Global Perspective – International Cybercrime Laws

Cyber crime knows no borders! A hacker in China can target an American bank using a Russian server. How do countries cooperate? Let's explore global cyber laws!

---

Major International Legal Frameworks

---

1. Budapest Convention on Cybercrime (2001)

First international treaty addressing internet crimes

Key Features

Membership: 68 countries (USA, UK, Japan, Australia - India NOT a member yet)

Covers:

• Illegal access, interception
• Data interference
• Computer-related fraud
• Child pornography
• Copyright infringement

Powers Granted:

• Real-time interception of communications
• Search & seizure of computer data
• Cross-border cooperation: Request evidence from other countries

Criticism:

• Privacy concerns: Too much surveillance power
• Developed countries favor: Crafted mainly by USA/Europe

Why India hasn't signed:

• Sovereignty concerns (foreign access to Indian data)
• Wants stronger provisions against terrorism
• Prefers bilateral treaties

---

##2. GDPR - Europe's Data Protection Law

General Data Protection Regulation (2018)

Core Principles

1. Consent: Explicit permission required for data collection

2. Right to Access: Know what data company has

3. Right to Erasure ("Right to be Forgotten"):

• Request data deletion
• Famous case: Google vs Mario Costeja (must remove old search results)

4. Data Portability: Download your data, move to competitor

5. Breach Notification: Inform users within 72 hours

GDPR Fines

Company	Fine	Violation
Meta (2023)	€1.2 billion	Transferring EU data to USA
Amazon (2021)	€746 million	Improper data processing
Google (2019)	€50 million	Lack of transparency
WhatsApp (2021)	€225 million	Privacy policy violations

Global Impact

Even if you're not in EU, GDPR applies if:

• You serve EU customers
• You monitor EU users

Example: Flipkart sells to German tourist in India → GDPR applies!

Result: Most global companies follow GDPR worldwide (easier than separate compliance)

---

3. USA - CFAA & Other Laws

A. Computer Fraud and Abuse Act (CFAA) - 1986

Criminalizes:

• Unauthorized access to computers
• "Exceeding authorized access" (controversial!)
• Trafficking passwords
• Damaging computers

Penalties: Up to 20 years for severe cases

Famous Cases:

Aaron Swartz (2011):

• Downloaded academic papers from JSTOR
• Charged under CFAA - faced 35 years
• Committed suicide (2013) - sparked reform debates
• Criticized: Punishment too harsh for non-malicious act

Kevin Mitnick:

• Legendary hacker, arrested 1995
• 5 years prison under CFAA
• Now ethical hacker/consultant

B. CLOUD Act (2018)

Clarifying Lawful Overseas Use of Data Act

• US law enforcement can demand data from US companies even if stored abroad
• Example: Microsoft servers in Dublin, Ireland - USA can still demand data
• Controversy: Conflicts with EU data sovereignty

C. State Laws (California - CCPA)

California Consumer Privacy Act (2020):

• Similar to GDPR but only for California
• Delete data, opt-out of sale
• Fines: Up to $7,500 per violation

---

4. China - Cybersecurity Law (2017)

Key Provisions

1. Data Localization:

• All data about Chinese citizens must be stored in China
• Cannot transfer abroad without approval

2. Real-Name Registration:

• No anonymous accounts
• WeChat, Weibo require ID verification

3. Government Access:

• Companies must cooperate with investigations
• Provide "technical support" (backdoors)

4. Great Firewall:

• Blocks Google, Facebook, Twitter, WhatsApp
• VPNs illegal (unless government-approved)

Impact:

• Apple stores iCloud data in China (on Chinese servers)
• LinkedIn shut down China service (2021) - couldn't comply with censorship

---

5. Other Country Approaches

Australia - Encryption Backdoors

TOLA Act (2018):

• Can force companies to build backdoors into encryption
• Help decrypt WhatsApp, Signal messages
• Criticism: Weakens security for everyone

Singapore - Fake News Law (2019)

Protection from Online Falsehoods and Manipulation Act:

• Government can order "corrections" next to posts
• Or remove content entirely
• Criticism: Tool for censorship?

Russia - Sovereign Internet Law (2019)

• Internet traffic must route through Russia-controlled servers
• Government can isolate Russia from global internet (kill switch)

Japan - Act on Prohibition of Unauthorized Computer Access (1999)

• Similar to CFAA
• Unauthorized access = up to 3 years

---

International Cooperation Mechanisms

1. Interpol Cybercrime Program

• 194 member countries
• Coordinates investigations
• IGCI (Interpol Global Complex for Innovation) - Singapore
• Example: Operation Night Fury (2020) - 1,000+ arrests across 20 countries

2. Mutual Legal Assistance Treaties (MLATs)

• Bilateral agreements for evidence sharing
• India has MLATs with USA, UK, Canada, Australia

Problem: Slow! (6-18 months response time)

3. 24/7 Network (Budapest Convention)

• Direct contact points for urgent cases
• Target: Respond in 8 hours
• Reality: Often takes days/weeks

---

Challenges in International Cyber Law

1. No Universal Agreement

Different priorities:

• USA: National security, counter-terrorism
• EU: Privacy, data protection
• China/Russia: Sovereignty, censorship
• India: Development, localization

Result: Fragmented approach

2. Jurisdiction Conflicts

Example - Facebook Data Case:

• EU: Data must stay in EU (GDPR)
• USA: We can demand it (CLOUD Act)
• Conflict! Who wins?

Solution: Privacy Shield agreement (2016) - but invalidated (2020) by EU court!

3. Safe Harbors vs Data Localization

Debate:

• West: Data should flow freely globally (efficiency)
• India/China/Russia: Data must stay local (sovereignty, security)

India's stance: Payment data (RBI) must be local, other data can go abroad (with safeguards)

4. Encryption Debate

Law Enforcement: Need backdoors to catch criminals/terrorists

Tech Companies: Backdoors weaken security for everyone, enable mass surveillance

Ongoing battle!

---

Comparative Analysis

Aspect	India	USA	EU (GDPR)	China
Primary Law	IT Act 2000	CF AA	GDPR	Cybersecurity Law
Privacy Focus	Medium	Low-Medium	Very High	Low
Data Localization	Partial (payments)	No	No	Yes (strict)
Max Penalty	₹1 cr (IT Act)	20 years	4% revenue	Severe (+ ban)
Budapest Member	No	Yes	Yes	No
Encryption Stance	Mandatory decryption (Section 69)	Backdoor debate	Pro-encryption	Mandatory backdoors

---

Emerging Global Norms

1. Right to Privacy = Fundamental Right

• Recognized: EU, India (Puttaswamy judgment), California
• Becoming global standard

2. Data Breach Notification

• Most countries now require disclosure within 72 hours

3. Child Online Safety

• Universal agreement on strict child porn laws
• Example: Section 67B (India), similar in all countries

4. Critical Infrastructure Protection

• Power grids, financial systems designated as critical
• Special cyber security regulations

---

Summary

• Budapest Convention: 68 countries, first cyber crime treaty (India not member)
• GDPR (EU): Strongest privacy law, 4% revenue fines (Meta fined €1.2B), global impact
• CFAA (USA): Up to 20 years for hacking, Aaron Swartz case controversy
• China: Data localization mandatory, Great Firewall, government access required
• Cooperation: Interpol (194 countries), MLATs (slow 6-18 months), 24/7 Network
• Challenges: No universal law, jurisdiction conflicts, encryption debate
• Comparison: India (medium privacy), USA (security focus), EU (privacy focus), China (control focus)

---

Quiz Time! 🎯

---

Next Chapter: Internet Governing Bodies! 🌐