On 23 November 2001, in Budapest, the Council of Europe opens for signature the Convention on Cybercrime, ETS No. 185. The authentic texts are English and French. Depositary: the Secretary General of the Council. Observer states sat at the drafting table: Canada, Japan, the Philippines, South Africa, the United States. The Committee of Ministers had adopted it at its 109th session, on 8 November, in Strasbourg.

The preamble calls for a common criminal policy: suitable legislation and rapid cooperation. The Convention is the first international treaty to criminalise, in a single frame, attacks on the confidentiality, integrity and availability of systems and data. It creates no court. Each Party transposes into domestic law.

Chapter II, Articles 2–10: illegal access, illegal interception, data interference, system interference, misuse of devices, computer-related forgery, computer-related fraud, offences related to child pornography, infringements of copyright and neighbouring rights. Articles 16–21: expedited preservation of stored data, production order, search and seizure of computer data, real-time collection of traffic data, interception of content data. Article 15: conditions and safeguards, including the European Convention on Human Rights, the 1966 Covenant and the principle of proportionality.

Article 32: transborder access to stored data, with consent or where publicly available, without mutual assistance. Article 35: the 24/7 network, a standing point of contact for technical advice, data preservation, evidence and locating suspects. Article 36: member States and non-member States that took part in the drafting may sign. It enters into force on the first day of the month following three months after five States, including at least three Council members, have consented to be bound. The date: 1 July 2004.

Additional Protocol ETS 189, opened in Strasbourg on 28 January 2003, criminalises racist and xenophobic material through computer systems. It enters into force on 1 March 2006. The second protocol, CETS 224, on enhanced cooperation and disclosure of electronic evidence, is opened on 12 May 2022. The United States signs in Budapest; the Senate ratifies in August 2006; for Washington the Convention takes effect on 1 January 2007.

Russia refuses: it would violate sovereignty. India did not take part in the drafting and has not acceded; since 2018, after a surge in cybercrime, New Delhi has been reconsidering. Ireland and South Africa have signed without ratifying. The Council of Europe counts 82 Parties. The Convention remains a working frame, not a dead letter.

Image: Elekes Andor, Hungarian Parliament Building from across the Danube, 27 March 2017, CC BY-SA 4.0, Wikimedia Commons. Cropped to 16:9.

Source consulted: Budapest Convention on Cybercrime. Treaty text: Convention on Cybercrime, Budapest, 23.XI.2001 (ETS No. 185).