EU Parliament OKs stricter penalties for cyber attacks

Cyber criminals could face tougher penalties across the European Union under new rules adopted by the European Parliament, which include the creation of a specific offense of using botnets.

The draft directive adopted by the parliament on Thursday defines specific criminal offenses for cybercrime and sets specific sanctions for each. It also requires E.U. countries to assist fellow member states and respond to urgent requests for help within eight hours in the event of a cyber attack.

The text has already been informally agreed with member states, and that agreement is expected to be formalized shortly. The member states will the have two years to implement it in national law.

Under the draft law, using botnets to establishing remote control over a significant number of computers by infecting them with malicious software carries a penalty of at least three years' imprisonment.

Meanwhile criminals responsible for cyber attacks against "critical infrastructure," such as power plants, transport networks and government network would face at least five years in jail. The same would apply if an attack is committed by a criminal organization or if it causes serious damage.

"Attacks against information systems pose a growing challenge to businesses, governments and citizens alike. Such attacks can cause serious damage and undermine users' confidence in the safety and reliability of the Internet," said Home Affairs Commissioner, Cecilia Malmström, welcoming the news.

Companies or organizations would also be liable for offenses committed for their benefit, for example hiring a hacker to get access to a competitor's database.

The directive, which updates rules that have been in place since 2005, also requires member states to allow judges the possibility to sentence criminals to two years in jail for the crimes of illegally accessing or interfering with information systems, illegally interfering with data, illegally intercepting communications, or intentionally producing and selling tools used to commit these offences.

Minor cases are excluded, but it is up to each country to determine what constitutes a "minor" case.

However technology blogger Glynn Moody expressed concern about possible mission-creep. "I predict laws will be abused by E.U. governments to attack coders and geeks," he said on Twitter.

The directive will apply across all E.U. member states with the exception of Denmark, which decided to opt out.

Stop spying on us, European Parliament tells US

The European Parliament gave European Commissioners and national ministers some extra ammunition Thursday in discussions with the U.S. following allegations about American spying and the Prism scandal: possible suspension of data-sharing agreements.

The Parliament called on the U.S. to provide full disclosure of any spying activities, and set up an inquiry to look into the allegations, but stopped short of suspending bilateral trade talks due to start on Monday. The resolution was approved by 483 votes to 98 with 65 abstentions.

Members of the European Parliament (MEPs) said that the European Commission, the Council of Ministers and E.U. member states should consider "all levers at their disposal" in negotiations with the U.S., including suspending deals for sharing air passenger (Passenger Name Record) data and bank data (the Terrorist Finance Tracking Programme).

The resolution also expresses grave concern that similar surveillance programs may be run by E.U. member states, including the U.K., Sweden, the Netherlands, Germany, and Poland. It calls on those countries to examine whether their programs are compatible with E.U. law.

The inquiry will be conducted by the Parliament's Civil Liberties Committee and will look into the alleged bugging of E.U. by the U.S. National Security Agency. It will assess the impact of the alleged surveillance activities on E.U. citizens' right to privacy and data protection, freedom of expression, the presumption of innocence, and the right to an effective remedy, and will publish its findings by the end of the year.

Parliament's resolution is not legally binding, but it also calls on E.U. countries to speed up their work on the whole data protection package. Jan Philipp Albrecht, the MEP charged with steering the E.U.'s data protection overhaul through Parliament said, "Boundaries need to be set on both sides of the Atlantic to protect the interests of E.U. citizens. Strict and consistent data protection rules are needed in the E.U. and the United States."

He also said that the current Safe Harbor Agreement between the E.U. and the U.S. should be reviewed.

Some MEPs had called for a suspension of the Transatlantic Trade and Investment Partnership (TTIP) talks. "We refuse to accept that consumer and data protection could be sacrificed for the sake of the TTIP," said Dany Cohn-Bendit and Rebecca Harms in a statement released Wednesday night.

In the final resolution, MEPs said it would be "unfortunate" if E.U.-U.S. trade talks were to be affected by the allegations, but added that "placing increasing free trade above fundamental rights and the rule of law will destroy citizens' trust in the E.U."

The talks will be handled by the European Commission. Commission President Jose Manuel Barroso said in a statement on Thursday that "negotiations on TTIP are and will remain top priority."

But he accepted that concerns over the spying allegations must be addressed. "We expect that the E.U.-U.S. working groups will analyze the oversight of the intelligence activities, intelligence collection, and also the question of privacy and data protection," he said.

"In a recent letter to the Commissioners responsible, the Attorney General of the United States, Eric Holder, said that the United States are ready, as soon as possible, to create these groups to analyse these matters. This Transatlantic Trade and Investment Partnership is of major importance. For it to be a success, we need confidence among partners and confidence can come better if there is a clarification of some issues that are of very serious concern at European level," Barroso said.