IGF 2022 WS #357 Cyberattacks and e-evidence – attribution and accountability

Description:
Cybercrime is causing trillions of Euros in damage and harm, is disrupting the functioning of critical infrastructure that societies rely upon, is extorting public and private sector organisations through ransom, is attacking election processes and democratic institutions, is violating the fundamental rights of individuals and is even leading to serious injury or death through attacks on health institutions. Cybercrime and other forms of cyberattacks are growing threats to the core values of societies, that is, human rights, democracy and the rule of law, and to international peace and stability. Information and data is needed for detection, investigation and attribution of cyberattacks and the ability to secure e-evidence is essential to ensure accountability for cybercrimes as well as most other types of crime with a digital footprint. For example: • In May 2022, several weeks of ransomware attacks against Costa Rica’s government institutions required the declaration of a state of emergency. • The critical infrastructure of Ukraine had been the target of cyberattacks for many years, and such attacks also accompany the current aggression by the Russian Federation against Ukraine. In 2017, the NotPetya ransomware initially targeted Ukraine before spreading around the world. • Any type of crime may entail electronic evidence. This also applies to war crimes. Tapping into data (satellite images, photographs, videos, audio recordings, DNA profiles etc) and securing electronic evidence for criminal justice purposes may help ensure accountability for such crimes. Obtaining volatile electronic evidence is a complex challenge. It is increasingly stored in foreign, multiple, shifting or unknown jurisdictions and often held by private sector entities. Effective public/private and cross-border cooperation – subject to safeguards – is required to ensure the preservation and disclosure of e-evidence. New tools are now available under the 2nd Additional Protocol to the Convention on Cybercrime on enhanced cooperation and disclosure of electronic evidence that was opened for signature on 12 May 2022. Agenda: 1. Setting the scene 2. Cyberattacks and e-evidence: examples illustrating the challenges 3. Securing electronic evidence: initiatives and new tools available - Current tools in practice - 2nd Additional Protocol on e-evidence to the Convention on Cybercrime - Specific challenge: e-evidence of war crimes 4. Conditions and safeguards: How to ensure that human rights and rule of law requirements are met 5. Looking ahead: Cooperation and capacity building 6. Q&A session with the audience in the room and online