    [Senate Treaty Document 108-11]
    [From the U.S. Government Publishing Office]

    108th Congress                                              Treaty Doc.
                                     SENATE
     1st Session                                                     108-11
    _______________________________________________________________________

                            CONVENTION ON CYBERCRIME

                                   __________

                                    MESSAGE

                                      from

                       THE PRESIDENT OF THE UNITED STATES

                                  transmitting

         COUNCIL OF EUROPE CONVENTION ON CYBERCRIME (THE ``CYBERCRIME
      CONVENTION'' OR THE ``CONVENTION''), WHICH WAS SIGNED BY THE UNITED
                          STATES ON NOVEMBER 23, 2001

     November 17, 2003.--Convention was read the first time, and together
      with the accompanying papers, referred to the Committee on Foreign
         Relations and ordered to be printed for the use of the Senate
                             LETTER OF TRANSMITTAL

                                  ----------

                                               The White House,
                                                     November 17, 2003.
    To the Senate of the United States:
        With a view to receiving the advice and consent of the
    Senate to ratification, I transmit herewith the Council of
    Europe Convention on Cybercrime (the ``Cybercrime Convention''
    or the ``Convention''), which was signed by the United States
    on November 23, 2001. In addition, for the information of the
    Senate, I transmit the report of the Department of State with
    respect to the Convention and the Convention's official
    Explanatory Report.
        The United States, in its capacity as an observer at the
    Council of Europe, participated actively in the elaboration of
    the Convention, which is the only multilateral treaty to
    address the problems of computer-related crime and electronic
    evidence gathering. An overview of the Convention's provisions
    is provided in the report of the Department of State. The
    report also sets forth proposed reservations and declarations
    that would be deposited by the United States with its
    instrument of ratification. With these reservations and
    declarations, the Convention would not require implementing
    legislation for the United States.
        The Convention promises to be an effective tool in the
    global effort to combat computer-related crime. It requires
    Parties to criminalize, if they have not already done so,
    certain conduct that is committed through, against, or related
    to computer systems. Such substantive crime include offenses
    against the ``confidentiality, integrity and availability'' of
    computer data and systems, as well as using computer systems to
    engage in conduct that would be criminal if committed outside
    the cyber-realm, i.e., forgery, fraud, child pornography, and
    certain copyright-related offenses. The Convention also
    requires Parties to have the ability to investigate computer-
    related crime effectively and to obtain electronic evidence in
    all types of criminal investigations and proceedings.
        By providing for broad international cooperation in the
    form of extradition and mutual legal assistance, the Cybercrime
    Convention would remove or minimize legal obstacles to
    international cooperation that delay or endanger U.S.
    investigations and prosecutions of computer-related crime. As
    such, it would help deny ``safe havens'' to criminals,
    including terrorists, who can cause damage to U.S. interests
    from abroad using computer systems. At the same time, the
    Convention contains safeguards that protect civil liberties and
    other legitimate interests.
        I recommend that the Senate give early and favorable
    consideration to the Cybercrime Convention, and that it give
    its advice and consent to ratification, subject to the
    reservations, declarations, and understanding described in the
    accompanying report of the Department of State.

                                                        George W. Bush.
                              LETTER OF SUBMITTAL

                                  ----------

                                           Department of State,
                                        Washington, September 11, 2003.
    The President,
    The White House.
        The President: I have the honor to submit to you, with a
    view to its transmittal to the Senate for advice and consent to
    ratification, the Council of Europe (``COE'') Convention on
    Cybercrime (``the Cybercrime Convention'' or ``the
    Convention''), which was adopted by the COE's Committee of
    Ministers on November 8, 2001. On November 23, 2001, the United
    States, which actively participated in the negotiations in its
    capacity as an observer state at the COE, signed the Convention
    at Budapest. I recommend that the Convention be transmitted to
    the Senate for its advice and consent to ratification.
        Accompanying the Convention is its official Explanatory
    Report, which was also adopted by the COE's Committee of
    Ministers on November 8, 2001. The Explanatory Report, which
    was drafted by the Secretariat of the COE and the delegations
    participating in the negotiations, provides a thorough analysis
    of the Convention. It is customary for the COE to prepare such
    reports in connection with its conventions. Under established
    COE practice, such reports reflect the understanding of the
    Parties in drafting convention provisions and, as such, are
    accepted as fundamental bases for interpretation of COE
    conventions. The Explanatory Report would be provided to the
    Senate for its information.
        The Cybercrime Convention is the first multilateral treaty
    to address specifically the problem of computer-related crime
    and electronic evidence gathering. With the growth of the
    Internet, attacks on computer networks have caused large
    economic losses and created great risks for critical
    infrastructure systems. Examples of such cybercrime activities
    include the deliberate transmission of ``viruses,'' ``denial of
    service'' attacks, and ``hacking'' into government and
    financial institution computer systems. Criminals around the
    world are also using computers to commit traditional crimes,
    such as fraud, child pornography and copyright piracy. In
    addition, computer networks provide organized crime syndicates
    and terrorists means with which to plan, support, coordinate,
    and commit their criminal activities.
        In response to this growing problem of computer-related
    crime, the COE established in 1997 the Committee of Experts on
    Crime in Cyber-space (``PC-CY'') to undertake negotiation of
    the Cybercrime Convention. States participating in the work of
    the PC-CY included the United States, COE member states,
    Canada, Japan, and South Africa. Beginning in April 2000,
    drafts of the Convention were made public by the COE, so that
    interested members of the public could review and provide
    comments to the PC-CY. In addition, U.S. Government officials
    sought to make information about the Convention available to
    interested members of the public. Since its adoption, 37 states
    have signed the Convention, including three COE member states
    that have also ratified it.
        The Convention establishes a treaty-based framework that
    requires Parties to criminalize certain conduct related to
    computer systems and to ensure that certain investigative
    procedures are available to enable their domestic law
    enforcement authorities to investigate cybercrime offenses
    effectively and obtain electronic evidence (such as computer
    data) of crime. In a manner analogous to other law enforcement
    treaties to which the United States is a party, the Convention
    also requires Parties to provide broad international
    cooperation in investigating computer-related crime and
    obtaining electronic evidence.
        By requiring Parties to establish certain substantive
    offenses, the Convention will help deny ``safe havens'' to
    criminals, including terrorists, who can cause damage to U.S.
    interests from abroad using computer systems. Similarly, by
    requiring Parties to have certain procedural authorities, the
    Convention will enhance the ability of foreign law enforcement
    authorities to investigate crimes effectively and
    expeditiously, including those committed by local criminals
    against U.S. individuals, institutions and interests. Since
    cybercrimes are often committed via transmissions routed
    through foreign Internet Service Providers (``ISPs'') and
    criminals increasingly seek to hide evidence of their crimes
    abroad, the Convention would also provide mechanisms for U.S.
    law enforcement authorities to work cooperatively with their
    foreign counterparts to trace the source of a computer attack
    and to obtain electronic evidence stored outside the United
    States. Thus, the Convention's obligations on Parties to
    establish domestic law enforcement frameworks and create a
    regime of international cooperation would enhance the United
    States' ability to receive, as well as render, international
    cooperation in preventing, investigating and prosecuting
    computer-related crime.
        The Convention would not require implementing legislation
    for the United States. As discussed below, existing U.S.
    federal law, coupled with six reservations and four
    declarations, would be adequate to satisfy the Convention's
    requirements for legislation. All of these reservations and
    declarations are envisaged by the Convention itself. Since
    other provisions contained in the Convention are self-executing
    (e.g., articles relating to extradition and mutual assistance),
    they would not require implementing legislation either.
        The Cybercrime Convention consists of 48 articles divided
    among four chapters: (1) ``Use of terms''; (2) ``Measures to be
    taken at the national level''; (3) ``International co-
    operation''; and (4) ``Final provisions.'' A detailed, article-
    by-article analysis is contained in the accompanying
    Explanatory Report. In addition, the following is an overview
    of the major Convention obligations and a description of the
    proposed reservations, declarations, and understanding.

                      CHAPTER I--USE OF TERMS (ARTICLE 1)

        Chapter I, Article 1, contains definitions of four key
    terms that are used throughout the Convention: ``computer
    system,'' ``computer data,'' ``service provider,'' and
    ``traffic data.'' ``[C]omputer system'' is defined to mean any
    device or group of inter-connected or related devices, where
    one or more of them performs automatic processing of data
    pursuant to a program. As elaborated upon in the Explanatory
    Report (paragraph 23), the Convention's definition of
    ``computer system'' may include input, output and storage
    facilities and can be either a ``stand alone'' system or one
    that is networked with similar devices. The term ``service
    provider'' includes public and private entities that provide
    users with the ability to communicate by means of a computer
    system, as well as other entities that process or store
    computer data for such entities or users. The definition of
    ``computer data'' encompasses data in electronic or another
    form suitable for processing by a computer system. As defined
    in Article 1, ``traffic data'' does not relate to the content
    of a communication but instead is data generated by computers
    in a communication chain that relates to the communication's
    origin, destination, route, time, date, size, duration, or type
    of underlying service. As such, traffic data can provide
    information about the source of a computer-related crime as
    well as other evidence of the crime. The Explanatory Report
    (paragraph 22) explains that it is not necessary for Parties to
    copy verbatim these definitions into their laws provided the
    concepts are covered, as they are under existing U.S. domestic
    law.

     CHAPTER II--MEASURES TO BE TAKEN AT THE NATIONAL LEVEL (ARTICLES 2-22)

        Chapter II consists of three parts, covering substantive
    criminal offenses that Parties are to establish; procedural
    mechanisms that Parties must have under their respective laws;
    and provisions requiring Parties to establish jurisdiction over
    the offences to be established. As discussed further in
    connection with Article 41 (``Federal clause''), a federal
    state may reserve the right to assume obligations under Chapter
    II ``consistent with its fundamental principles governing the
    relationship between its central government and constituent
    States or other similar territorial entities.'' In explaining
    this provision, the Explanatory Report (paragraph 317) makes
    clear that the United States could therefore implement its
    obligations under Chapter II through its federal criminal law,
    which ``generally regulates conduct based on its effects on
    interstate or foreign commerce, while matters of minimal or
    purely local concern are traditionally regulated by constituent
    States.'' Thus, provided it invokes the Federal clause
    reservation provided for in Article 41, the United States would
    be able to rely on its existing federal laws, which, because of
    the architecture of the Internet and computer networks, provide
    for broad coverage of the obligations contained in Chapter II.
    The United States would not be obligated to criminalize
    activity that otherwise would not merit an exercise of federal
    jurisdiction. Similarly, whether or not constituent State laws
    conform to the Convention would not be an issue since the
    United States, having invoked the federal clause reservation,
    would not be required to implement the Convention's obligations
    at that level.

    Substantive criminal law (Articles 2-13):

        Articles 2-10 of the Convention require Parties to
    criminalize domestically, if they have not already done so,
    certain conduct that is committed through, against or related
    to computer systems. Included in these substantive crimes are
    the following offenses against the ``confidentiality, integrity
    and availability'' of computer data and systems: ``Illegal
    access'' (Article 2), ``Illegal interception'' (Article 3),
    ``Data interference'' (Article 4), ``System interference''
    (Article 5), and ``Misuse of devices'' (Article 6). Also
    included are offenses involving the use of computer systems to
    engage in conduct that is presently criminalized outside the
    cyber-realm, i.e., ``Computerrelated forgery'' (Article 7),
    ``Computer-related fraud'' (Article 8), ``Offences related to
    child pornography'' (Article 9), and ``Offences related to
    infringements of copyright and related rights'' (Article 10).
        For criminal liability to attach under the offenses to be
    established pursuant to Articles 2-10, the conduct in question
    must be committed intentionally. As the Explanatory Report
    (paragraph 113) notes, ``wilfully'' was used in lieu of
    ``intentionally'' in the context of Article 10 infringements so
    as to conform with Article 61 of the Agreement on Trade-Related
    Aspects of Intellectual Property Rights (``TRIPS''), which
    employs the term ``wilful.'' In addition, the Report (paragraph
    39) explains that determinations of what constitutes the
    necessary criminal intent are left to each Party's
    interpretation under its laws.
        The obligation to establish offenses under the Convention
    extends only to acts committed ``without right.'' This concept
    recognizes that in certain instances conduct may be legal or
    justified by established legal defenses, such as consent, or by
    other principles or interests that preclude criminal liability.
    Thus, as explained in the Explanatory Report (paragraph 38),
    the Convention does not require the criminalization of actions
    undertaken pursuant to lawful government authority (e.g., steps
    taken by a Party's government to investigate criminal offenses
    or to protect national security). Additional guidance regarding
    the contours of ``without right'' is provided in the
    Explanatory Report (e.g., paragraphs 43, 47, 48, 58, 62, 68,
    76, 77, 89, 103) in the context of the various offenses to be
    established. Such guidance makes it clear that authorized
    transmissions, legitimate and common activities inherent in the
    design of computer networks, and legitimate and common
    operating or commercial practices should not be criminalized.
    The condition that conduct be committed ``without right'' is
    explicitly stated in all but one of the enumerated offenses.
    The one exception is Article 10 (``Offences related to
    infringement of copyright and related rights''), where it was
    determined that the term ``infringement'' already captured the
    concept of ``without right'' (Explanatory Report, paragraph
    115).
        The requisite elements for the various offenses are set
    forth in Articles 2-10. Except for Article 5 (``System
    interference'') and Article 8 (``Computer-related fraud''),
    these articles also provide that a Party may require certain
    additional criminalization elements or may otherwise limit
    application of a criminalization obligation, provided a
    permitted declaration or reservation is made in accordance with
    Articles 40 and 42. This approach seeks to promote uniform
    application of the Convention while recognizing that permitting
    Parties to maintain established concepts in their domestic law
    will broaden acceptance of the Convention. As discussed below,
    in order to implement the Convention's substantive criminal law
    obligations under existing federal criminal law, the United
    States would avail itself of declarations and reservations
    provided for in Articles 2, 4, 6, 7, 9, 10, and 41.
        In terms of the specific offenses against the
    confidentiality, integrity and availability of computer data
    and systems, Article 2 (``Illegal access'') requires a Party to
    criminalize unauthorized intrusions into computer systems
    (often referred to as ``hacking,'' ``cracking'' or ``computer
    trespass''). Such intrusions can result in damage to computer
    systems and data, and compromise the confidentiality of data.
    Under Article 2, a Party may require certain additional
    elements for there to be criminal liability, including that the
    offense must be committed with an intent to obtain computer
    data. In order to correspond with the requirement contained in
    existing U.S. computer crime law, 18 U.S.C. Sec. 1030(a)(2) &
    (b), I recommend that the following declaration be included in
    the U.S. instrument of ratification:
              The Government of the United States of America
            declares, pursuant to Articles 2 and 40, that under
            United States law, the offense set forth in Article 2
            (``Illegal access'') includes an additional requirement
            of intent to obtain computer data.
        Article 3 (``Illegal interception'') seeks to protect the
    privacy of non-public computer data transmissions from
    activities such as monitoring and recording through technical
    means (Explanatory Report, paragraph 54).
        Article 4 (``Data interference'') requires a Party to
    criminalize ``the damaging, deletion, deterioration, alteration
    or suppression of computer data,'' which the Explanatory Report
    (paragraphs 60 and 61) makes clear would include the inputting
    of malicious codes, such as viruses, that can threaten the
    integrity, functioning or use of computer data and programs.
    Under Article 4(2), a Party may reserve the right to require
    that such conduct result in serious harm. In order to maintain
    federal jurisdictional damage thresholds, e.g., 18 U.S.C.
    Sec. 1030(a)(5)(B), I recommend that the following reservation
    be included in the U.S. instrument of ratification:
              The Government of the United States of America,
            pursuant to Articles 4 and 42, reserves the right to
            require that the conduct result in serious harm, which
            shall be determined in accordance with applicable
            United States federal law.
        Article 5 (``System interference'') requires a Party to
    criminalize acts with respect to data which seriously hinder
    the functioning of a computer system. Examples of such acts are
    provided by the Explanatory Report (paragraph 67) and include
    using programs to generate denial of service attacks and
    transmitting malicious code, such as viruses, to stop or slow
    the functioning of a computer system.
        The offenses to be established under Articles 2-5 are
    frequently committed using computer programs or access tools,
    such as stolen passwords or access codes. To deter their use
    for the purpose of committing Article 2-5 offenses, Article 6
    (``Misuse of devices'') requires a Party to criminalize the
    possession, production, sale, procurement for use, import,
    distribution, or making available of such items. As recognized
    in the Explanatory Report (paragraph 73), however, devices such
    as computer programs can be used for either criminal or non-
    criminal purposes (so-called ``dual use'' devices). To avoid
    criminalizing activities related to devices intended for
    legitimate purposes, the Article provides that devices must be
    ``designed or adapted primarily for the purpose of committing''
    an Article 2-5 offense. Moreover, Article 6 provides that
    activities in relation to devices, passwords or access codes,
    including their production and distribution, must be done with
    the intent that such devices, passwords or access codes be used
    for the purpose of committing an Article 2-5 offense. The
    Article also makes clear that it ``shall not be interpreted''
    to impose criminal liability on the authorized testing or
    protection of a computer system.
        With respect to the possession offense, Article 6(1)(b)
    provides that a Party may require that a number of items be
    possessed before criminal liability attaches. United States
    law, 18 U.S.C. Sec. 1029(a)(3), requires that a person possess
    fifteen or more access devices in order for there to be federal
    jurisdiction. I therefore recommend that the following
    declaration be included in the U.S. instrument of ratification:
              The Government of the United States of America
            declares, pursuant to Articles 6 and 40, that under
            United States law, the offense set forth in paragraph
            (1)(b) of Article 6 (``Misuse of devices'') includes a
            requirement that a minimum number of items be
            possessed. The minimum number shall be the same as that
            provided for by applicable United States federal law.
        Article 6(3) provides that a Party may reserve the right
    not to apply the criminalization requirement for the misuse of
    items, so long as the reservation does not concern the sale,
    distribution or making available of passwords, access codes or
    similar data with the intent that they be used for committing
    an Article 2-5 offense. United States law does not directly
    criminalize the possession or distribution of data interference
    and system interference devices. Therefore, I recommend that
    the United States limit its obligations accordingly by
    including the following reservation in its instrument of
    ratification:
              The Government of the United States of America,
            pursuant to Articles 6 and 42, reserves the right not
            to apply paragraph (1)(a)(i) and (1)(b) of Article 6
            (``Misuse of devices'') with respect to devices
            designed or adapted primarily for the purpose of
            committing the offenses established in Article 4
            (``Data interference'') and Article 5 (``System
            interference'').
        With respect to the substantive crimes to be established
    which involve the use of computer systems to commit acts that
    would normally be considered criminal if committed outside the
    cyber-realm, Article 7 (``Computer-related forgery'') seeks to
    protect the security and reliability of data by creating an
    offense akin to the forgery of tangible documents. The Article
    requires a Party to criminalize the input, alteration,
    deletion, or suppression of computer data, resulting in
    inauthentic data with the intent that it be considered or acted
    upon for legal purposes as if it were authentic, regardless of
    whether the data is directly readable and intelligible. It also
    allows a Party to require intent to defraud, or similar
    dishonest intent, before criminal liability attaches. In order
    to enable the offense to be covered under applicable U.S. fraud
    statutes, I recommend that the following declaration be
    included in the U.S. instrument of ratification:
              The Government of the United States of America
            declares, pursuant to Articles 7 and 40, that under
            United States law, the offense set forth in Article 7
            (``Computer-related forgery'') includes a requirement
            of intent to defraud.
        Article 8 (``Computer-related fraud'') requires a Party to
    criminalize manipulations of data that are done with fraudulent
    intent and to procure an unlawful economic benefit. As
    indicated in the Explanatory Report (paragraph 86), an example
    of an activity that would be encompassed by the Article 8
    offense is the serious problem of on-line credit card fraud.
        Articles 9 and 10 deal with content-related offenses.
    Article 9. (``Offences related to child pornography'') requires
    a Party to criminalize various aspects of the production,
    possession, procurement, and distribution of child pornography
    through computer systems. The Explanatory Report (paragraph 93)
    notes that it was believed important to include Article 9
    because of the increasing use of the Internet to distribute
    materials created through sexual exploitation of children. In
    addition to covering visual depictions of an actual minor
    engaged in sexually explicit conduct, the Article covers images
    of a person appearing to be a minor engaged in such conduct as
    well as realistic images representing a minor engaged in such
    conduct (so-called ``virtual'' child pornography). Article
    9(4), however, provides that a Party may reserve the right not
    to criminalize cases of a person appearing to be a minor or
    realistic images representing a minor engaged in such conduct.
    These categories were covered under U.S. law by 18 U.S.C.
    Sec. 2256(8)(B), (C) & (D), and to the extent that such images
    are obscene, certain conduct relating to such obscene images is
    also covered by federal obscenity law. In light of the U.S.
    Supreme Court's decision in Ashcroft v. Free Speech Coalition,
    535 U.S. 234 (2002), ruling Sec. 2256(8)(B) & (D)
    unconstitutional, I recommend that the following reservation be
    included in the U.S. instrument of ratification:
              The Government of the United States of America,
            pursuant to Articles 9 and 42, reserves the right to
            apply paragraphs (2)(b) and (c) of Article 9 only to
            the extent consistent with the Constitution of the
            United States as interpreted by the United States andas
    provided for under its federal law, which includes, for example, crimes
    of distribution of material considered to be obscene under applicable
    United States standards.
        Article 10 (``Offences related to infringement of copyright
    and related rights'') is directed at infringements of
    intellectual property rights, i.e., copyright and related
    rights, by means of a computer system and on a commercial
    scale. Its approach differs from the other articles requiring
    the establishment of offenses in that it defines the offenses
    by reference to other international agreements, which are set
    forth in the Article. Specifically, a Party is required under
    Article 10 to establish as criminal offenses acts that are
    committed ``wilfully, on a commercial scale and by means of a
    computer system'' and that are defined as infringements of
    copyright or related rights, under its domestic law, pursuant
    to obligations it has undertaken in the referenced agreements.
    As indicated in the Explanatory Report (paragraphs 110 and
    111), a Party's obligations under this Article are framed only
    by those agreements that have entered into force and to which
    it is party. Moreover, a Party's obligations under Article 10
    may be limited by reservations or declarations it has made with
    respect to the referenced agreements. For the purpose of
    determining the United States' obligations under Article 10,
    the relevant referenced agreements are the four to which the
    United States is party, i.e., the Paris Act of 24 July 1971 of
    the Bern Convention for the Protection of Literary and Artistic
    Works, the Agreement on the Trade-Related Aspects of
    Intellectual Property Rights, the WIPO Copyright Treaty, and
    the WIPO Performances and Phonograms Treaty. Of these, the
    latter two entered into force after the Cybercrime Convention
    was opened for signature.
        Because, among the referenced agreements, only TRIPS
    requires criminal sanctions, Article 10 permits a Party to
    reserve the right not to impose criminal liability in limited
    circumstances provided other ``effective remedies'' are
    available and the reservation does not derogate from its
    minimum obligations under applicable international instruments,
    which the Explanatory Report (paragraph 116) makes clear refers
    to TRIPS. Because U.S. law provides for other effective
    remedies but not criminal liability for infringements of
    certain rental rights, I recommend that the following
    reservation be included in the U.S. instrument of ratification:
              The Government of the United States of America,
            pursuant to Articles 10 and 42, reserves the right to
            impose other effective remedies in lieu of criminal
            liability under paragraphs 1 and 2 of Article 10
            (``Offenses related to infringement of copyright and
            related rights'') with respect to infringements of
            certain rental rights to the extent the criminalization
            of such infringements is not required pursuant to the
            obligations the United States has undertaken under the
            agreements referenced in paragraphs 1 and 2.
        Article 11 (``Attempt and aiding or abetting'') provides
    that aiding or abetting the commission of any of the offenses
    set forth in Articles 2-10 shall also be made criminal.
    Similarly, a Party is required to criminalize an attempt to
    commit certain of these offenses, to the extent specified in
    paragraph 2 of the Article. As with the Article 2-10 offenses,
    aiding or abetting or an attempt must be committed
    intentionally. Thus, as indicated in the Explanatory Report
    (paragraph 119), the fact that an ISP is a mere conduit for
    criminal activity, such as the transmission of child
    pornography or a computer virus, does not give rise to criminal
    liability for the ISP, because it would not share the criminal
    intent required for aiding and abetting liability. Further, the
    Explanatory Report (paragraph 119) makes clear the Parties'
    understanding that ``there is no duty on a service provider to
    actively monitor content to avoid criminal liability under this
    provision.''
        Article 12 (``Corporate liability'') requires the adoption
    of criminal, civil or administrative measures to ensure that a
    corporation or similar legal person can be held liable for the
    offenses to be established in accordance with the Convention,
    where such offenses are committed for its benefit by a natural
    person who has a leading position in the corporation or legal
    person. The Article also provides for liability where a lack of
    supervision or control by a leading person makes possible the
    commission of one of the criminal offenses for the benefit of
    the legal person by a natural person acting under its
    authority. Per the Explanatory Report (paragraph 125), a
    ``natural person acting under its authority'' is understood to
    be an employee or agent acting within the scope of their
    authority. Further, the Explanatory Report (paragraph 125)
    notes that a ``failure to supervise should be interpreted to
    include the failure to take appropriate and reasonable measures
    to prevent employees or agents from committing criminal
    activities on behalf of the legal person.'' The Explanatory
    Report (paragraph 125) also makes clear, however, that such
    appropriate and reasonable measures ``should not be interpreted
    as requiring a general surveillance regime over employee
    communications.'' The concepts set forth in Article 12 are
    already reflected in U.S. law.
        Under Article 13 (``Sanctions and measures''), each Party
    is to ensure that Articles 2-11 offenses committed by natural
    persons are subject to ``effective, proportionate and
    dissuasive sanctions, which include deprivation of liberty.''
    As elucidated in the Explanatory Report (paragraph 130), the
    Article leaves open the possibility of other sanctions or
    measures, such as forfeiture, for these offenses. Consistent
    with the approach set forth in Article 12 (``Corporate
    liability''), sanctions to be imposed against legal persons may
    be criminal, civil or administrative in nature.

    Procedural law (Articles 14-21):

        As recognized by the Explanatory Report (paragraph 133),
    evidence in electronic form can be difficult to secure, as it
    may be flowing swiftly in the process of communication and can
    be quickly altered, moved or deleted. In an effort to ensure
    that Parties are able to investigate effectively the offenses
    established under the Convention and other criminal offenses
    committed by means of a computer system, as well as to collect
    evidence in electronic form of a criminal offense, the
    Convention requires each Party to ensure that its competent
    authorities have certain powers and procedures for use in
    specific criminal investigations or proceedings. These powers
    and procedures are set forth in articles on: ``Expedited
    preservation of stored computer data'' (Article 16),
    ``Expedited preservation and partial disclosure of traffic
    data'' (Article 17), ``Production order'' (Article 18),
    ``Search and seizure of stored computer data'' (Article 19),
    ``Real-time collection of traffic data'' (Article 20), and
    ``Interception of content data'' (Article 21). All of these
    powers and procedures are already provided for under U.S. law.
        A number of important limitations on the powers and
    procedures to be established pursuant to Articles 16-21 are set
    forth throughout the procedural law articles. Under Article 14
    (``Scope of procedural provisions''), for example, the powers
    and procedures are to be invoked to obtain or collect data in
    connection with ``specific'' criminal investigations or
    proceedings. Thus, as the Explanatory Report explains
    (paragraphs 151 and 152), the Convention does not impose a
    general obligation on service providers to collect and retain
    data on a routine basis simply because such data might one day
    be useful to some yet-to-be determined criminal investigation
    or proceeding. The preservation measures apply to data already
    stored by means of a computer system, thus presupposing that
    the data already exists, has been collected and is being
    stored. Further, Article 15 (``Conditions and safeguards'')
    provides that the establishment, implementation and application
    of the powers and procedures called for by the Convention are
    to be subject to conditions and safeguards provided for under a
    Party's domestic law, which law shall provide for the adequate
    protection of human rights and liberties, including rights
    arising in accordance with obligations a Party has undertaken
    under applicable human rights instruments. This Article depends
    on implementation through a Party's domestic law. For the
    United States, no implementing legislation would be required as
    the U.S. Constitution and U.S. law already provide for adequate
    conditions and safeguards.
        Article 15 and its accompanying text in the Explanatory
    Report (paragraph 147) recognize that, depending on the power
    or procedure, different conditions and safeguards under
    domestic law may be appropriate. For example, the Explanatory
    Report (paragraph 215) notes that, due to its high degree of
    intrusiveness, interception of content data pursuant to Article
    21 merits more stringent safeguards, such as judicial or other
    independent supervision, as well as limitations on its
    duration. Article 15 also requires a Party, to the extent
    consistent with the public interest, to consider the impact of
    the powers and procedures upon the rights, responsibilities and
    legitimate interests of third parties. In this regard, the
    Explanatory Report (paragraph 148) indicates that a Party
    should consider mitigating the impact of such powers and
    procedures through such steps as minimizing disruption of
    consumer services, protecting service providers from liability
    for disclosing or facilitating the disclosure of data, or
    protecting proprietary interests.
        The preservation regime to be established pursuant to
    Article 16 (``Expedited preservation of stored computer data'')
    and Article 17 (``Expedited preservation and partial disclosure
    of traffic data'') requires a Party to enable its competent
    authorities to order or similarly obtain the expedited
    preservation of specified computer data, including traffic
    data, for use in a specific investigation or proceeding. This
    power, which already exists in U.S. law, is important to
    ensuring that evidence is not moved, altered or deleted while
    further processes for obtaining a search warrant or subpoena
    for its disclosure are pursued.
        As indicated in the Explanatory Report (paragraph 160),
    preservation under Article 16 may be accomplished by different
    legal means, including by ordering a person, including a
    service provider, not to destroy or delete computer data within
    that person's possession or control. The person may be required
    to preserve that data for a period of up to 90 days to allow
    the competent authorities to seek its disclosure. (A Party may
    provide for renewal of the preservation order.) The person who
    is to preserve the data may also be required to keep
    confidential for a period of time the undertaking of the
    preservation. With respect to traffic data, Article 17 provides
    that a sufficient amount of data must be able to be disclosed
    expeditiously in order to enable a Party to identify other
    service providers and the path through which a communication
    was transmitted. Such expedited disclosure is intended to
    enable authorities to take steps to preserve additional
    computer data that otherwise might be lost, which can be
    critical to tracing a communication back to the source of a
    computer-related crime (Explanatory Report, paragraphs 166-
    168). The U.S. Government would comply with this requirement by
    moving expeditiously, using existing preservation and
    disclosure procedures provided for under U.S. law.
        As stated in the Explanatory Report (paragraphs 151 and
    152), the data preservation measures contained in Articles 16
    and 17 are distinguishable from so-called ``data retention''
    measures in that they ``do not mandate the collection of all,
    or even some, data collected by a service provider or other
    entity in the course of its activities.'' Instead, as indicated
    above, data preservation measures apply only to data that
    already exists, is being stored, and is specified by competent
    authorities as being sought in connection with a specific
    criminal investigation or proceeding.
        Article 18 (``Production order'') and Article 19 (``Search
    and seizure of stored computer data'') require Parties to
    establish additional measures by which their competent
    authorities can obtain stored computer data. Under Article 18,
    authorities must be able to order a person, including third
    party custodian of data, such as an ISP, to produce data,
    including subscriber information, that is in that person's
    possession or control. The Explanatory Report (paragraph 177)
    makes clear that such subscriber information, which includes
    various types of information about the use and user of a
    service, may be in computer data form as well as in other forms
    (e.g., paper records). The Article, however, does not impose an
    obligation on service providers to compile and maintain such
    subscriber information in the normal course of their business.
    Instead, as the Explanatory Report (paragraph 181) describes,
    it requires a Party to be able to order a service provider to
    produce subscriber information that it does in fact keep. For
    its part, Article 19 is intended to enable authorities
    themselves to search and seize a computer system, data stored
    in a computer system and data contained in storage mediums,
    such as diskettes (Explanatory Report, paragraphs 187-189).
        Article 20 (``Real time collection of traffic data'') and
    Article 21 (``Interception of content data'') require Parties
    to establish measures to enable their competent authorities to
    collect data associated with specified communications in their
    territory at the time of the data's communication (i.e., in
    ``real time''). ``Traffic data'' is defined in Article 1, while
    guidance in the Explanatory Report (paragraph 209) indicates
    that ``content data'' refers to ``the meaning or purport of the
    communication, or the message or information being conveyed by
    the communication (other than traffic data).'' Under Article
    20, a Party is required to enable its authorities to collect
    traffic data with respect to any offense, although under
    Article 14(3)(a), a Party may take a reservation limiting the
    types of crimes to which Article 20 must be applied. This
    reservation would not be needed by the United States as federal
    law already makes this mechanism generally available for
    criminal investigations and prosecutions. With regard to
    Article 21, the Explanatory Report (paragraphs 210 and 212)
    recognizes that interception of content data is considered an
    intrusive measure and, therefore, that Article only requires a
    Party to provide for such measures in relation to a range of
    serious offenses to be determined by its domestic law, which is
    the approach taken by U.S. federal law.
        Under both Articles 20 and 21, a Party is generally
    required to adopt measures enabling its competent authorities:
    (a) to collect or record data themselves through application of
    technical means on the territory of that Party, and (b) to
    compel a service provider, within its existing technical
    capability, either to collect or record data through the
    application of technical means or to cooperate and assist
    competent authorities in the collection or recording of such
    data. The Explanatory Report (paragraph 224) explains that in
    certain states, such as Germany, due to ``established legal
    principles'', law enforcement is not able to intercept
    communications directly and must rely on service providers to
    have the capability to collect content or traffic data in real
    time on its behalf. Accordingly, pursuant to Article 20(2),
    Parties may therefore adopt other measures to ensure the
    collection or recording of data, including by requiring service
    providers to provide technical facilities. This exception does
    not apply to the United States as its authorities are empowered
    to collect and record data directly through technical means. In
    states, such as the United States, in which this exception
    would not be invoked, the obligation on a service provider to
    assist law enforcement under Articles 20 and 21 is subject to
    ``its existing technical capability.'' As more fully described
    in the Explanatory Report (paragraph 221), this means there is
    no obligation to impose a duty on service providers to obtain
    or deploy new equipment or engage in costly reconfiguration of
    their systems in order to assist law enforcement.

    Jurisdiction (Article 22):

        Article 22 requires a Party to establish jurisdiction over
    the offenses specified in the Convention where committed in the
    Party's territory, on board a ship flying its flag, on board an
    aircraft registered under its laws, or, in certain
    circumstances, by one of its nationals. Except with respect to
    offenses committed in its territory, Article 22(2) permits a
    Party to enter a reservation as to these jurisdictional bases.
    Because U.S. criminal law does not provide for plenary criminal
    jurisdiction over offenses involving its nationals and
    selectively provides for maritime or aircraft jurisdiction, I
    recommend that the following reservation be included in the
    U.S. instrument of ratification:
              The Government of the United States of America,
            pursuant to Articles 22 and 42, reserves the right not
            to apply in part paragraphs (1)(b), (c) and (d) of
            Article 22 (``Jurisdiction''). The United States does
            not provide for plenary jurisdiction over offenses that
            are committed outside its territory by its citizens or
            on board ships flying its flag or aircraft registered
            under its laws. However, United States law does provide
            for jurisdiction over a number of offenses to be
            established under the Convention that are committed
            abroad by United States nationals in circumstances
            implicating particular federal interests, as well as
            over a number of such offenses committed on board
            United States-flagged ships or aircraft registered
            under United States law. Accordingly, the United States
            shall implement paragraphs 1(b), (c) and (d) to the
            extent provided for under its federal law.
        Under Article 22(3), a Party is also required to establish
    jurisdiction over the criminal offenses established in
    accordance with Articles 2-11 of the Convention in the event it
    does not extradite an alleged offender solely on the basis of
    nationality. As explained in the Explanatory Report (paragraph
    237), establishing such jurisdiction is necessary to ensure
    that such a Party has the ability to undertake investigations
    and proceedings against the alleged offender domestically.
    United States law permits extradition of nationals;
    accordingly, this paragraph does not give rise to a need for
    implementing legislation.
        As indicated in the Explanatory Report (paragraph 239),
    offenses committed through the use of the Internet may target
    victims in many states, giving rise to instances in which more
    than one Party has jurisdiction. Accordingly, Article 22(5)
    provides that when more than one Party claims jurisdiction over
    an alleged offense established in accordance with the
    Convention, they shall, where appropriate, consult with a view
    to determining the most appropriate jurisdiction for
    prosecution.

            CHAPTER III--INTERNATIONAL CO-OPERATION (ARTICLES 23-35)

        Chapter III, Article 23 (``General principles relating to
    international co-operation'') provides that Parties are to
    provide international cooperation to one another to the
    ``widest extent possible'' for investigations and proceedings
    concerning criminal offenses related to computer systems and
    data, or for the collection of evidence in electronic form of a
    criminal offense. The Chapter contains extradition and mutual
    legal assistance provisions typical of many multilateral law
    enforcement conventions to which the United States is already a
    party, and, as such, is compatible with existing U.S. law. As
    provided in the Chapter and as recognized in the Explanatory
    Report (paragraph 244), the general approach is to supplement
    existing international cooperation agreements and provide a
    basis for such cooperation where no such framework exists.
        Extradition is covered in Article 24 (``Extradition''),
    which provides that the offenses established in accordance with
    Articles 2-11 of the Convention shall be deemed to be included
    as extraditable offenses in extradition treaties between or
    among the Parties provided the offenses are subject to minimum
    penalties as described in the Article. The Article provides
    that extradition is subject to the conditions provided by the
    law or applicable treaties of the requested Party, including
    the grounds on which it may refuse extradition. Any Party that
    refuses an extradition request solely because the person sought
    is one of its nationals is obliged at the request of the
    requesting Party to submit the case to its competent
    authorities for the purpose of prosecution.
        Article 24 also provides that a Party that conditions
    extradition on the existence of a treaty may use the Convention
    itself as a treaty basis, although it is not obligated to do
    so. For situations in which there is no separate extradition
    treaty in existence, Article 24(7) provides that a Party is to
    notify the COE of the name and address of its authority for
    receiving requests for extradition or provisional arrest under
    the Convention. The United States would not invoke Article 24
    as a separate basis for extradition, but, instead, would
    continue to conduct extradition pursuant to applicable
    bilateral treaties, supplemented where appropriate by relevant
    international law enforcement conventions. Thus, the principal
    legal effect of Article 24 for the United States would be to
    incorporate by reference the offenses provided for in the
    Convention as extraditable offenses under U.S. bilateral
    extradition treaties. Further, because the United States would
    continue to rely on bilateral extradition treaties, it would
    notify the COE that it is not designating an authority under
    Article 24(7) and that the authority responsible for making or
    receiving extradition requests on behalf of the United States
    is set forth in the applicable bilateral extradition treaties.
        The provisions relating to mutual legal assistance are set
    forth in Articles 25-35. Article 25 sets forth ``General
    principles relating to mutual assistance,'' where the duty to
    provide cooperation is not limited to the offenses to be
    established pursuant to Articles 2-11 of the Convention. As the
    Explanatory Report (paragraph 253) notes, the need for
    ``streamlined mechanisms of international co-operation''
    extends beyond such offenses and, thus, Article 25 obliges the
    Parties to afford mutual assistance ``to the widest extent
    possible for the purposes of investigations or proceedings
    concerning criminal offences related to computer systems and
    data, or for the collection of evidence in electronic form of a
    criminal offence.'' Article 25 provides that in urgent
    circumstances a Party may make a request for assistance by
    expedited means of communication (e.g., fax or e-mail) and that
    the requested Party shall be obliged to respond to the request
    by expedited means of communication as well. Article 25(4) sets
    forth the general rule that, except as otherwise specifically
    provided for in Chapter III, mutual assistance shall be subject
    to conditions provided for by applicable mutual legal
    assistance treaties or by the law of the requested Party.
    Article 25(4) itself provides for an exception to this general
    rule in that it precludes a Party from denying assistance with
    respect to the offenses set forth in Articles 2-11 on the
    ground that the request concerns a fiscal (i.e., tax) offense.
        Article 26 (``Spontaneous information'') provides that,
    without receiving an assistance request, a Party may forward to
    another Party information it obtains in one of its own
    investigations where it believes such information might assist
    the other Party in initiating or carrying out an investigation
    or proceeding. Per the Explanatory Report (paragraph 260), such
    a provision was thought useful because some states require a
    positive grant of legal authority to provide such assistance,
    which would be satisfied by inclusion of this provision in the
    Convention. Before providing such information, a Party may
    require that it be used subject to conditions, such as that it
    be kept confidential.
        Article 27 (``Procedures pertaining to mutual assistance
    requests in the absence of applicable international
    agreements'') and Article 28 (``Confidentiality and limitations
    on use'') provide a framework for assistance where there is no
    mutual legal assistance treaty or arrangement on the basis of
    uniform or reciprocal legislation in force between the
    requesting Party and the requested Party. Article 27 provides
    procedures for handling assistance requests as well as grounds
    for refusal, which include where the request concerns a
    political offence or is ``likely to prejudice [a requested
    Party's] sovereignty, security, ordre public or other essential
    interests.'' The Article also provides for the designation by
    each Party of a central authority or authorities, which is to
    be responsible for handling requests for mutual assistance. In
    the event of urgency, Article 27(9) allows for requests to be
    sent directly to judicial authorities. A Party may declare,
    however, that for reasons of efficiency, such requests are to
    be addressed to its designated central authority. In this
    regard, I recommend that the following declaration be included
    in the U.S. instrument of ratification:
              The Government of the United States of America
            declares, pursuant to Articles 27 and 40, that requests
            made to the United States of America under paragraph
            9(e) of Article 27 (``Procedures pertaining to mutual
            assistance requests in the absence of applicable
            international agreements'') are to be addressed to its
            central authority for mutual assistance.
        Article 28 provides that the requested Party may condition
    the provision of information on confidentiality and certain use
    limitations. The Article only applies, however, where there is
    no mutual assistance treaty or arrangement on the basis of
    uniform or reciprocal legislation in force as between the
    requested and requesting Parties, unless the Parties concerned
    agree to its application in whole or in part.
        Articles 29-35 contain specific provisions on mutual
    assistance that apply regardless of whether assistance is being
    requested or provided pursuant to an existing mutual legal
    assistance treaty or arrangement.
        Article 29 (``Expedited preservation of stored computer
    data'') and Article 30 (``Expedited disclosure of preserved
    traffic data'') address the preservation and disclosure of
    data. As indicated in the Explanatory Report (paragraphs 282
    and 290), these articles make available for the purposes of
    international cooperation the mechanisms provided for use at
    the domestic level in Articles 16 and 17. Under Article 29, a
    requesting Party may obtain advance, expedited preservation of
    stored data that is located in the territory of the requested
    Party provided it intends to submit a subsequent, formal mutual
    assistance request for disclosure of the data. Upon
    preservation, the requesting Party shall then have at least
    sixty days to submit its mutual assistance request. A requested
    Party may refuse preservation on the ground that the request
    concerns a political offense or that its execution would be
    ``likely to prejudice its sovereignty, security, ordre public,
    or other essential interests.'' For the purposes of obtaining
    the initial preservation, Article 29 does not as a rule require
    dual criminality. As explained in the Explanatory Report
    (paragraph 285), once preserved, the data is generally not
    subject to disclosure to government officials until the formal
    mutual assistance request is executed. A determination with
    respect to any dual criminality requirement can be made in the
    context of that request. However, a requested Party that
    requires dual criminality as a condition under its applicable
    mutual legal assistance framework may enter a reservation that
    would enable it to refuse a preservation request if it has
    reason to believe that at the time of the disclosure dual
    criminality would not be met. Because the United States
    generally seeks, as a policy matter, to minimize the
    application of dual criminality as a ground for refusing
    international mutual assistance, and, especially since
    preservation in and of itself does not result in disclosure of
    data to government officials, the United States would not
    exercise this reservation. Under Article 30, if the requested
    Party determines in executing an Article 29 request for
    expedited preservation concerning a specific communication that
    a service provider in another state was involved in that
    communication, then it is under an obligation to disclose to
    the requesting Party such traffic data as necessary to identify
    the foreign service provider and the communication path. As in
    Article 29, such disclosure may only be withheld by the
    requested Party on political offense grounds or on the grounds
    that it ``is likely to prejudice its sovereignty, security,
    ordre public or other essential interests.''
        Article 31 (``Mutual assistance regarding accessing of
    stored computer data'') is the international cooperation
    counterpart to Article 19 (``Search and seizure of stored
    computer data'') in the procedural law chapter. It requires a
    requested Party to be able to ``search or similarly access,
    seize or similarly secure, and disclose'' stored data in
    response to a request for mutual assistance. Where the data is
    ``particularly vulnerable to loss or modification,'' the
    requested Party is required to expedite its response.
        Article 32 (``Trans-border access to stored computer data
    with consent or where publicly available'') is not a mutual
    assistance provision per se. Rather, as discussed in the
    Explanatory Report (paragraphs 293 and 294), it reflects the
    general agreement that an accessing Party need not seek the
    prior authorization of another Party to access data stored in
    that other Party's territory where the data is publicly
    available or obtained through a computer system located in the
    accessing Party's territory with the lawful and voluntary
    consent of a person who has lawful authority to disclose that
    data through that system.
        Article 33 (``Mutual assistance in the real-time collection
    of traffic data'') and Article 34 (``Mutual assistance
    regarding the interception of content data'') are the
    counterparts in the international cooperation chapter to
    Articles 20 and 21. Under Article 33, a Party is required to
    provide mutual assistance in the real-time collection of
    traffic data at least with respect to offences for which such
    real-time collection would be permitted under its domestic law.
    Similarly, Article 34 obligates a Party to provide mutual
    assistance in the interception of content data, but only to the
    extent permitted under its applicable treaties and domestic
    law.
        Article 35 (``24/7 Network'') requires each Party to
    designate a point of contact that will be available 24 hours a
    day, seven days a week to ensure the provision of immediate
    assistance for the purposes of investigations or proceedings
    concerning criminal offenses related to computer systems and
    data, or for the collection of evidence in electronic form.
    This shall include an obligation to facilitate or, if permitted
    by its domestic law and practice, direct the carrying out of
    immediate assistance in the provision of technical advice, the
    expedited preservation of stored computer data, the expedited
    disclosure of preserved traffic data, the collection of
    evidence, the provision of legal information, and the locating
    of suspects. As indicated in the Explanatory Report (paragraph
    298), this channel draws its inspiration from a network created
    by the G8 countries in 1998. The 24/7 point of contact for the
    United States would be the same point of contact used for the
    G8 network: the Department of Justice, Criminal Division,
    Computer Crime and Intellectual Property Section.

    Chapter IV--Final provisions (Articles 36-48):

        As indicated in the Explanatory Report (paragraph 303), the
    provisions contained in Chapter IV (``Final provisions'') are
    generally based on standard model clauses used by the COE.
    Article 36 (``Signature and entry into force'') provides that
    the Convention is open for signature by COE member states and
    by non-member states that have participated in its elaboration,
    i.e., the United States, Canada, Japan, and South Africa. Five
    states, including at least three COE member states, must
    express their consent to be bound by the Convention for it to
    enter into force. After entry into force, states subsequently
    expressing their consent to be bound shall become party to it
    on the first day of the month following a three month period
    from the date of that state's expression of consent. Article 37
    (``Accession to the Convention'') details a procedure for
    accession by other states after the Convention enters into
    force. Reflecting past practice in this area within the COE,
    accession by a state requires the unanimous consent of the
    Parties to the Convention. Article 38 (``Territorial
    application'') enables states to specify the extent of their
    territory to which the Convention will apply.
        Article 39 (``Effects of the Convention'') addresses the
    relationship of the Cybercrime Convention to other
    international instruments. It makes clear that the Convention
    is intended to supplement applicable treaties or arrangements
    between the Parties in the area of international cooperation.
    As set forth in the Article and as explained in the Explanatory
    Report (paragraph 312), Parties are free to enter into new
    agreements with one another regarding matters dealt with in the
    Convention provided they do not undermine its objectives and
    principles. Article 39 also contains a ``savings'' clause to
    the effect that the Convention does not affect other rights and
    obligations that are not addressed in the Convention.
        Article 40 (``Declarations''), Article 41 (``Federal
    clause'') and Article 42 (``Reservations'') permit Parties to
    modify or derogate from specified Convention obligations. Under
    Article 40, a Party may declare that it avails itself of
    various additional elements provided for in specified articles
    at the time it consents to be bound by the Convention. As set
    forth above, in order to meet its Convention obligations
    without having to seek new implementing legislation, the United
    States would make declarations under Articles 2, 6(1)(b), 7,
    and 27(9)(e).
        Article 41 (``Federal clause'') permits a federal state to
    enter a reservation allowing for minor variations in coverage
    of its Chapter II obligations (``Measures to be taken at the
    national level''). As stated in the Explanatory Report
    (paragraph 316), this reservation takes into account that
    variations in coverage may occur due to ``well-established
    domestic law and practice'' of a federal state based on the
    federal state's ``Constitution or other fundamental principles
    concerning the division of powers in criminal justice matters''
    between its central government and its constituent entities.
    The reservation was inserted to make clear that the United
    States could meet its Convention obligations through
    application of existing federal law and would not be obligated
    to criminalize activity that does not implicate a foreign,
    interstate or other federal interest meriting the exercise of
    federal jurisdiction. In the absence of the reservation, there
    would be a narrow category of conduct regulated by U.S. State,
    but not federal, law that the United States would be obligated
    to criminalize under the Convention (e.g., an attack on a
    stand-alone personal computer that does not take place through
    the Internet). Article 41 makes clear that this reservation is
    available only where the federal state is still able to meet
    its international cooperation obligations and where application
    of the reservation would not be so broad as to exclude entirely
    or substantially diminish its obligations to criminalize
    conduct and provide for procedural measures. Such a restriction
    is not an obstacle for the United States because the
    Convention's international cooperation provisions are
    implemented at the federal level and because federal
    substantive criminal law provides for broad overall coverage of
    the illegal conduct addressed by the Convention. In invoking
    the reservation, the U.S. Government would be obliged to bring
    the Convention's provisions to the attention of its constituent
    States and entities, with a ``favourable opinion'' encouraging
    them to take appropriate action to give effect to such
    provisions, even though, as a result of the reservation, there
    would be no obligation for them to do so. This step would be
    accomplished through an outreach effort on the part of the
    federal government. Accordingly, I recommend that the following
    reservation be included in the U.S. instrument of ratification:
              The Government of the United States of America,
            pursuant to Articles 41 and 42, reserves the right to
            assume obligations under Chapter II of the Convention
            in a manner consistent with its fundamental principles
            of federalism. Furthermore, in connection with this
            reservation, I recommend that the Senate include the
            following understanding in its resolution of advice and
            consent:
        The United States understands that, in view of its
    reservation pursuant to Article 41, Chapter II of the
    Convention does not warrant the enactment of any legislative or
    other measures; instead, the United States will rely on
    existing federal law to meet its obligations under Chapter II
    of the Convention.
        Article 42 (``Reservations'') enumerates those provisions
    by which a Party can exclude or modify its obligations with
    respect to specified articles at the time it consents to be
    bound by the Convention. Consistent with COE treaty practice,
    the Article provides that no other reservations may be made.
    Article 43 (``Status and withdrawal of reservations'') provides
    a mechanism for Parties to withdraw their reservations as soon
    as circumstances permit. As set forth above, to meet its
    obligations without the need for additional implementing
    legislation, the United States would make permitted
    reservations under Articles 4(2), 6(3), 9(4), 10(3), 22(2), and
    41.
        The procedure for amending the Convention is set forth in
    Article 44 (``Amendments'') and provides that amendments do not
    come into force until they have been accepted by all Parties to
    the Convention. Article 45 (``Settlement of disputes'')
    obligates Parties to seek to settle disputes as to the
    interpretation or application of the Convention through
    peaceful means of their choosing. Resort to binding arbitration
    or to the International Court of Justice is possible if the
    Parties concerned agree. Article 46 (``Consultations of the
    Parties'') establishes a flexible framework for Parties to
    consult regarding implementation of the Convention, including
    the effect on implementation of significant legal, policy or
    technological developments. As appropriate, such consultations
    are to be facilitated by the COE, including specifically by the
    European Committee on Crime Problems. The Explanatory Report
    (paragraph 328) encourages Parties, in the context of these
    consultations, to seek the views of non-governmental and
    private sector organizations on privacy, business and other
    related issues.
        Article 47 (``Denunciation'') sets out the procedure for a
    Party to denounce the Convention with three months advance
    notice, and Article 48 (``Notification'') empowers the COE's
    Secretary General to act as the notifying authority in relation
    to the Convention.
        It is my belief that the Convention would be advantageous
    to the United States and, subject to the reservations and
    declarations proposed in this Report, would be consistent with
    existing United States legislation. The Departments of Justice
    and Commerce join me in recommending that the Convention be
    transmitted to the Senate at an early date for its advice and
    consent to ratification, subject to the reservations and
    declarations described above.
        Respectfully submitted.
                                                       Colin L. Powell.