5 Recommendation of the Council Concerning Guidelines for the Security of Information Systems and Networks—Towards a Culture of Security of 25 July 2002, (C (2002) 131).

increasingly dependent on information systems and networks, which should prompt efforts to protect and foster confidence in such systems and networks. At the same time, as was also stressed in the Recommendation, information systems and networks, as well as data stored on, or transmitted over, such systems and networks, are subject to new and increasing threats (various types of unauthorized access, use or alteration, malicious code transmissions, and mass denial-of-service attacks affecting a significant number of computers and paralyzing tele-information systems). In consequence, governments of Member States were advised, in particular, to develop new or revise existing policies, practices, measures and procedures based on the Guidelines attached to Recommendation C(2002)131, and at the same time to promote a culture of security as set out in these Guidelines among all concerned parties (which are understood as including all entities which develop, own and use information systems and networks, and which provide related services, i.e. governments, enterprises, other organizations and individual users). Given the technological progress, work to revise the Guidelines commenced in 2012 and resulted in adopting, on the 17th of September 2015, the Recommendation of the Council on Digital Security Risk Management for Economic and Social Prosperity (C(2015)115).6 It was stressed in the Recommendation that the global interconnectedness has created considerable opportunities, but the risks emerging throughout its development are becoming more common and refined, and may affect the functioning of both the public and private sectors. The problem should, therefore, be now approached from a bigger perspective, one that is not limited to technological aspects. For this reason, the terms "cybersecurity" and "cyberspace" were abandoned in the Recommendation, and broader terms, "digital security risk" and "digital environment", were used instead. The Recommendation clearly stated that governments and private enterprises should share responsibility for combating digital security risks. It laid down the principles of digital security risk management to be followed by all concerned parties (governments, public and private organizations, as well as natural persons whose social or economic activities are pursued, whether in whole or in part, in the digital environment), along with guidelines for national strategies to ensure digital security, the implementation of which should be advocated by governments. These strategies are expected to present a clear and 'whole-of-government' approach, which should be flexible, technology-neutral and coherent with other strategies fostering economic and social prosperity. It should also cover best practices for the public sector, large, medium-sized and small enterprises, and individual citizens.7

Among other OECD guidelines related to widely understood information technologies, the following are worth noting:

6 Recommendation of the Council on Digital Security Risk Management for Economic and Social Prosperity of 17 September 2015 (C(2015)115).

7 See more in Radoniewicz (2016), pp. 152–156.

To sum up OECD's activities in the field of regulations on new technologies, it should be stressed that, although the Organization was first to implement measures aimed at combating cybercrime, its major interest is now limited to cybersecurity.13

#### 3 Council of Europe

A discussion on the Council of Europe activities in the field of cybersecurity and combating cybercrime should start with Recommendation No. R(89)9 on Computer-Related Crime, adopted by the Committee of Ministers of the Council of Europe on the 13th of September 1989.14 The document required Member States to take into account, in the course of legislative work on regulations directed at eliminating computer crime, the proposed solutions included in the report attached to it.15

8 Recommendation of the Council concerning Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data of 23 September 1980 (C(80)58(final).

9 Recommendation of the Council on Cross-border Co-operation in the Enforcement of Laws Protecting Privacy of 12 December 2007 (C (2007) 67 (final).

10Recommendation of the Council on Cross-Border Co-operation in the Enforcement of Laws against Spam of 13 April 2006 (C(2006) 57).

11Recommendation of the Council on Protection of Critical Information Infrastructures of 30 April 2008 (C(2008)35).

12See more Radoniewicz (2019).

13S. Schjølberg, The History of Global Harmonization on Cybercrime Legislation – The Road to Geneva, http://www.cybercrimelaw.net, accessed on 10 October 2020, p. 17.

14Recommendation No. R(89)9 on Computer-Related Crime.

15See more in Radoniewicz (2016), pp. 158–160.

The aforementioned Convention on Cybercrime was the first, and only, international treaty on crimes committed via the Internet and other computer networks.

Work on the Convention, which took over 4 years to complete, was carried out with the participation of not only representatives of most Member States of the Council of Europe (including Poland) but also by U.S., Japanese and Canadian delegates (as observers), representatives of European institutions, and independent experts. Its main objective was to develop a legal framework to facilitate international crime prosecution. It proposed a range of solutions, which were innovative (at least at that time, given that the Convention was drawn up at the end of the previous century). Compared to some earlier documents adopted at the international level, it featured an extended list of criminal offences (including illegal access, illegal interception, system interference, acts involving hacking tools, computerrelated forgery, computer-related fraud, offences related to child pornography,16 and offences related to infringements of copyright and related rights). Furthermore, it contained provisions on recognizing criminal liability depending on the stage of commitment, as well as aiding and abetting, and provisions on corporate liability (including also the liability of organizations without a legal personality). Several procedural solutions were also envisaged, including the preservation of data, search and seizure of stored computer data, real-time collection of traffic data, and the like.17

The obvious advantages of the Convention on Cybercrime include its open character, with countries not belonging to the Council of Europe being allowed to accede, and the fact that it contains optional clauses. The latter enable the Convention to be adopted with the exclusion of certain provisions, as a result of which on implementing the Convention the signatory countries, within their national laws, can reconcile the solutions it envisages with their own legal culture and tradition, and with the regulations already in force within their respective jurisdictions.18 Considering the above, by the first of January 2021, the Convention on Cybercrime had been signed by almost all Council of Europe Member States (more specifically, by 46 countries, with Russia being the only exception), and 44 of these had ratified it. Furthermore, the Convention was signed by 4 countries from outside Europe (Canada, Japan, the United States, and the Republic of South Africa, and the first three have already ratified it). Other 18 states (i.a., Australia, the Dominican Republic, Israel, Panama) acceded to it. It is also worth noting that several countries, including Egypt and Pakistan, while not signing the Convention on Cybercrime, used its provisions as a basis when developing their own domestic regulations.

16The Convention on Cybercrime only refers to one group in this category—offences related to child pornography. Initially, it was meant to additionally include offences driven by racism or xenophobia. Eventually, these were included in a separate Additional Protocol to the Convention on Cybercrime regarding the criminalisation of acts of a racist and xenophobic nature committed through computer systems of 28 January 2003. See further comments.

17Cf. Adamski (2001), pp. 9–11; Radoniewicz (2016), pp. 162–164; Tarnogórski (2009), pp. 207–210.

18Cf. Adamski (2001), pp. 9–17.

The Convention on Cybercrime entered into force on 1 July 2004 after it had already been ratified by five signatory countries. Although Poland was one of the first countries to sign the Convention (on 23 November 2001), it did not ratify its provisions until the 29th of January 2015. To date, two amendments have been made to the Criminal Code with a view to adjusting its content to the provisions of the Convention.19

The aforementioned Additional Protocol of 28 January 2003 to the Convention on Cybercrime20 regarding the penalisation of offences motivated by racism or xenophobia, committed using computer systems (hereinafter the Protocol),21 is the only binding international law act developed within the Council of Europe which deals with the issues of crimes motivated by racism or xenophobia.

The fact that the provisions on crimes motivated by racism and xenophobia were included in a separate protocol, and not in the Convention on Cybercrime, resulted from the dissenting views expressed by delegates of the countries involved in its creation. Differences in the constitutional standards of free speech in individual countries substantially hindered a common standpoint. As a result, in order not to delay work on the Convention, it was decided that the provisions regarding such matters be included in a separate act.22

19Act of 18 March 2004 on amending the Criminal Code, the Code of Criminal Proceedings and the Code of Offences, Polish Journal of Laws No. 69, item 626 and the Act of 24 October 2008 on amending the Criminal Code and certain other acts, Polish Journal of Laws No. 214, item 1344.

20Convention on Cybercrime of the Council of Europe of 23 November 2001 (https://www.coe.int/ en/web/conventions/full-list/-/conventions/treaty/185 Accessed on 1 September 2020).

21Protocol of 28 January 2003 to the Convention on Cybercrime https://rm.coe.int/168008160f, accessed 1.12.2020.

22Adamski (2001), p. 49.

The Protocol entered into force on 1 March 2006. In accordance with its Article 9 (1), it is open for signature by the states which have signed the Convention, which implies that it is also open to countries which are not members of the Council of Europe, both from Europe and outside of it. Such countries can accede to the Convention on Cybercrime provided that they participated in work on its development (as did the United States, Canada and Japan), or once they are invited to the Committee of Ministers or have obtained the consent from all the signatories.

Among other documents adopted by the Council of Europe, the subject-matter in question was also indirectly discussed in the following:

#### 4 Organisation for Security and co-Operation in Europe

Security of the data processed in computer systems has not formed the area of interest of the Organisation for Security and Co-operation in Europe (OSCE). However, this does not mean that cybersecurity issues are entirely neglected is OSCE activities. Examples testifying to the contrary include four decisions by the Committee of Ministers: two on combating the use of the Internet for terrorist purposes,27 in which it was indicated that the use of the Internet by terrorist groups for such purposes as member recruitment, collection and transfer of funds, organisation of terrorist acts or propaganda, must be prevented. However, this must be

23Convention No. 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data, done at Strasbourg on 28 January 1981 (https://www.coe.int/en/web/data-protection/ convention108-and-protocol, accessed on 1.12.2020).

24Convention No. 201 on the Protection of Children against Sexual Exploitation and Sexual Abuse, done at Lanzarote on 25 October 2007 (https://rm.coe.int/1680084822 accessed on 1.12.2020).

25Recommendation CM/R(99)5 on the protection of privacy on the Internet of 23 February 1999 Recommendation Rec (99)5 on the Protection of Privacy on the Internet.

26Recommendation CM/R(2009)1 electronic democracy (e-democracy) of 18 February 2009 Recommendation CM/Rec(2009)1 on Electronic Democracy (e-Democracy).

27Ministerial Council Decision of 7 December 2004 No. 3/04 on combating the use of the Internet for terrorist purposes and Ministerial Council Decision of 7 December 2006 No. 7/06 on combating the use of the Internet for terrorist purposes.

done in observance of human rights, and in particular the right to privacy and the freedom of expression of opinions and views. This objective is to be facilitated by information exchange between the concerned parties and by establishing strategies for effectively combating this phenomenon. The other two decisions concern enhancing OSCE efforts to reduce the risks of conflict stemming from the use of information and communication technologies.28

#### 5 United Nations

First and foremost, it is worth noting that the United Nations initially attached importance mainly to preventing computer crime by referring to theoretical considerations and empirical studies conducted by criminologists in this field. In recent years, this approach has been changing gradually, as reflected in the so-called Salvador Declaration (see further comments).

Special attention to cybersecurity issues on the UN forum was paid for the first time at the Eighth United Nations Congress on the Prevention of Crime and the Treatment of Offenders, held from 27 August to 7 September 1990 in Havana (such congresses regarding the prevention of crime are organised by the UN every 5 years, recently—i.e. since the Congress in Bangkok in 2005—as Congresses on Crime Prevention and Criminal Justice), and at the Symposium on the Prevention and Prosecution of Computer Crime, organised by the Foundation for Responsible Computing, which was an event accompanying the Congress. The discussions held at the Congress led to the General Assembly of the United Nations adopting, on the 14th of December 1990 at the initiative of Canadian representatives, Resolution 45/121 on Combating the Criminal misuse of Information Technologies.29

As proposed by Hubbard and S. Schjølberg,30 the subsequent resolutions adopted by the General Assembly of the United Nations can be divided into the following groups:

1. Resolutions 53/70 of 3 December 1998, 54/49 of 1 December 1999, 55/28 of the 20th of November 2000, 56/19 of the 29th of November 2001, 57/53 of the 22nd of November 2002, 58/32 of the 18th of December 2003, 59/61 of the 3rd of December 2004, 60/45 of the 8th of December 2005, 61/54 of the 6th of December 2006, 62/17 of the 5th of December 2007, 63/37 of the 2nd of

28Decision No. 5/16 of 9 December 2016 on enhancing OSCE efforts to reduce the risks of conflict stemming from the use of information and communication technologies and Decision No. 5/17 of 8 December 2016 on enhancing OSCE efforts to reduce the risks of conflict stemming from the use of information and communication technologies.

29Cf. Adamski (2000), pp. 9–10; Sieber (1998), pp. 162–163.

30A.M. Hubbard, S. Schjølberg, Harmonizing national legal approaches on cybercrime, http:// www.itu.int/osg/spu/cybersecurity//docs/Background\_Paper\_Harmonizing\_National\_and\_Legal\_ Approaches\_on\_Cybercrime.pdf, p. 6; accessed on 10.10.2020.

December 2008, 64/25 of the 2nd of December 2009, 65/41 of the 8th of December 2010, 66/24 of the 2nd of December 2011, 67/27 of the 3rd of December 2012, 68/243 of the 27th of December 2013, 69/28 of the 2nd of December 2014, 70/237 of the 23rd of December 2015, 71/28 of the 5th of December 2016, 73/27 of the 5th of December 2018, of 73/266 of the 22nd of December 2018, 74/28 of the 12th of December 2019, and 74/29 of the 12th of December 2019—all referred to as Developments in the Field of Information and Telecommunications in the Context of International Security, which contain rather general provisions, indicating the threats which may be posed by advancing IT, and recommending that countries adopt the guidelines periodically formulated in the information security reports drawn up by the Group of Government Experts on Information Security;

At the aforementioned Eighth United Nations Congress, taking place in Havana in 1990, Resolution 45/121 on Combating the Criminal Misuse of Information Technologies was developed, together with the United Nations Manual on the

31Radoniewicz (2016), pp. 196–200.

Prevention and Control of Computer-Related Crime, which was published in 1994. In the declaration issued at the Tenth United Nations Congress on the Prevention of Crime and Treatment of Offenders in Vienna,32 which was annexed to Resolution 55/59 of the General Assembly of 4 December 2000, computer crime was referred to in a very general manner (in Point 18 which dealt, inter alia, with the planned policy for issuing guidelines on the prevention of this phenomenon). In the declaration entitled Synergies and Responses: Strategic Alliances in Crime Prevention and Criminal Justice, annexed to Resolution 60/177 of the General Assembly of 16 December 2005 "Follow-up to the Eleventh United Nations Congress on Crime Prevention and Criminal Justice", 33 ending the Eleventh Congress in Bangkok, attention was again paid to the significance of criminal law harmonisation, as a factor indispensable for the efficient fight with cybersecurity, and the instrumental roles of both by the UN and other international organisations were highlighted. In the so-called Salvador Declaration on Comprehensive Strategies for Global Challenges: Crime Prevention and Criminal Justice Systems and Their Development in a Changing World, adopted at the Twelfth United Nations Congress in Salvador (12–19 April 2010), as the document concluding the event (annexed to Resolution 65/230 of the General Assembly of 21 December 2010), a recommendation was made for the UN Commission on Crime Prevention and Criminal Justice (CCPCJ), in cooperation with Member States, representatives of international communities and private sector entities, to develop draft versions of new solutions, both at the national and international levels, in response to the threat posed by cybercrime. At the Thirteenth United Nations Congress, which took place on 11–19 April 2015 in Doha (Al-Dauha), Qatar, attention was focused on the issue of integrating crime prevention and criminal justice into the wider United Nations agenda to address social and economic challenges, and to promote the rule of law both at the national and international levels, also by involving society at large. As regards cybersecurity issues, the Congress participants once again stressed the need to take specific measures to establish a secure cyberspace. As regards preventing and combating Internet crime, emphasis was placed on such issues as identity theft, botnets, online recruitment for terrorist and human trafficking purposes, and the need to protect children. Furthermore, the significance of enhancing international cooperation as a condition precedent to ensuring cyberspace security was also stressed. The Doha Declaration on Integrating Crime Prevention and Criminal Justice into the Wider United Nations Agenda to Address Social and Economic Challenges and to Promote the Rule of Law at the National and International Levels, and Public Participation,34

32The Vienna Declaration on Crime and Justice: Meeting the Challenges of the Twenty-first century); http://daccess-dds-ny.un.org/doc/UNDOC/GEN/N00/562/93/PDF/N0056293.pdf? OpenElement, accessed on 1 December 2020).

33Follow-up to the Eleventh United Nations Congress on Crime Prevention and Criminal Justice; http://daccess-dds-ny.un.org/doc/UNDOC/GEN/N05/498/22/PDF/N0549822.pdf?OpenElement, Accessed on 1 December 2020).

34The Doha Declaration on Integrating Crime Prevention and Criminal Justice into the Wider United Nations Agenda to Address Social and Economic Challenges and to Promote the Rule of

the provisions of which were adopted by acclamation on the first day of the Congress, was the concluding document of the Thirteenth United Nations Congress. It summarised the 60-year achievements of the UN congresses and activities in the field of preventing crime. It also marked an attempt at responding to contemporary challenges emerging in this respect. With a view to implementing the objectives envisaged in the Doha Declaration, the United Nations Office on Drugs and Crime, using Qatar's financial support, launched an ambitious programme with global coverage, aimed at supporting countries in crime prevention efforts, developing criminal justice, preventing corruption and promoting the rule of law. Next congress was scheduled on 20–27 April 2020, and was to take place in Kyoto (a city which hosted the Fourth United Nations Congress in 1970). However, due to the COVID-19 pandemic, it had to be rescheduled.

It is common knowledge that the speed of action is of utmost important in conducting criminal proceedings on cybercrime, considering that digital evidence is non-permanent ("perishable"). To accelerate and facilitate information exchange, inter alia, by more intensive cooperation with the private sector, a joint initiative has been launched by the Counter-Terrorism Committee Executive Directorate (CTED), the United Nations Office on Drugs and Crime (UNODC), and the International Association of Prosecutors—Lawful Access to Digital Data Across Borders.

The UN Security Council also implements activities in the field of cybersecurity and fight against cybercrime. In Resolution 1373 (2001) of 27 September 2001, it called Member States to intensify the exchange of information on the ICT use by terrorist groups, and to block any terrorist recruitment attempts via the Internet. In Resolution 2129 (2013) of 17 September 2013, it stressed that the Internet and social media were increasingly used for facilitating various terrorist acts, including communication, abetting, recruitment, training, preparations, planning, financing, and information collection.

Recognising the need to engage the private sector in combating organised crime and terrorism, CTED has launched the Tech Against Terrorism initiative, its objective being to encourage private sector entities to take measures aimed at selfregulation and at counteracting the use of their platforms by terrorist groups.

In addition, Security Council Resolutions 2341 (2013) of 13 February 2017 imposed on CTED the obligation to verify Member States' efforts to protect critical infrastructures against terrorist attacks, and to identify threats and future challenges likely to emerge in this field.

Law at the National and International Levels, and Public Participation; http://www.unodc.org/ documents/congress//Declaration/V1504151 English.pdf, accessed on 1 June 2020).

#### 6 The International Telecommunication Union

The International Telecommunication Union (ITU), with its seat in Geneva, is a United Nations specialised agency which is currently the most dynamically operating body in the field of ensuring cyberspace security by harmonising the legal orders in various countries, and by establishing international regulations. The ITU duties include standardising and regulating the telecommunications market, promoting international cooperation in the field of telecommunication, providing technical assistance to developing countries, and taking measures aimed at establishing a global telecommunication network combining multiple technologies.35 The Plenipotentiary Conference composed of representatives of the ITU Member States is the chief political body of the Union. The Conference gathers every 4 years and sets the principal directions of the ITU policy, as well as elects members of the Council and defines the organisation's financial plans. The Council is entrusted with supervising the ongoing policies, strategies and activities of the Union in the periods between the consecutive Plenipotentiary Conferences. The General Secretary elected for a fouryear term of office manages the General Secretariat, which is an office dealing with ITU resource and activity administration. The General Secretary is a legal representative of the Union.

The ITU conducts its activities in three principal fields which are supervised by separated structures, i.e. the radiocommunication sector (ITU-R), the standardisation sector (ITU-T) and the telecommunication development sector (ITU-D). ITU-T is in charge of examining and adopting guidelines pertaining to technical, operational and pricing issues, aimed at telecommunication standardisation globally. These are divided into series (each assigned a different letter of the alphabet), and feature separate and more detailed categories. The X series is entitled Data networks, open system communications and security, and it contains guidelines on general security, information and network security, application and service security, cyberspace security, the exchange of information on cybersecurity, and cloud computing security.36 The World Telecommunication Standardization Assembly (WTSA), which gathers every 4 years, is a non-ITU institution. However, it sets the general direction of the activities of the standardisation (ITU-T) and radio communication (ITU-R) sectors. It is in charge of approving the list of technical topics related to telecommunications (referred to as queries) which can form the subject-matter of research and are submitted to the research groups operating within those sectors, which are established on an as-needed basis and comprise experts from various countries. These groups are in charge of drawing up responses which, in principle, take the form of a draft recommendation or a partial recommendation on a given issue, which is then subject to WTSA's approval. In addition, WTSA can adopt resolutions. For instance, the most recent WTSA, which gathered between 25 October and

35See more in Kubicka (2007), pp. 127–128.

36https://www.itu.int/en/ITU-T/publications/Pages/structure.aspx#Z; accessed on 1 September 2020.

3 November 2016 in Hammamet, adopted Resolution 50 (Rev. Hammamet, 2016) on Cybersecurity, and Resolution 52 (Rev. Hammamet, 2016) on Countering and Combating Spam.37

The Plenipotentiary Conference is yet another body issuing resolutions on the subject-matter discussed in this article, including Resolution 179 (Rev. Busan, 2014) of the Plenipotentiary Conference on ITU's role in child online protection, and Resolution 181 (Guadalajara, 2010) of the Plenipotentiary Conference on definitions and terminology relating to building confidence and security in the use of ICT.

The executive body is the permanently operating secretariat with the Secretary General in the lead.

In 2001, the General Assembly of the United Nations passed Resolution 56/183 of 21 December 2001 on the World Summit on the Information Society (WSIS),38 in which it approved the concept of conducting WSIS as proposed by ITU. The Summit was divided into two stages, the first of which took place on 10–12 December 2003 in Geneva, and the second on 16–18 November 2005 in Tunis.

The principal objectives of the first stage of WSIS included developing a shared viewpoint and adopting a statement expressing the political willingness to lay the foundations for "information society for all", taking into consideration the diversified interests of all participants while also heralding the implementation of initial measures to attain this objective. The first stage resulted in adopting, on the 2nd of December 2003, the Geneva Declaration of Principles (Building the Information Society: a global challenge in the new Millennium) and the Geneva Plan of Action. The second stage of WSIS was aimed, in particular, at initiating the implementation process of the provisions of the Geneva Plan of Action, and at searching for solutions in such fields as Internet management and financial mechanisms on the Internet. On 18 November 2005, the Tunis Agenda on Information Society was announced, in which the role of international cooperation in combating cybercrime was stressed, entailing both collaboration between law enforcement authorities, and the establishing of dedicated legal frameworks by governments jointly with parties concerned (representatives of the IT industry and NGOs).39

On 17 May 2007, the ITU Global Cybersecurity Agenda (GCA) was initiated. It acts as a framework for establishing international dialogue and cooperation to facilitate the coordination of global measures, serving as a response to the challenges related to combating cybercrime and building a secure information society. It is based on five strategic pillars (legal measures, technical and procedural measures, organisational structure, capacity-building, and international cooperation), its objective being to develop model cybercrime legislation that is interoperable with existing

37https://www.itu.int/en/publications/ITU-T/pages/publications.aspx?lang¼e&parent¼T-RES& version\_date¼2016; accessed on 1 September 2020. 38http://www.itu.int/wsis/docs/background/resolutions/56 183 unga 2002.pdf, accessed on

1 September 2020.

39Radoniewicz (2016), pp. 206–207.

national and regional legislative measures, and potentially applicable in the global context.40

#### 7 Group of Eight

At the meeting of representatives of the Justice and Home Affairs Ministries of the countries belonging to the Group of Eight,41 held on 10 December 1997 in Washington, a programme for combating computer crime, which was drawn up by the Subgroup on High-Tech Crime,42 was adopted featuring ten principles of combating cybercrime, together with a ten-point action plan.43 The primary objectives included eliminating "hacker havens", coordinating the prosecution of cybercrime regardless of where it was committed, as well as training and equipping law enforcement officers with adequate tools to combat high-tech crime.44

The Ministerial Conference on Combating Transnational Organized Crimes which took place on 9–20 October 1999 in Moscow was dominated by such issues as financing terrorist activities, human trafficking or cybercrime. The last two issues were further discussed in annexes to the document45 summarising the event. The

43Principles to combat against high-tech crime and Action Plan to combat against high-tech crime.

40Radoniewicz (2016), pp. 207–208.

41The Group of Seven (G7)/the Group of Eight (G8) is not an international organisation but a sort of a "semi-institution"—a political and economic forum involving the most influential countries in the world, including France, Japan, Canada, Germany, USA, the United Kingdom, Italy, representatives of the European Union, and Russia. Their leaders gather at annual political and economic summits. The first such gathering took place in 1975. The G7/G8's main objectives include strengthening international cooperation, coordinating foreign policies of its Member States, and improving international commodity turnover. See Łoś-Nowak (2009), pp. 291–293.

42On 15–17 June 1995, at the G8's Summit in Halifax, a dedicated expert group was established, which was entrusted with designing solutions to improve the procedures related to combating organised crime. Its work resulted in formulating, in 1996, a set of Forty Recommendations which were adopted at the G8's Summit in Lyon on 27–29 June 1996. The group was, therefore, named the G8's Lyon Group for fighting international organised crime. Several subgroups were established within its framework, the activities of which involve diversified issues of combating crime, including the aforementioned Subgroup on High-Tech Crime established in 1997. Other subgroups focus on fighting human trafficking or on providing legal assistance. The principal duties of the G8's Lyon Group related to criminal procedures, international cooperation and effective prosecution of computer crime. At the G8's meeting held on 19 October 2001 in Rome, following the 11 September 2001 attacks, representatives of the Justice and Home Affairs Ministries decided that the G8's Lyon Group be merged with the G8's Rome Group dealing with fighting terrorism. Following that merger, the G8's Lyon/Rome Group was formed.

44See also The Information Economy Report drawn up in 2005 at the UN Conference on Trade and Development, http://www.unctad.org/en/docs/sdteecb20051ch6\_en.pdf, accessed on 1. September 2020.

45Communiqué of the Ministerial Conference of the G8 Countries on Combating Transnational Organized Crime.

said document included basic principles to combat cybercrime, which were later restated in numerous international strategies dealing with this subject-matter.46 The practical effect of the Conference was the expansion of the international network of 24/7 points of contact operating within the Group of Eight.47 At the Conference in Paris, attention was once again drawn to the need to eliminate the so-called lawless digital heavens or Internet heavens, and to the role which the Convention on Cybercrime could play as an international agreement open also to those countries which are not members of the Council of Europe, thus potentially serving as a global regulation. At the G8 Government-Industry Workshop on Safety and Security in Cyberspace held in May 2001 in Tokyo, the issues of data retention and securing data for criminal proceedings were dealt with.

At the Washington meeting of representatives of the Justice and Home Affairs Ministries of the countries belonging to the Group of Eight, the continual development of (and amendments to) the national regulations on penalising computer misuse acts, in order to reflect the actual technological progress, was recognised as a condition precedent to effectively combating Internet misuse for terrorist and criminal purposes. Such an approach should accelerate international criminal proceedings on computer crime. With reference to the Convention on Cybercrime, it was pointed out that measures were taken to encourage countries to accede to that document.48 At another meeting of representatives of the Justice and Home Affairs Ministries which was held in Sheffield (Great Britain) on 16–17 June 2005, Member States were recommended to develop regulations which would guarantee a prompt response to serious cyberthreats and network incidents.49

At a meeting held in Moscow in 2006,50 representatives of G8's Justice and Home Affairs Ministries and Prosecutors focused on the issues of terrorism and cybercrime. They stressed that these phenomena are inter-related, and the establishing of effective measures against cybercrime was, therefore, recognised as the condition precedent to effectively combating terrorist acts in the domain of modern technologies.51

46Gercke (2011). p. 177.

47The network of points of contact serving the purpose of information exchange for conducting proceedings in cybercrime cases, operating on a permanent (24/7) basis, parallel to the 24/7 network operating under the Convention on Cybercrime. See Adamski (2011), p. 179.

48The statement by G8's Justice and Home Affairs Ministries of 11 May 2004, the Summit of G8's Justice and Home Affairs Ministries held in Washington on 10–11 May 2004, http://www.g8. utoronto.ca/justice/justice040511\_comm.htm, accessed on 1 September 2020.

49See General objectives adopted at the Summit of G8's Justice and Home Affairs Ministries on 16–17 June 2005, http://www.g8.utoronto.ca/justice/justice\_uk2005.htm, accessed on September 2020.

50The Summit of G8's Justice and Home Affairs Ministries and Prosecutors held in Moscow on 15–16 May 2006.

51See the press conference of representatives of G8's Justice and Home Affairs Ministries, http:// www.g8.utoronto.ca/justice/justice2006.htm, Accessed on 1 September 2020.

At the conference of G8's Justice and Home Affairs Ministries held on 23–25 May 2007 in Munich, the attendees undertook to work on the penalisation, also through domestic measures, of computer misuse acts committed via the Internet for terrorist purposes.52

On 7–9 July 2008, at the summit of G8 Member States in Hokkaido Tokyako, Japan, a report drawn up by the Rome/Lyon Group was presented,53 which once again outlined the various ways of exploiting new technologies by terrorist groups. A further extension of the network of 24/7 points of contact was also recommended, including in particular the extension of its coverage (at that time, the network covered around 50 countries).

At the 2009 meeting of G8's Justice and Home Affairs Ministries and Prosecutors, which was held on 29–30 May 2009 in Rome, the report prepared by the G8's Lyon/Rome Group for the UN Commission on Crime Prevention and Criminal Justice (CCPCJ) was discussed.54 In the statement55 containing a summary of the Summit, attention was drawn to the technological progress and new forms of Internet misuse, such as the criminal misuse of social networks, encryption services, VoIP services, the Domain Name System, and other new and evolving criminal attacks on information systems.

At the Summit in Muskoka, Canada, held on 25–26 June 2010, cybercrime was only mentioned in the context of Internet misuse by terrorists. Attention was drawn both to the problem of networks being put under terrorist threat, and their misuse by terrorists for communication purposes56 (i.e. for disseminating ideologies, recruiting new members, training terrorists or coordinating terrorist activities).57

On 24–25 May 2011, Paris was home to the e-G8 Forum The Internet: Accelerating Growth, in which Internet-related issues were discussed in attendance of representatives of scientific circles and enterprises operating in the widely understood IT industry (e.g. Microsoft, HTC, Google, Facebook, Alcatel, France Telecom, Eutelsat).58 The Conference immediately preceded the G8 Summit scheduled on 26–27 May 2011 in Deauville (France). It was attended by representatives of the e-G8 Forum participants who brought a special message to governments (Message to Deauville), which stressed the significance of the Internet as a major drive of both

52Gercke (2011)p. 180.

53http://www.g8.utoronto.ca/summit/2008hokkaido/2008-crimereport.pdf, accessed on 1 September 2020.

54Cf. http://www.cybercrimelaw.net/G8.html, Accessed on 1 September 2020.

55http://www.g8italia2009.it/static/G8\_Allegato/declaration1giu2009,0.pdf, accessed on 1 September 2020.

56See Muskoka Declaration: Recovery and New Beginnings, Point 42, http://www.g7.utoronto.ca/ summit/2010muskoka/communique.html#peace, accessed on 1 September 2020.

57Cf. The statement from the G8 Summit held in Heiligendamm on 8 June 2007 on combating terrorism, http://www.g8.utoronto.ca/summit/2007heiligendamm/g8-2007-ct.html, Accessed on 10 October 2020.

58http://www.g8.utoronto.ca/summit/2011deauville/eg8/index.html, Accessed on 1 September 2020.

social and economic development and recognised it as an "engine for change" (with the Arab Spring as an example). Governments of the G8 Member States were called to provide an unconstrained, fast and secure Internet. Although the Message met with a full understanding, and even approval, of the addressees, it did not translate into any specific recommendations.59 At the subsequent G8/G7 summits60 (the 2012 Summit in Camp David, the 2013 Summit in Lough Erne, the 2014 Summit in Brussels, and the 2015 Summit in Schloss Elmau), the issues of cybercrime were not dealt with, while at the 2016 Summit in Ise-Shima (Japan, the 26th–27th of May 2016), cyberspace security was again one of the most important subjects of the debate. In the declaration61 adopted at that Summit, it was stressed that a secure cyberspace was one of the main contributors to economic growth and prosperity. An undertaking was, therefore, made to establish close cooperation against the malicious use of cyberspace both by state and non-state parties, including terrorist units. The existing international law was again recognised as applicable to states' operations in cyberspace. An undertaking was made to protect and promote human rights on the Internet, and to support a multilateral approach to Internet management entailing a full and active involvement, inter alia, of governments, private sector entities, civic societies, technological communities and international organisations. The specific duties and roles of countries in the tele-information environment aimed at ensuring security, stability and prosperity were stressed. Finally, a promise was made to establish a new G7 working group for cyberspace, with a view to facilitating concerted measures to ensure security and stability in cyberspace.

At the 2017 Summit in Taormina (Italy, 27 May 2017), attention was drawn to the fact that cyber attacks targeted at critical infrastructures worldwide highlighted the need to strengthen international cooperation aimed at ensuring cyberspace security as a condition precedent to economic growth and prosperity.62

At the subsequent summits, taking place on 8–9 June 2018 in Charlevoix, Canada,63 and on 24–26 August 2019 in Biarritz, France,64 the issues of cybercrime and cybersecurity were barely touched upon. The 2020 Summit was planned to be held in March in Camp David. However, due to the COVID-19 pandemic, it was cancelled and a series of videoconferences were organised instead.

59Gercke (2011), p 181.

60In consequence of the events taking place in Ukraine in 2014, the G7 formula was restored, with Russia's membership being "on suspension". Thus, the 2014 Summit which was initially planned to be organised in Sochi was eventually held in Brussels (without Russia's attendance).

61G7 Ise-Shima Leaders' Declaration, http://www.g8.utoronto.ca/summit/2016shima/ise-shimadeclaration-en.html, Accessed on 1 December 2020.

62Taormina Leaders' Communiqué; http://www.g8.utoronto.ca/summit/2017taormina/ communique.html, accessed on 1 December 2020.

63The Charlevoix G7 Summit Communiqué, http://www.g8.utoronto.ca/summit/2018charlevoix/ index.html, accessed on 1 December 2020.

64G7 Biarritz Leaders' Declaration; http://www.g8.utoronto.ca/summit/2019biarritz/declaration-ofleaders.html; accessed on 1 December 2020.

#### References

Filip Radoniewicz PhD; legal advisor; adjunct in the Department of Cybersecurity Law and New Technologies at the Institute of Law, War Studies University, Warsaw; expert at the Academic Centre for Cybersecurity Policy, (War Studies University) and in the Ministry of Justice; he worked as an assistant judge (in the Fourth Criminal and Sixth Penitentiary Department of the Regional Court in Lublin); graduate of post-graduate studies: "European Union Law" at the Jagiellonian University, "Human Rights and Freedoms", co-organized by the Institute of Legal Sciences of the Polish Academy of Sciences and the Helsinki Foundation for Human Rights, and "Computer Network Administration" at the Lublin University of Technology; author or co-author of approximately fifty publications, mainly in the field of broadly understood criminal law, new technology law and human rights. Selected publications: F. Radoniewicz (2016) Odpowiedzialność karna za hacking i inne przestępstwa przeciwko danym komputerowym i systemom informatycznym/Criminal liability for hacking and other offences against computer data and information systems/, Wolters Kluwer, Warszawa; Ustawa o krajowym systemie cyberbezpieczeństwa. Komentarz /Act on the National Cybersecurity System. Commentary/ (2019) ed. W. Kitler, J. Taczkowska-Olszewska, F. Radoniewicz, CH. Beck, Warszawa.

Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

## Cybersecurity in the European Union Law

#### Filip Radoniewicz

Abstract The first legal acts adopted within the framework of the European Communities were adopted in the early nineties. However, they were not binding. They contained calls for appropriate actions, identification of some solutions, proposals for draft legal acts, strategies and action plans to improve network security.

This chapter, however, highlights the most important binding acts: the first binding EU legal instrument to combat computer crime: Council Framework Decision 2005/222/JHA of the 24th of February 2005 on attacks against information systems, Directive 2013/40/EU of the European Parliament and of the Council of the 12th of August 2013 on attacks against information systems and replacing Council Framework Decision 2005/222/JHA and Directive (EU) 2016/1148 of the European Parliament and of the Council of the 6th of July 2016 concerning measures for a high common level of security of network and information systems across the Union.

#### 1 Introduction

When discussing European Union activities in the field of cybersecurity and combating cybercrime, it appears advisable to go back to the 1990s, when the first non-binding legal Acts were adopted to regulate these matters. They called for the implementing of the appropriate measures, indicating specific solutions or proposals for the draft legal Acts, as well as the developing of strategies and action plans to improve network security. In this context, the following documents are worth noting:

e-mail<EMAIL_ADDRESS>
F. Radoniewicz (\*)

Akademickie Centrum Polityki Cyberbezpieczeństwa/Academic Center for Cybersecurity Policy, Akademia Sztuki Wojennej w Warszawie/War Studies University in Warsaw, Warsaw, Poland

1 Council Decision 92/242/EEC of 31 March 1992 in the Field of Security of Information Systems (OJ EU L 123/19).

2 Council Recommendation 95/144/EC of 7 April 1995 on Common Information Technology Security Evaluation Criteria, OJ EC 1995 C 93/27.

3 The Resolution of Parliament of 19 May 2002 Calling for Legislative Measures Against High-Tech Crime, Unpublished.

4 Unauthorised access to information systems, disruptive attacks on information systems, malicious software, misrepresentation (using other person's data with fraudulent intentions—this not only concerned identity theft but also spoofing).

5 Council Recommendation of 25 June 2001 on Contact Points Maintaining a 24-h Service for Combating High-Tech Crime Official Journal C 187 of 3.07.2001, p. 5.

6 The Council Resolution of 28 January 2002 on a Common Approach and Specific Actions in the Field of Network and Information Security, OJ EC 2002 C 43/2.

At the aforementioned special meeting of the European Council, which took place in Lisbon on the 23rd–24th of March 2000, the eEurope programme was

7 Radoniewicz (2016), pp. 233–236.

8 Commission Staff Working Document—Assessment of the EU 2013 Cybersecurity Strategy SWD (2017) 295 final of 13.9.2017.

9 Council Decision of 23 September 2013 on the Security Rules for Protecting EU Classified Information (2013/488/EU), OJ EU 2012 L 27/1.

10Communication to the European Parliament, the Council, the Economic and Social Committee and the Committee of the Regions: Cybersecurity Strategy of the European Union: An Open, Safe and Secure Cyberspace JOIN(2013) 1 final.

11Commission Communication COM (1999) 687: eEurope – An Information Society for All.

12Kuliński (2010), pp. 23–24. Cf. Chałubińska-Jentkiewicz (2019), pp. 266–269.

approved, and the so-called Lisbon Strategy was adopted. The Lisbon Strategy was a long-term socio-economic development programme for the European Union, the purpose of which was to make Europe the most dynamic and competitive economic region in the world by building the knowledge-based economy (i.e. an economy directly based on production, distribution, and the use of information and knowledge).13

In June 2000, at the meeting in Santa Maria de Feira, eEurope 2002 – An Information Society for All. Action Plan was adopted.

The measures implemented within the framework of the eEurope 2002 programme were maintained in the eEurope 2005 programme, and then in the i2010 Strategy announced in Commission Communication COM(2005)229 of the 1st of June 2005: i2010 – A European Information Society for Growth and Employment. Europe 2020 – A strategy for smart, sustainable and inclusive growth (COM (2010)2020), which was approved by the European Council on the 17th of June 2010, serves as a follow-up to the i2010 programme. It is within its framework that the European digital agenda has been implemented. Its objective is to develop a uniform digital market enabling EU Member States to derive permanent economic and social benefits.

At the meeting of the European Council which took place on the 4th–5th of November 2004 in Brussels, an action plan in the fields of justice and internal affairs was adopted. It was referred to as the Hague Programme, as it was developed during the Netherlands' Presidency of the Council of the European Union.

The Hague Programme's implementation was continued in the so-called Stockholm Programme—An Open and Safe Europe Serving and Protecting Citizens adopted during Sweden's Presidency at the meeting in Brussels on the 10th–11th of December 2009. It was implemented within the framework of the action plan adopted by the Commission on the 20th of April 2010. It recommended that an internal security strategy be developed for the EU, directed at increasing the protection of citizens and at effectively combating serious crime, organised crime, and terrorism, by strengthening cooperation between the police and the judicial services in criminal cases, and Member States' cooperation in the field of border management, citizen protection and assistance in the event of natural disasters or catastrophes. Other guidelines regarding the development planning of the AFSJ (the area of freedom, security and justice) were laid down by the European Council on 26th–27th of June 2014. However, these were not turned into a programme, as had been done with previous guidelines, but were included in the European Union conclusions. In the document entitled The Continuation of Work on a Comprehensive Approach to Cybersecurity and Cybercrime, ensuring cybersecurity was considered a principal measure directed at providing EU citizens with real security space.14

13See more e.g. Radoniewicz (2019a), pp. 13–14.

14Chałubińska-Jentkiewicz (2019), pp. 269–270.

On the 6th of May 2015, A Digital Single Market Strategy15 was adopted, its purpose being to develop a uniform legal framework for the EU digital market.

#### 2 Council Framework Decision 2005/222/JHA of the 24th of February 2005 on Attacks Against Information Systems

Council Framework Decision 2005/222/JHA of the 24th of February 2005 on attacks against information systems16 was the first binding EU legal instrument the objective of which was to combat computer crime. In principle, the document included definitions of the most pertinent concepts ("information system," "computer data," "legal person" and "without right"), and obliged Member States to consider illegal access to information systems and illegal system interference as punishable offences. Reference was also made to the liability of legal persons, jurisdiction, and the establishing of a network of points of contact' maintaining a 24-h service, available 7 days a week, to facilitate the exchange of information on attacks against information systems. The limited number of crimes defined in Framework Decision 2005/222, along with the need to recognise new threats, as well as the intent to adjust the regulations to new EU initiatives in the field of cybersecurity, and to supplement them in order to arrive at a comprehensive regulation of this subject matter, eventually led to a decision on developing a new legal instrument concerning cybercrime. Work on the new regulation coincided with the adopting of the Treaty of Lisbon, which made it possible to use the directive for regulating cybercrime issues.

#### 3 Directive 2013/40/EU of the European Parliament and of the Council of the 12th of August 2013 on Attacks Against Information Systems

In Directive 2013/40/EU of the European Parliament and of the Council of the 12th of August 2013 on attacks against information systems and replacing Council Framework Decision 2005/222/JHA,17 the provisions of Framework Decision

15A Digital Single Market Strategy Communication COM (2015)192 from the Commission to the European Parliament, the Council, the Economic and Social Committee, and the Committee of the Regions. Cf. Radoniewicz (2019a), pp. 14–15.

16Council Framework Decision 2005/222/JHA of 24 February 2005 on attacks against information systems, OJ EU 2005 L 69/67.

17Directive 2013/40/EU of the European Parliament and of the Council of 12 August 2013 on attacks against information systems and replacing Council Framework Decision 2005/222/JHA, OJ EU 2013 L218/8.

2005/222 were generally upheld, but a number of new solutions were added. New types of criminal offences were envisaged (e.g. the illegal interception of computer data, and crimes involving "hacking tools"), and additional circumstances were defined, along with committing crime within a criminal organisation, as provided for in Framework Decision 2005/222 (though with more stringent sanctions), which Member States should obligatorily treat as increasing criminal liability. These included 'botnet' attacks, causing serious harm (such issues as causing serious harm or influencing material interests were also envisaged in the Framework Decision, but that provision was of a non-obligatory character), committing an offence against an information system with critical-infrastructure status, and another person's true identity's being used by the perpetrator.18

#### 4 Directive 2017/541 (EU) of the European Parliament and of the Council of the 15th of March 2017 on Combating Terrorism

Directive 2017/541/EU of the European Parliament and of the Council, of the 15th of March 2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA19 and amending Council Decision 2005/671/JHA,20 is the major legal instrument whose purpose is to combat terrorism in the European Union. Under Article 3 of Directive 2017/541, in order for an illegal act to be considered a terrorist offence, it must meet the objective criterion of being one of the acts listed in the closed-ended list contained in that article, or involve a threat of such an act's being committed. In addition, it must satisfy at least one of the premises listed further in the definition, concerning the perpetrator's purpose, i.e. it must be committed with the intention of

The list referred to above contains, inter alia, the illegal acts as defined in Articles 4 and 5 of Directive 2013/40 (illegal system interference and illegal data interference, respectively) provided that any of the aggravating circumstances listed in the directive are found to have occurred (as regards the act defined in Article 4, when the

18See more e.g. Radoniewicz (2017), pp. 303–317.

19About Framework Decision 2002/475/JHA see e.g. Radoniewicz (2015), pp. 192–196.

20Directive 2017/541/EU of the European Parliament and of the Council, of 15 March 2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA, OJ EU 2017 L 88/6.

perpetrator's action involving the use of hacking software affected a large number of information systems, or the act caused serious damage to or was directed against an information system with critical-infrastructure status; and as regards the act as defined in Article 5, when the act was committed against an information system with critical-infrastructure status).21 Furthermore, Member States were obliged to take the necessary measures to ensure the prompt removal of online content constituting a public provocation to commit a terrorist offence, or to block access to such content when its removal is not feasible (Article 21 of Directive 2017/541).22

#### 5 Directive 2008/114/EC of the 8th of December 2008 on the Identification and Designation of European Critical Infrastructures

With a view to raising the security level of critical infrastructures of supra-national significance, Council Directive 2008/114/EC of the 8th of December 2008 on the identification and designation of European critical infrastructures, and the assessment of the need to improve their protection, was adopted.23 Under Article 2(a) of the Directive, "critical infrastructure" means an asset, system, or part thereof located in Member States, which is essential for the maintenance of vital societal functions: health, safety, security, the economic or social well-being of people, the disruption or destruction of which would have a significant impact on a Member State as a result of the failure to maintain those functions; and "The European critical infrastructure", or "ECI", as defined in Article 2(b) of the Directive, means a critical infrastructure located in Member States whose disruption or destruction would have a significant impact on at least two Member States. The significance of this impact is assessed in terms of cross-cutting criteria. These include the effects resulting from cross-sector dependencies on other types of infrastructure. Under Article 3(2) of the Directive, the cross-cutting criteria comprise the casualties' criterion, the economiceffects' criterion, and the public-effects' criterion. While the Directive is focused on the energy and transport sectors, its extension is planned to include other sectors, e.g. the information-and-communication-technology (ICT) sector.

21See more: Radoniewicz (2016), pp. 266–267.

22See more e.g. Radoniewicz (2019b), pp. 193–205.

23Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection (Text with EEA relevance), OJ EU 2008 L 345/7.

#### 6 Directive 2002/21/EC on a Common Regulatory Framework for Electronic Communications Networks and Services (A Framework Directive)

Directive 2002/21/EC of the European Parliament and of the Council of the 7th of March 2002 on a common regulatory framework for electronic communications networks and services (A Framework Directive)24 lays down a common regulatory framework for electronic-communications networks, i.e. transmission systems, which permit the conveyance of signals by wire, radio, optical, or other electromagnetic means, including satellite networks, fixed and mobile terrestrial networks, electricity-cable systems, networks used for radio and television broadcasting, and cable-television networks, irrespective of the type of information conveyed, as well as for electronic-communications services, which consist of the conveyance of signals on those networks, and the associated equipment and services related to electronic-communications networks and services, which facilitate or support the provision of services by such networks. It also lays down tasks of national regulatory authorities, and establishes a set of procedures to ensure the harmonised application of the regulatory framework throughout the Community (Article 1(1) of Directive 2002/21/EC).

The issue of network security is discussed in Chapter IIIa of Directive 2002/21/ EC, which was added by way of a directive 2009/140/EC of the 25th of November 2009,25 which became effective on the 19th of December 2009.

Under Article 13a (1) of Directive 2002/21/EC, Member States were obliged to ensure that undertakings providing public-communications networks or publicly available electronic-communications services take the appropriate technical and organisational measures to properly manage the risks posed to the security of networks and services. These measures are expected to ensure a level of security commensurate to the risk presented, having regard to the state of the art. In particular, measures should be taken to prevent and minimise the impact of security incidents on users and interconnected networks.

Member States are also required to ensure that undertakings providing publiccommunications networks take all the appropriate steps to guarantee the integrity of their networks, and thus ensure the continuity of the supply of the services provided over those networks (Article 13a (2) of Directive 2002/21/EC), and that undertakings providing public-communications networks or publicly available electronic-

24Directive 2002/21/EC of the European Parliament and of the Council of 7 March 2002 on a common regulatory framework for electronic communications networks and services (Framework Directive), OJ EC 2002 L 108/33.

25Directive 2009/140/EC of the European Parliament and of the Council of 25 November 2009 amending Directives 2002/21/EC on a common regulatory framework for electronic communications networks and services, 2002/19/EC on access to, and interconnection of, electronic communications networks and associated facilities, and 2002/20/EC on the authorisation of electronic communications networks and services (OJ EU 2013 L 337/37).

communications services take the appropriate technical and organisational measures to properly manage the risks posed to the security of networks and services (Article 13a (3) of Directive 2002/21/EC).

With a view to implementing the provisions of Article 13a, the responsible national regulatory authorities need to be vested with the power to issue binding instructions, including those regarding time limits for implementation, to undertakings providing public-communications networks or publicly available electroniccommunications services (Article 13b (1) of Directive 2002/21/EC).

Under Article 13b (2) of Directive 2002/21/EC, undertakings providing publiccommunications networks or publicly available electronic-communications services should be required to notify the responsible national regulatory authority of every breach of security or loss of integrity, which has had a significant impact on the operation of networks or services.

Member States are expected to ensure that the responsible national regulatory authorities have the power to require undertakings providing publiccommunications networks or publicly available electronic-communications services to

Article 13b (3) of Directive 2002/21/EC provides for vesting national regulatory authorities with all the powers necessary to investigate cases of non-compliance and the effects thereof on the security and integrity of networks.

#### 7 Directive 2006/24/EC on the Retention of Data Generated or Processed in Connection with the Provision of Publicly Available Electronic Communications Services or of Public Communications Networks

Directive 2006/24/EC of the European Parliament and of the Council of the 15th of March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC,26 aimed to

26Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC, OJ EU 2006 L 105/54 (no longer in force).

harmonise Member States' provisions concerning the obligations of the providers of publicly available electronic-communications services or of public-communications networks in respect of the retention of so-called transmission data (i.e. traffic and location data, and related data necessary to identify the subscriber or registered user) which are generated or processed by them, in order to ensure that the data are available for the purposes of the investigation, detection, and prosecution of serious crimes, as defined by each Member State in its national law (Article 1). At the same time, the Directive (in Article 3) obliges Member States to adopt measures to ensure that these data (specified in detail in Article 5) are retained in accordance with the provisions thereof, to the extent that they are generated or processed by providers of publicly available electronic-communications services, or of a publiccommunications network within their jurisdiction, in the process of supplying the communications services concerned. The obligation to retain data includes the retention of data in the event of unsuccessful call attempts where those data are generated or processed and stored (as regards telephone data) or saved while users' logging in (as regards Internet data), by providers of publicly available electroniccommunications services, or of a public-communications network within the jurisdiction of the Member State involved in the process of supplying the communications services concerned. Under Article 6, these categories of data are retained for periods of not less than six months and not more than two years from the date of the communication. This Directive was implemented by Member States (obviously including Poland) but it was then deemed invalid by the Court of Justice decision of the 8th of April 2014.27 However, the decision did not cause all the provisions adopted in the course of the Directive transposition to be repealed. The basis for data retention in EU law is thus still provided by Article 15(1) of the Privacy Directive.

#### 8 Regulation No 910/2014 on Electronic Identification and Trust Services for Electronic Transactions in the Internal Market (eIDAS)

Regulation (EU) No 910/2014 of the European Parliament and of the Council of the 23rd of July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC28 (eIDAS) lays down a new system of secure electronic interactions across the EU between businesses, citizens, and public authorities.

27Joined cases C-293/12 and C-594/12, Digital Rights Ireland Ltd vs. the Minister for Communications et al., ECLI:EU:C:2014:238.

28Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC, OJ EU 2014 L 257/73, (hereinafter referred as eIDAS).

Under the regulation on trust services, qualified and non-qualified trust-service providers29 are obliged to take the appropriate technical and organisational measures, having regard to the latest technological developments, to manage the risks posed to the security of the trust services they provide, while also ensuring that the level of security is commensurate to the degree of risk. In particular, they are expected to take measures to prevent and minimise the impact of security incidents, and to inform stakeholders of the adverse effects of any such incidents.

Qualified and non-qualified trust-service providers must, without undue delay, but in any case within 24 h after having become aware of it, notify the supervisory body, and, where applicable, other relevant bodies, such as the authorised national body for information security or the data-protection authority, of any breach of security or loss of integrity which has a significant impact on the trust service provided, or on the personal data maintained therein. Furthermore, where the breach of security or loss of integrity is likely to adversely affect a natural or legal person to whom the trust service has been provided, the trust-service provider must also notify the natural or legal person of the breach of security or loss of integrity without undue delay. Where appropriate, in particular if a breach of security or loss of integrity concerns two or more Member States, the notified supervisory body is obliged to inform the supervisory authorities in the other Member States concerned, and ENISA (The European Network and Information Security Agency; currently—The European Union Agency for Cybersecurity).

29Under Article 3(19), in conjunction with Article 3(20) of the Regulation on trust services, the term "trust-service provider" means a natural or a legal person who provides one or more trust services, either as a qualified (i.e. satisfying certain additional requirements stipulated in the regulation) or as a non-qualified trust-service provider. "Trust service" means an electronic service normally for remuneration which consists of:

(1) the creation, verification, and validation of electronic signatures, electronic seals, or electronic time stamps, electronic registered delivery services and the certificates related to those services; or

Finally, "qualified trust service" means a trust service which meets the applicable requirements laid down in the regulation on trust services.

#### 9 Directive 2016/1148 Concerning Measures for a High Common Level of Security of Network and Information Systems Across the Union

The draft version of Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016, concerning measures for a high common level of security of network and information systems across the Union (NIS Directive)30 was presented in 2013 as a major element in the Cybersecurity Strategy, its underlying objective being to ensure a high level of security of network and information systems (hence the Directive is commonly abbreviated as the NIS Directive) at the EU level, i.e. to increase the security of tele-information systems forming the basis for the functioning of the modern societies and economies of EU Member States, which is to improve the functioning of the EU internal market. To this end, Article 2(1) of the NIS Directive provides for

The requirements concerning security and incident reporting, as stipulated in the NIS Directive, are not applicable to undertakings which are subject to the requirements arising from Articles 13a and 13b of Directive 2002/21/EC of the European Parliament and of the Council of 7 March 2002, on a common regulatory framework for electronic communications networks and services (A Framework Directive) (i.e. to undertakings providing public-communications networks or publicly available electronic-communications services), or to trust-service providers which are subject to the requirements arising from Article 19 of Regulation (EU) No 910/2014 of the European Parliament and of the Council of the 23rd of July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC.

30Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union, OJ EU 2016 L 194/1, (hereinafter referred as "NIS Directive").

The NIS Directive is without prejudice to the actions taken by Member States to safeguard their essential state functions, in particular to safeguard national security, including actions protecting information whose disclosure Member States consider contrary to the essential interests of their security, and to maintain law and order, in particular to facilitate the investigation, detection, and prosecution of criminal offences (Article 2(6)). It should be stressed that it provides for minimum harmonisation, as, under Article 4, Member States may adopt or maintain provisions with a view to achieving a higher level of security of network and information systems.

For the purpose of the NIS Directive (Article 4(1)), "network and information systems" are defined as

The security of network and information systems is understood as the ability of network and information systems to resist, at a given level of confidence, any action which compromises the availability, authenticity, integrity, or confidentiality of stored or transmitted or processed data, or the related services offered by, or accessible via, those network and information systems (Article 4(2)). The operator of essential services means a public or private entity of a type referred to in Annex II (energy, transport, banking, financial-markets infrastructure, healthcare, water-supply and digital infrastructure). Digital services were specified in Annex III (online marketplace, online search engine, cloud-computing services).

In compliance with the NIS Directive, Member States are obliged to identify the operators which are subject to the Directive within each of the sectors listed in Annex II. It is not required to identify all services, but only those of major significance to social and economic interests, and which could be subjected to significant disruptive effects. The significance of a disruptive effect is determined by taking into account the factors listed in Article 6 of the NIS Directive. These refer to the number of users relying on the service provided by the entity concerned, the dependency of other sectors (referred to in Annex II) on the service provided by that entity, the impact which incidents could have on economic and societal activities or public safety, the relative impact of social and economic interests, market share, geographical spread, etc. Chapter II governs the national frameworks on the security of network and information systems. Article 7 obliges each Member State to adopt a nationalsecurity strategy, while at the same time defining the issues to be considered therein. Article 8 obliges each Member State to designate competent authorities on the security of network and information systems (supervising their compliance with the provisions implementing the NIS Directive) and single points of contact. The Directive provides for establishing computer security incident response teams (CSIRTs) (Article 9) charged with the management of risks and incidents in the sectors defined in Annex II, and in the services listed in Annex III. Furthermore, the NIS Directive provides for cooperation at the national level between competent authorities, single points of contact, and CSIRTs (Article 10). Cooperation between Member States was regulated in Chapter III, which envisages establishing a Cooperation Group (Article 11) composed of representatives of Member States, the Commission, and ENISA, and entrusted with providing strategic guidance for the activities of the CSIRT network, exchanging information and best practices, etc. Article 12 obliges Member States to establish a national CSIRT network, the principal duty of which will be to ensure coordinated response to incidents. The NIS Director provides for certain security and incident-reporting obligations to be imposed both on operators of essential services (Article 14) and on digital service providers (Article 16).31

There are numerous documents related to the NIS Directive, including legal Acts of a binding and non-binding character:

31Savin (2017), pp. 347–348.

32Commission Implementing Regulation (EU) 2018/151 of 30 January 2018 laying down rules for application of Directive (EU) 2016/1148 of the European Parliament and of the Council as regards further specification of the elements to be taken into account by digital service providers for managing the risks posed to the security of network and information systems and of the parameters for determining whether an incident has a substantial impact, OJ EU 2018 L 26/48.

33Commission Implementing Decision (EU) 2017/179 of 1 February 2017 laying down procedural arrangements necessary for the functioning of the Cooperation Group pursuant to Article 11(5) of the Directive (EU) 2016/1148 of the European Parliament and of the Council concerning measures for a high common level of security of network and information systems across the Union, OJ EU 2017 L 28/7.

Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems across the Union.34

#### 10 Directive (EU) 2018/1972 Establishing the European Electronic Communications Code

Directive (EU) 2018/1972 of the European Parliament and of the Council of the 11th of December 2018 establishing the European Electronic Communications Code (Recast) (Text with EEA relevance)37 recast and replaced Directives 2002/19/EC, 2002/20/EC and 2002/21/EC (with subsequent amendments), the provisions of which were meant to be transposed to the legal order of EU Member States by 2003. The new provisions included in Directive (EU) 2018/1972 should be implemented in the legal order of EU Member States by the 21st of December 2020, and will be deemed applicable from that date. The Directive entered into force on the 20th of December 2018.38

34Communication from the Commission to the European Parliament and the Council: Making the most of NIS—towards the effective implementation of Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems across the Union COM(2017) 476 final 2.

35Commission Recommendation (EU) 2017/1584 of 13 September 2017 on coordinated response to large-scale cybersecurity incidents and crises, OJ EU 2017 L 239/36.

36Joint Communication to the European Parliament and the Council—Resilience, Deterrence, and Defence: Building strong cybersecurity for the EU JOIN(2017) 450 final.

37Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (Recast) Text with EEA relevance. PE/52/2018/REV/1, OJ EU 2018L 321/36.

38Article 125 of the Code stipulates that Directives 2002/19/EC [Directive 2002/19/EC of the European Parliament and of the Council of 7 March 2002 on the access to and the interconnection of electronic communications networks and associated facilities (Access Directive) (OJ EC 2002 L 108/7], 2002/20/EC [Directive 2002/20/EC of the European Parliament and of the Council of 7 March 2002 on the authorisation of electronic communications networks and services (Authorisation Directive) (OJ EC 2002 L 108/21], 2002/21/EC [Directive 2002/21/EC of the European Parliament and of the Council, of 7 March 2002 on a common regulatory framework for electronic communications networks and services (A Framework Directive) (OJ EC 2002 L 108/33], and 2002/22/EC [Directive 2002/22/EC of the European Parliament and of the Council of 7 March 2002 on universal service and users' rights relating to electronic communications networks and services (Universal Service Directive) (OJ EC 2002 L 108/51], listed in Annex XII, Part A, will be repealed on 21 December 2020 without prejudice to the obligations of Member States relating to the timelimits for the transposition into national law and the dates of application of the Directives set out in Annex XII, Part B. Article 5 of Decision 243/2012/UE [Decision No 243/2012/EU of the European Parliament and of the Council of 14 March 2012 establishing a multi-annual radio spectrum policy

Directive 2018/1972 is a set of new or updated solutions regulating activities in the communications sector, i.e. issues pertinent to electronic-communications networks (tele-communications networks), communications services, and associated equipment and services. It also defines the expertise of national regulatory bodies and other responsible entities, and also envisages a range of procedures serving the purpose of harmonising the regulatory frameworks across the EU. Its aim is to promote the internal market in the field of electronic-communications networks and services, e.g. by stimulating competition and increasing investments in 5G and high-capacity networks, leading to the proliferation of such networks, the achievement of sustainable competition, the development of the interoperability of electronic-communications services, accessibility, network and services securing, and the provision of other benefits to end users, so as to ensure that all EU citizens and businesses can use high-quality communications, enjoy a guaranteed high level of consumer protection, and choose from a wide range of innovative digital services. This involves ensuring the provision, throughout the Union, of good-quality, affordable, publicly available services through effective competition and choice, to deal with circumstances in which the needs of end-users, including those with disabilities, in order to access the services on an equal basis with others are not being satisfactorily met by the market, and to lay down the necessary end-user rights (Article 1 (2) of Directive 2018/1972).

In compliance with Directive 2018/1972, national regulatory bodies and other responsible bodies, as well as BEREC,39 the Commission, and Member States, should seek to attain the following general objectives.

	- (a) removing the existing obstacles to investments in electronic-communications networks, associated facilities and services, and electronic-communications services

programme. Text with EEA relevance (OJ EU 2012 L 81/7)] is removed, effective on 21 December 2020.

39The Commission, the Body of European Regulators for Electronic Communications (BEREC) is expected to ensure that EU regulations are complied with in a consistent manner to facilitate the efficient functioning of the single electronic-communications market across the EU. It provides advice to EU institutions, whether at their request or on its own initiative. BEREC includes the so-called regulatory authorities council, which is composed of heads of the national regulatory bodies from each EU Member State (or designated senior representatives of those bodies).

	- (a) favouring the effective, efficient, and coordinated use of radio spectra
	- (b) open innovation
	- (c) the establishment and development of trans-European networks
	- (d) the provision, availability, and interoperability of pan-European services and end-to-end connectivity
	- (a) enabling the generating of maximum benefits in terms of choice, price, and quality, on the basis of effective competition
	- (b) maintaining the security of networks and services
	- (c) ensuring a high and common level of protection for end-users through the necessary sector-specific rules, and
	- (d) addressing the needs—such as affordable prices—of specific social groups, in particular end-users with disabilities, elderly end-users, and end-users with special social needs, and by providing choice and equal access for end-users with disabilities.

Member States were obliged to ensure that entities providing publiccommunications networks or publicly available electronic-communications services take appropriate and commensurate technical and organisational measures to manage the risks posed to the security of networks and services. These measures must ensure a level of security appropriate to the risk presented, having regard to the state of the art. In particular, measures, including encryption, where appropriate, are required to prevent and minimise the impact of security incidents on users, and on other networks and services (Article 40(1)). The coordination of Member States will be facilitated by ENISA in order to avoid diverging national requirements that might create security risks and barriers to the internal market (Article 40(2)).

#### 11 Regulation (EU) No 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (The European Union Agency for Cybersecurity) and on Information and Communications Technology Cybersecurity Certification, and Repealing Regulation (EU) No 526/2013

Finally, two entities, i.e. the European Agency and the European Cybercrime Centre, are worth mentioning. The European Union Agency for Cybersecurity (ENISA) was set up as The European Network and Information Security Agency on the 15th of March 2004 by way of Regulation (EC) No 460/2004 of the European Parliament and of the Council of the 10th of March 2004 establishing the European Network and Information Security Agency.40 Its objective is to provide assistance to EU Member States regarding broadly understood cybersecurity issues, and to drive the development of the information society. Under Article 27 of Regulation No 460/2004, the European Network and Information Security Agency was established for a period of five years, starting from the 14th of March 2004. Its duration was then extended twice by way of two subsequent regulations [Regulation No 1007/2008 of the European Parliament and of the Council of the 24th of September 2008 amending Regulation (EC) No 460/2004 establishing the European Network and Information Security Agency as regards its duration,41 and Regulation (EC) No 580/2011 of the European Parliament and of the Council of the 8th of June 2011 amending Regulation (EC) No 460/2004 establishing the European Network and Information Security Agency as regards its duration42]. Then, the Agency operated under Regulation (EU) No 526/2013 of the European Parliament and of the Council of the 21st of May 2013 concerning the European Union Agency for Network and Information Security (ENISA),and repealing Regulation (EC) No 460/2004,43 in

40Regulation (EC) No 460/2004 of the European Parliament and of the Council of 10 March 2004 establishing the European Network and Information Security Agency (Text with EEA relevance), OJ EU 2004 L 77/1.

41Regulation (EC) No 1007/2008 of the European Parliament and of the Council of 24 September 2008 amending Regulation (EC) No 460/2004 establishing the European Network and Information Security Agency as regards its duration (Text with EEA relevance), OJ EU 2008 L293/1.

42Regulation (EU) No 580/2011 of the European Parliament and of the Council of 8 June 2011 amending Regulation (EC) No 460/2004 establishing the European Network and Information Security Agency as regards its duration Text with EEA relevance, OJ EU 2011 L 165/3.

43Regulation (EU) No 526/2013 of the European Parliament and of the Council of 21 May 2013 concerning the European Union Agency for Network and Information Security (ENISA) and repealing Regulation (EC) No 460/2004 Text with EEA relevance, OJ EU 2013 L 165/4.

which its duration was envisaged to continue for seven years. As was rightly noted by C. Banasiński and W. Nowak, this limited duration, even if subsequently extended, significantly reduced the Agency's authority, hindering any long-term planning, and affecting in a negative way the situation of the entities to which its services were addressed. It was also contradictory to the NIS Directive which (see further comments) entrusted the Agency with certain tasks.44 Regulation (EU) No 2019/881 of the European Parliament and of the Council of the 17th of April 2019 on ENISA (The European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification, and repealing Regulation (EU) No 526/2013,45 put an end to the temporary character of the Agency. Not only did it envisage the Agency's duration to be unlimited, but it also vested new rights and duties in the Agency (inter alia, relating to certification and normalisation).

The Regulation, along with determining the objectives and duties of ENISA, and regulating its organisational matters, provides a framework for the establishment of European cybersecurity certification schemes, for the purpose of ensuring an adequate level of cybersecurity for ICT products, ICT services, and ICT processes in the Union, as well as for the purpose of preventing the fragmentation of the internal market with regard to cybersecurity certification schemes in the Union (Article 1(1)). The framework provides for a mechanism to establish European cybersecurity certification schemes, and to attest that ICT products, ICT services, and ICT processes, which have been evaluated in accordance with such schemes comply with specified security requirements for the purpose of protecting the availability, authenticity, integrity, or confidentiality of stored or transmitted or processed data, or the functions or services offered by, or accessible via, those products, services, and processes throughout their life cycle (Article 46(2)).

#### 12 The European Cybercrime Centre (EC3)

In turn, the European Cybercrime Centre (EC3) established by way of the Communication from the Commission to the European Parliament, and the Council, "Tackling Crime in our Digital Age: Establishing a European Cybercrime Centre", 46 is in charge of coordinating EU efforts aimed at tackling cybercrime. In addition, it operates as a technical-expertise centre specialising in this field. Its capacities, therefore, overlap with those of ENISA.

44Banasiński and Nowak (2018), p. 151.

45Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act) (Text with EEA relevance), OJ EU 219 L 151/15.

46Communication from the Commission to the Council and the European Parliament Tackling Crime in our Digital Age: Establishing a European Cybercrime Centre COM/2012/0140 final.

#### References

Banasiński C, Nowak W (2018) Europejski i krajowy system cyberbezpieczeństwa. In: Cyberbezpieczeństwo. Zarys wykładu, Warsaw

Chałubińska-Jentkiewicz K (2019) Cyberodpowiedzialność, Toruń

Kuliński M (2010) Regulacje komunikacji elektronicznej, Warsaw

Filip Radoniewicz PhD; legal advisor; adjunct in the Department of Cybersecurity Law and New Technologies at the Institute of Law, War Studies University, Warsaw; expert at the Academic Centre for Cybersecurity Policy, (War Studies University) and in the Ministry of Justice; he worked as an assistant judge (in the Fourth Criminal and Sixth Penitentiary Department of the Regional Court in Lublin); graduate of post-graduate studies: "European Union Law" at the Jagiellonian University, "Human Rights and Freedoms", co-organized by the Institute of Legal Sciences of the Polish Academy of Sciences and the Helsinki Foundation for Human Rights, and "Computer Network Administration" at the Lublin University of Technology; author or co-author of approximately fifty publications, mainly in the field of broadly understood criminal law, new technology law and human rights. Selected publications: F. Radoniewicz (2016) Odpowiedzialność karna za hacking i inne przestępstwa przeciwko danym komputerowym i systemom informatycznym / Criminal liability for hacking and other offences against computer data and information systems/, Wolters Kluwer, Warszawa; Ustawa o krajowym systemie cyberbezpieczeństwa. Komentarz /Act on the National Cybersecurity System. Commentary/ (2019) ed. W. Kitler, J. Taczkowska-Olszewska, F. Radoniewicz, CH. Beck, Warszawa.

Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

## National Cybersecurity System Act

#### Filip Radoniewicz

Abstract The Act of the 5th of July 2018 on the National Cybersecurity System (hereinafter referred to as "NCSA"), as indicated in the explanatory memorandum to this act, is on the one hand an attempt to comprehensively regulate the national cybersecurity system, which is a response to the constantly growing and dynamically changing cyber threats, which may affect the security of the state, the economy and society, and on the other hand it is the implementation of the Directive (EU) 2016/ 1148 of the European Parliament and of the Council of the 6th of July 2016 concerning measures for a high common level of security of network and information systems across the Union (the NIS Directive). The purpose of this chapter is a brief description of the act and a synthetic presentation of the solutions it contains, which will be discussed in detail later in the monograph.

#### 1 Introduction

The Act of the 5th of July 2018 on the National Cybersecurity System1 (hereinafter the NCSA), as indicated in the substantiation to its draft version is, on the one hand, an attempt at comprehensively regulating the national cybersecurity system, in response to the ever-growing and dynamically evolving cyber threats, which may potentially compromise the security of the State, the economy and society; on the other hand, it is intended to implement the above-mentioned NIS Directive.

The national cybersecurity system is organised to ensure cybersecurity at the national level, including the undisrupted provision of essential services and digital services, by attaining a sufficient level of security of information systems serving the

1 Act of 5 July 2018 on the National Cybersecurity System, consolidated text Polish Journal of Laws of 2020 item 1369 as amended.

F. Radoniewicz (\*)

Akademickie Centrum Polityki Cyberbezpieczeństwa/Academic Center for Cybersecurity Policy, Akademia Sztuki Wojennej w Warszawie/War Studies University in Warsaw, Warsaw, Poland

e-mail<EMAIL_ADDRESS>
purpose of providing such services, and by ensuring incident handling (Article 3 of the NCSA).

The Act regulates three problem areas: the organisation of the national cybersecurity system, and the duties and obligations of the entities, which form its part; the procedure for supervising and inspecting compliance with the provisions of the Act; and the scope of the Cybersecurity Strategy of the Republic of Poland (which is discussed in Chapter 13 of the NCSA).

The legislator has envisaged some exclusions in this respect, whether in whole or in part. Namely, providers of trust services and entities conducting treatment activities, established by the Head of the Internal Security Agency or the Head of the Intelligence service are wholly excluded from the Act, while telecommunications enterprises are excluded in the part regarding security and incident reporting requirements.

For the purpose of the NCSA, 19 definitions were formulated which, in view of the significance of this regulation, should be considered systemic definitions. First and foremost, the information system is understood as the ICT system (the teleinformation system) referred to in Article 3(3) of the Act of the 17th of February 2005 on the Computerisation of the Operations of Entities Performing Public Tasks, along with electronic data processed in that system (Article 2(14) of the NCSA). Second, cybersecurity is viewed as the ability of information systems to resist any action that compromises the confidentiality, integrity, availability and authenticity of processed data or related services rendered via such systems (Article 2(4) of the NCSA).2

In Article 2(5) of the NCSA, an incident is defined as an event, which has, or may have, an adverse impact on cybersecurity. The legislator has distinguished four categories of incidents: a critical incident (Article 2 (6) of the NCSA), a serious incident (Article 2 (7) of the NCSA), a substantial incident (Article 2 (8) of the NCSA), and an incident occurring within a public entity (Article 2 (9) of the NCSA):

2 See more e.g. Radoniewicz (2019), pp. 27–51.

4. critical incidents (Article 2 (6) of the NCSA), which are incidents of the most serious character, resulting in serious detriment to security or public order, international interests, economic interests, activities of public institutions, civic rights and freedoms, or human life and health, classified by the relevant CSIRT MON, CSIRT NASK or CSIRT GOV.3

#### 2 Entities of the National Cybersecurity System

The national cybersecurity system covers, in particular, operators of essential services (e.g. banks and enterprises from the energy sector), providers of digital services (e.g. entrepreneurs conducting activities via e-commerce platforms), authorities competent for cybersecurity, i.e. public institutions whose competences include supervising a given essential sector of economy (competent ministers, i.e. the minister competent for energy, the minister competent for transport, the minister competent for of maritime economy, the minister competent for inland navigation, the minister competent for health, the Minister of National Defence, the minister competent for computerisation and the Polish Financial Supervision Authority), the Computer Security Incident Response Teams established within the Internal Security Agency (CSIRT GOV), the Research and Academic Computer Network, National Research Institute (CSIRT NASK), the Ministry of National Defence (CSIRT MON), sectoral cybersecurity teams, the Point of Single Contact for cybersecurity, the Government Plenipotentiary for Cybersecurity, the College for Cybersecurity, and public entities listed in Article 4 of the NCSA. The above-listed entities can be divided into:

#### 3 CSIRT MON, CSIRT NASK and CSIRT GOV

While implementing the provisions of the NIS Directive on establishing Computer Security Incident Response Teams (CSIRTs), new entities were not established, but the use was made of those already operating at the national level, on which the

3 See more Chałubińska-Jentkiewicz et al. (2021), passim.

4 Radoniewicz (2019), p. 54.

obligations arising from the Directive were imposed. These included: CERT.GOV. PL, MIL-CERT.PL and CERT POLSKA, i.e. currently CSIRT GOV, CSIRT MIL and CSIRT NASK, respectively.

CSIRT GOV, the Government Computer Security Incident Response Team, operating since January 2008 within the Internal Security Agency (as CERT.GOV. PL). It is in charge of coordinating the handling of incidents reported by the entities listed in Article 26 (7) of the NCSA (government administration, the National Bank of Poland, and Bank Gospodarstwa Krajowego). In addition, it is entrusted with identifying, preventing and detecting threats to security, which are important for ensuring the continuity of the functioning of the national ICT systems, utilised by public administration authorities or a system of ICT networks forming part of critical infrastructure. CSIRT MON (formerly MIL-CERT.PL), operating within the Computer Incident Response System of the Ministry of National Defence (SRnIK RON), performs duties in the field of coordinating the processes of preventing, detecting and responding to computer incidents in the ICT systems and networks of that Ministry. CSIRT MON coordinates the process of handling incidents reported by the entities subordinated to or supervised by the Ministry of National Defence, including entities whose ICT systems or networks are included in a consolidated register of facilities, installations, devices and services forming parts of critical infrastructure, referred to in Article 5b (7) (1) of the Act of the 26th of April 2007 on Crisis Management, and entrepreneurs of particular economic and defensive significance. NASK (the Research and Academic Computer Network) is a national research institute operating since 1993, which conducts scientific activities, runs the national (.pl) domains register, and provides advanced ICT services. Since 1996, CERT POLAND, currently CSIRT NASK, has been operating within its framework, coordinating the process of handling incidents, which violate network security in the "civil area" and, which occur within public networks, i.e. incidents reported by other entities (not classified to any of the above-mentioned groups), including by operators of essential services (excluding operators of critical infrastructure), digital services providers, and local government authorities. Generally speaking, CSIRT NASK's competences cover all incidents reported by those entities, which do not fall within the competences of CSIRT GOV and CSIRT MON (while the latter two are always, regardless of the category of the reporting entity, in charge of terrorist incidents, and CSIRT MON is also in charge of any incidents related to national defence). It is thus referred to as the CERT of last resort, being the entity to whom all citizens (or, more generally, all natural persons and organisational units) may report incidents. Furthermore, if an entity cannot establish direct contact or receive the expected support from the party directly involved in the incident, the reporting party files its query with the CSIRT as a last resort.5 The tasks of, CSIRT MON, CSIRT NASK and CSIRT GOV are detailed described the chapter entitled "The main tasks of the team network to respond to computer security incidents in the light of the Act on the national cybersecurity system in Poland".

5 See Banasiński and Nowak (2018), pp. 161–162; Trąbiński (2018), pp. 76–78.

#### 4 The Competent Authorities for Cybersecurity

The competent authorities for cybersecurity are supreme authorities (i.e. competent ministers, depending on the sector indicated in Appendix I to the Act, in which a given operator of an essential service or a digital service provider conducts its activities, the minister competent for energy, the minister competent for transport, the minister competent for maritime economy, the minister competent for inland navigation, the minister competent for health, the Minister of National Defence, or the minister competent for computerisation), and one central authority (the Polish Financial Supervision Authority), issuing decisions on recognising an entity as the operator of an essential service (and also confirming the expiry of decisions made to that effect) and supervising those entities. Their duties are discussed in the chapter "The authorities competent for cybersecurity".

#### 5 The Minister Competent for Computerisation and the Minister of National Defense

The minister competent for computerisation and the Minister of National Defense play a special role in the national cybersecurity system. The cited regulations referred to them are described in detail in separate chapters in part II of the monograph. The contact point run by the minister competent for computerisation ensures the exchange of information between various entities responsible for cybersecurity. Its duties include collecting serious or substantial incident reports from other EU Member States, and passing them to CSIRT MON, CSIRT NASK, CSIRT GOV or sectoral cybersecurity teams; passing serious or substantial incident reports concerning two or more EU Member States to other Member States; representing the Republic of Poland in the Cooperation Group; cooperating with the European Commission in the field of cybersecurity; coordinating the cooperation between authorities competent for cybersecurity and public authorities with the competent authorities in EU Member States; and ensuring information exchange for the Cooperation Group and CSIRT network purposes.6

6 See more: chapter 16 "Role of Minister competent for computerisation in Cybersecurity system".

#### 6 The Government Plenipotentiary for Cybersecurity

This is a single-person function appointed and recalled by the President of the Council of Ministers to coordinate activities and to implement the government's policy directed at ensuring cybersecurity. The Plenipotentiary's primary duties include:

#### 7 The College for Cybersecurity

The College for Cybersecurity is a collegial opinion-making and advisory authority, operating within the Council of Ministers, regarding cybersecurity issues and activities conducted in this field by CSIRT, the Ministry of National Defence, CSIRT NASK, CSIRT GOV, sectoral cybersecurity teams and authorities competent for cybersecurity. The College is led by the President of the Council of Ministers and is composed of the minister competent for internal affairs, the Minister competent for computerisation, the Minister of National Defence, the minister competent for foreign affairs, the Head of the Chancellery of the President of the Council of Ministers, the Head of the National Security Bureau, and the Minister competent for coordinating the activities of special forces. The College meetings are also attended by the Director of the Government Centre for Security, the Head or Deputy Head of the Internal Security Agency, the Head or Deputy Head of the Military Counterintelligence Service, and the Director of the Research and Academic Computer Network and the National Research Institute.

In addition, the College draws up recommendations for the Council of Ministers on the activities directed at ensuring cybersecurity at the national level (Article 65 (2) of the NCSA).

#### 8 Incident Response Teams for a Given Sector or Subsector

The Act has envisaged the possibility for a computer security incident response team to be established by the authorities competent in cybersecurity, for any of the sectors or subsectors listed in the appendix to the Act (which is, therefore, not an obligatory body), i.e. a sectoral cybersecurity team (as referred to in Article 4 (6) of the NCSA) in charge of receiving serious incident reports within that sector or subsector. Such a team shall also be responsible for providing support in the handling of such incidents, supporting operators of essential services in performing their duties arising from the Act, analysing serious incidents, identifying associations between incidents, and formulating conclusions on incident handling, as well as for cooperating with the competent CSIRT (Article 44 (1) of the NCSA). Sectoral cybersecurity teams were not included in the initial draft act. A suggestion to include the possibility for these entities to be established was put forward during social consultations, and it appeared in numerous opinions, in which the fact that such teams would take account of the specificity of a given sector, thus enabling the support to be adjusted to operators of essential services, was seen as a major advantage. More about the Government Plenipotentiary and the College for Cybersecurity, see the chapter "The duties and legal status of the Government Plenipotentiary for Cybersecurity and the College for Cybersecurity".

#### 9 Operators of Essential Services

These are entities whose organisational units are situated in the territory of the Republic of Poland, and in respect of whom the authority competent for cybersecurity has issued a decision on recognising them as operators of essential services (i.e. services of the highest significance for the maintenance of social or economic activities, included in the list of essential services), e.g. banks, enterprises from the energy sector, etc. It seems that a situation cannot be ruled out in which natural persons conducting business activities are classified as such, along with legal persons and organisational units without a legal personality whose legal capacity arises from separate provisions (e.g. commercial law companies and partnerships).

The authorities competent for cybersecurity issue a decision on recognising an entity as the operator of an essential service. The list of operators of essential services is maintained by the minister competent for computerisation. Operators of essential services are obligated, in particular, to ensure the security of the information systems they use for the provision of essential services, Operators of essential services cooperate with the sectoral cybersecurity team (if applicable). In addition, they are obliged to ensure the carrying out, at least on a biennial basis, the security audit of the information system used for the provision of the essential service.

With the purpose of performing their cybersecurity duties, operators of essential services establish internal structures responsible for cybersecurity or enter into agreements with third parties for the provision of cybersecurity services. The organisational and technical conditions for entities providing cybersecurity services, and internal structures responsible for cybersecurity, are determined by the minister competent for computerisation, by way of a regulation, which must consider the Polish Norms, along with the need to ensure the security of the internal structures responsible for cybersecurity, entities providing cybersecurity services to operators of essential services, and information processed within such structures or entities.

#### 10 Digital Service Providers