Cybersecurity and/or human rights

According to the EC, only 12% of European Internet users feel completely safe when carrying out online transactions. Threats such as malicious software and Internet fraud deprive the growth in the number of consumers and nullify efforts aimed at promoting the digital economy. As for Ukrainian consumers, as of February 2016, 63% of households in Ukraine were connected to the Internet. 62% of families use the Internet regularly, that is, once a month. According to the World Bank, Internet penetration in Ukraine increases by an average of 5% annually. That is, problems related to trust online and online transactions will grow from year to year. Half a century ago, the term "information security" was first used together with the terms "information society," "knowledge economy," and later "digital economy," etc. Now one can increasingly hear "cybersecurity," "cyberwar," "cyberattack," "cybercrime." Let us first try to figure out what these are. Information security – preserving the confidentiality, integrity, and availability of information. Authenticity, accountability, non-repudiation, and reliability must also be taken into account (ISO/IEC 17799:2005). That is, these are actions to secure information itself from citizens and means, and not the other way around – to secure citizens from information, as one can sometimes read on the Internet. The term "cybersecurity" usually refers to corporate governance, management, and providing assurance regarding security that go beyond what we understand as "information security." Cybersecurity focuses on special forms of complex attacks and covers their technical and social aspects. Since there are many definitions of cybersecurity, this term is often misunderstood. The official EU definition is as follows: "Cybersecurity usually refers to measures and actions aimed at protecting cyberspace in the civilian and military spheres from threats that may harm or are related to interdependent networks and information infrastructure. Cybersecurity is aimed at preserving the availability and integrity of networks and infrastructure, as well as the confidentiality of the information contained in them." 1 ________________ 1 European Commission, Joint Communication to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions – EU Cybersecurity Strategy: An Open, Safe and Secure Cyberspace, Brussels, 2 July 2013, p. 3: http://ec.europa.eu/information_society/newsroom/cf/dae/document.cfm?doc_id=1667. ISACA gives the following definition of cybersecurity: "Protection of information assets by combating threats to the security of information that is processed, stored, and transmitted through information systems that interact via networks." 2 _________________ 2 ISACA, Cybersecurity Glossary, 2014: http://www.isaca.org/Knowledge- Center/Documents/Glossary/Cybersecurity_Fundamentals_glossary.pdf. In its publication Transforming Cybersecurity, ISACA describes cybersecurity in more detail: "... Cybersecurity encompasses everything that protects organizations and individuals from deliberate attacks, breaches, incidents, and their consequences. In practice, cybersecurity primarily concerns those types of attacks, breaches, and incidents that are targeted, high-tech, and difficult to detect or manage. ... Cybersecurity focuses on so-called advanced persistent threats (APT) 3 , cyberwars, and their impact on organizations and people." 4 ________________ 3 APT (advanced persistent threats) – targeted persistent threats. 4 ISACA, Transforming Cybersecurity, USA, 2013, p. 11: https://www.isaca.org/Knowledge-Center/Research/ResearchDeliverables/Pages/Transforming- Cybersecurity-Using-COBIT-5.aspx Thus, information security has a lower level than cybersecurity and differs in scale, motives, capabilities, and methods of attack. Let us look at the PESTLE analysis – this is a detailed analysis of various aspects of an enterprise, namely political (Political), economic (Economic), social (Social), technological (Technical), legal (Legal), and environmental (Environmental), prepared by ISACA experts. 5 _________________ 5 Implementing European Cybersecurity: An Overview https://www.isaca.org/cyber Cybersecurity, unlike information security, is ensured not only directly by the organization being protected, but also by other service providers (telecommunications, service, cloud, etc.). In most cases, this concerns the collective security of participants in activity on the Internet. That is, a large number of users whom one organization cannot control in the direct sense of the word, but who have access to certain collective resources or the right to use public services. In this case, the service provider has great power and the technical ability to manage information and the transit of data flow (Internet traffic) through the networks it operates. Internet access service providers may participate in managing Internet traffic for specific lawful purposes, for example, to preserve the integrity and security of the network. They may also take measures to prevent access to or distribution of illegal or harmful content, for example, through self-regulation systems in cooperation with state bodies. However, other interventions in Internet traffic may affect the quality of services provided to Internet users and lead to blocking, discrimination, or prioritization of specific types of content, applications, and services. Moreover, some of the methods used in the context of access management, or monitoring of messages, may undermine users' trust in the Internet. The European community for the realization of human rights on the Internet (since 2013, the right to access the Internet has been a fundamental human right) adopted Recommendation CM/Rec (2016) 1 of the Committee of Ministers to member States on the protection and promotion of the right to freedom of expression and the right to privacy with regard to network neutrality (adopted by the Committee Fig. 1. PESTLE analysis of Ministers on 13 January 2016 at the 1244th meeting of the Ministers' Deputies) and Recommendation CM/Rec (2016) 5 of the Committee of Ministers to member States on Internet freedom (adopted by the Committee of Ministers on 13 April 2016 at the 1253rd meeting of the Ministers' Deputies), recognizing the risks associated with the regulation of access to the Internet and the capabilities of service providers. As stated in Recommendation Rec (2016) 5, Internet governance mechanisms, at the national, regional, or global level, must be based on an understanding of Internet freedom. States have rights and obligations with regard to international policy related to the Internet. In exercising their sovereign rights, states must, in accordance with the norms of international law, refrain from any actions that may directly or indirectly harm natural or legal persons within or outside their jurisdiction. Any national decision or action restricting human rights and fundamental freedoms on the Internet must comply with international obligations and, in particular, be based on law. Fully observing the principles of proportionality and guaranteeing access to remedies, as well as the right to be heard and to apply with the provision of due process guarantees, must be important in a democratic society. The EU, understanding all possible consequences of technical and technological regulation of ensuring access to the Internet, emphasizes the need to regulate at the level of law the restrictions required to ensure collective security. This also concerns the obligation of the state to protect people from cybercrime through effective criminal justice or other measures. In cases where such measures contain a risk related to the right to privacy, the right to freedom of expression, or the right to freedom of peaceful assembly and association, they are subject to conditions and guarantees against abuse. These measures must comply with Articles 8, 10, and 11 of the Convention for the Protection of Human Rights and Fundamental Freedoms. Moreover, they must be established at the level of law. The law must be accessible, precise, and understandable; pursue a legitimate aim; be necessary and proportionate in a democratic society and provide effective remedies. Ukraine acceded to the Convention for the Protection of Human Rights and Fundamental Freedoms quite a long time ago, and the EU Association Agreement entered into force (provisional application) several years ago. Therefore, the state of Ukraine has determined that in the field of human rights it will adhere to the democratic European model of state regulation (restriction) of human rights, in particular on the Internet. Does current legislative regulation correspond to the European model? Partly yes. As regards telecommunications services – yes; as regards cybersecurity – no. In 2006, Ukraine acceded to the Convention on Cybercrime, in particular recognizing "the need for cooperation between States and private enterprises to combat cybercrime and the need to protect legitimate interests during the use and development of information technologies." And in furtherance of this Convention, Ukraine needed to develop mechanisms for cooperation between the state and the private sector in ensuring cybersecurity (hereinafter – cybersecurity measures), but while preserving "an appropriate balance between law enforcement interests and respect for fundamental human rights." It was also necessary to revise Ukraine's criminal legislation with regard to developing procedural issues in order to obtain proper evidence in crimes involving information and telecommunications networks and technologies, and to formulate the very composition of the crime in the digital world. One of the tasks was to provide both specialists who could investigate crimes without breaking into and seizing servers, and specialists who could adequately establish the relevant facts in court. As you understand, not everything is so good 11 years after acceding to the Convention on Cybercrime. Currently, there is only the Cybersecurity Strategy of Ukraine, approved by Decree of the President of Ukraine 1.5 years ago, and draft law 2126a, which was submitted for consideration to the Verkhovna Rada of Ukraine and was sent for a repeat second reading. Analyzing draft law No. 2126a for the presence of cybersecurity measures, we note that none of those listed above are in it. Amendments to criminal and procedural legislation and the establishment of public-private partnership mechanisms are also absent. Likewise absent is any explanation (interpretation) of how compliance with cybersecurity principles is achieved. By the way, cybersecurity and cyber defense in the Ukrainian version are two different things, as they say in Odesa. In other countries, cybersecurity is precisely understood as protection measures, as discussed above. In our opinion, the adoption of the said law will not ensure the realization of the goal described in its preamble: the draft law contains no articles for implementing the principles of ensuring cybersecurity, and the definition of critical infrastructure objects and all related issues is generally assigned to another level – resolutions and orders of the Cabinet of Ministers. By the way, the term "cybersecurity" from the draft law has an interesting detail: "cybersecurity – the protection of the vital interests of a person and citizen, society, and the state during the use of cyberspace, under which the sustainable development of the information society and the digital communication environment is ensured, as well as the timely detection, prevention, and neutralization of real and potential threats to the national security of Ukraine in cyberspace;". The Law of Ukraine "On the Fundamentals of National Security of Ukraine" defines national security as follows: "national security – the protection of the vital interests of a person and citizen, society, and the state, under which the sustainable development of society is ensured, as well as the timely detection, prevention, and neutralization of real and potential threats to national interests in the spheres of law enforcement activity, combating corruption, border activity and defense, migration policy, healthcare, education and science, scientific-technical and innovation policy, cultural development of the population, ensuring freedom of speech and information security, social policy and pension provision, housing and communal services, the market of financial services, protection of property rights, stock markets and securities circulation, tax-budgetary and customs policy, trade and entrepreneurial activity, the market of banking services, investment policy, audit activity, monetary and currency policy, information protection, licensing, industry and agriculture, transport and communications, information technologies, energy and energy conservation, the functioning of natural monopolies, the use of subsoil, land and water resources, minerals, protection of ecology and the natural environment, and other spheres of state administration when negative trends arise toward the creation of potential or real threats to national interests." Did anything surprise you? So cybersecurity must ensure the timely detection, prevention, and neutralization of threats to national interests. One of the threats (Article 7 of the Law of Ukraine "On the Fundamentals of National Security of Ukraine") is "in the information sphere: manifestations of restriction of freedom of speech and access to public information; dissemination by the mass media of a cult of violence, cruelty, and pornography; computer crime and computer terrorism; disclosure of information constituting a state secret, or other information with restricted access, aimed at satisfying the needs and ensuring the protection of the national interests of society and the state; attempts to manipulate public consciousness, in particular by disseminating unreliable, incomplete, or biased information." It seems they have overcomplicated things a bit. The draft law does not speak about rights and restrictions on rights, but an interesting legal trick – "ensuring cybersecurity in Ukraine is based on the principles: 1) the rule of law, legality, respect for human rights and fundamental freedoms and their protection in the manner determined by law" – proves the opposite: either some law already exists that describes the procedure for protecting rights and freedoms, or it will still be developed – the draft law does not provide an answer. If they meant legislative acts on the protection of personal data or on access to public information, or on ensuring access to the Internet – then they could have referred to them. In general, there are more questions than answers. It is good that there is an opportunity to review the draft law (the norms laid down in it) critically. CONCLUSION: This article did not aim to examine in detail the violation of specific rights and freedoms in connection with measures to ensure cybersecurity, only the basic concepts, principles, and their essence for understanding that the coexistence of rights and freedoms is possible. Security is not created in exchange for rights and freedoms, but only together with them. Nothing costs as much as freedom. And restrictions (and not prohibitions!!!) for the sake of collective security can and should be introduced, but under one condition – the law must be accessible, precise, and understandable; pursue a legitimate aim; be necessary and proportionate in a democratic society and provide effective remedies. The law and only the law must prevail! © LLC "Information and Analytical Center "LIGA", 2017 © LLC "LIGA ZAKON", 2017