Ukraine’s fight against cybercrime: how authorities want to monitor traffic and seize crypto assets

In September the Verkhovna Rada of Ukraine registered Bill No. 4004, \”On Amendments to the Criminal Procedure Code of Ukraine to enhance the effectiveness of the fight against cybercrime and the use of electronic evidence\”.

It introduces the concept of electronic evidence and makes changes to the mechanism by which law enforcement accesses information about user traffic from operators.

It also outlines the procedure for confiscating digital currencies obtained through illicit activity.

According to the explanatory note, the bill is intended to combat cybercrime. However some argue that certain measures proposed by the bill conflict with constitutional rights and freedoms, and the document is likened to Russia’s \u201cYarovaya package\u201d.

ForkLog examines the potential consequences of the bill for Ukrainians.

The bill by ForkLog on Scribd

According to the document, electronic evidence is defined as \u201cinformation in digital form with data that may be used as evidence of facts or circumstances established during criminal proceedings\u201d.

In addition to electronic documents, websites, text and voice messages and other data, the authors of the bill also include virtual assets.

If cryptocurrencies are part of a criminal offense, they may be confiscated. An exception is when their owner \u201cdid not know or could not know about their illicit use\u201d.

\u201cToday, special confiscation does not affect virtual assets, though the laundering of proceeds obtained through criminal activity largely occurs via unregulated virtual markets,\u201d said in the explanatory note.

As an example of an \u201cuncontrolled virtual market\u201d they cite the Silk Road darknet marketplace.

Under the bill, virtual assets (VA) are confiscated in the following cases:

• when they \u201care made, adapted or used as means or instruments of committing a criminal offense\u201d;
• used to induce a person to commit a crime, to finance it;
• if they \u201cwere the subject of a criminal offense or another socially dangerous act\u201d;
• when they passed to a person connected with someone convicted of corruption or money laundering, \u201cif the court has not confirmed the legality of acquiring rights to such virtual assets, as well as to the income from them\u201d. The latter includes legal entities that received cryptocurrencies from the convict.

If the court finds no lawful basis for the rights to part of the VA, that portion will be confiscated.

If confiscation of the VA is not possible, and the legality of the acquisition of rights to which has not been established, the convicted person must pay their value.

If the owner of the cryptocurrencies did not know about their criminal use, the assets should be returned. If the owner cannot be identified, they pass to the state.

A decision to confiscate VA is issued only after proof of the owner\’s awareness of their illicit origin or use.

Disputes over VA ownership are resolved in civil proceedings.

According to Artem Afyan, managing partner at Juscutum, the introduction of the possibility to confiscate cryptocurrency at this stage is a controversial proposal \u201cdue to the specifics of regulating the virtual asset market\u201d.

Senior lawyer in criminal law and business protection practice at Arzinger, Alexey Zadoenko, told ForkLog that the \u201cs bill on virtual assets \u2014 the bill on virtual assets has been revised several times and is still not adopted. Bill on virtual assets has been revised several times and remains unadopted.

Rushing the entry into force of the procedure for handling virtual assets by investigators and prosecutors before a general law on such assets is adopted is described as \u201cnot entirely clear and premature\u201d:

\u201cAnd given law enforcement\’s well-known fondness for bending legislative gaps to their own ends, it is quite risky.\u201d

Afyan noted that the authors of the current bill do not provide a definition of virtual assets. If it is adopted, law enforcement will refer to the existing law on counteracting money laundering and financing of terrorism, the lawyer said.

\u201cThe definition of virtual assets, as a digital expression of value that can be traded in digital form or transferred, and that can be used for payment or investment purposes, is a matter of debate,\u201d emphasised Afyan.

In addition to provisions on confiscating cryptocurrencies, the bill obliges operators to bear the cost of installing the technical means necessary to carry out \u201coperational-search measures, covert investigative actions and temporary access to information\u201d about the subscriber.

They must also assist the investigation and \u201cnot to disclose organizational and tactical methods\u201d of its conduct.

The explanatory note states that the measures proposed by the bill aim to \u201cimprove the procedure for covert investigative (search) measures in criminal proceedings involving cybercrime suspects\u201d.

The provision on temporary access to information, which operators and providers must facilitate, is described as controversial by lawyers.

\u201cThe aim of such a norm could be a veiled desire by law enforcement to access users\’ private communications, bypassing the decision-making process of the Appellate Court (which exists today), replacing it with a simpler local-court order,\u201d says Zadoenko.

In the Internet Association of Ukraine noted that the purchase of technical equipment, \u201cyou need by law enforcement to perform their functions and powers, should be funded exclusively from the state budget, and not through financing such processes by business structures\u201d.

The coalition \u201cFor a Free Internet\u201d stated that this contradicts the EU Directive on electronic commerce, which prohibits imposing a general obligation on intermediaries to monitor information transmitted through them, the statement said.

Meanwhile, lawyers note that the requirement to install special equipment does not substantially narrow telecoms rights, as the obligation to install it existed previously as well.

\u201cThe proposed changes merely specify the information to which access may be granted, and the grounds for such access are defined as covert investigative actions,\u201d said Alexey Zadoenko.

In addition to Bill No. 4004, the Verkhovna Rada registered another bill — \u201cOn Amendments to the Criminal Procedure Code of Ukraine and the Code of Ukraine on Administrative Offenses to enhance the effectiveness of countering cyberattacks\u201d.

It obliges operators and providers to store traffic data for a year, \u201cdone in a volume sufficient to identify the subscriber\u201d. Law enforcement will be able to access this information by order of a investigator or prosecutor.

In the Internet Association of Ukraine note that access to such information must occur \u201conly on the basis of a court decision\u201d.

The document also allows law enforcement to access information \u201cin electronic information systems\u201d that are not subject to a search of case if the investigator or prosecutor decides that it is important for the criminal production.

\u201cThis provision grants unlimited discretion to law enforcement and offers no safeguards to protect a person\u2019s right to the secrecy of correspondence,\u201d said the \u201cFor a Free Internet\u201d coalition.

Such a possibility is bound to raise concerns, especially as law enforcement interests increasingly turn to the internet space.

In September, the secretary of the National Security and Defence Council of Ukraine, Oleksiy Danilov, stated that users of the social network \u201cVKontakte\u201d, blocked in the country, will face \u201ccertain problems directly with our police, with our security agencies\u201d.

***

Experts interviewed by ForkLog note that, on one hand, the proposed legislative changes could speed up cybercrime investigations and bring clarity to electronic evidence handling.

However, the impact may be limited to small-time offenders, says Dmitry Budorin, cybersecurity expert and CEO of Hacken:

\u201cCriminals don\u2019t always have higher education, but even they can outwit surveillance mechanisms and they have IT consultants.

He also noted that it remains unclear whether there will be protection for citizens against potential abuses of such powers beyond relying on trust in government agencies:

\u201cThere must be a clear understanding and wording of what constitutes a criminal offense, what is a socially dangerous act, in which covert cases state authorities may request data, and in which this should be restricted.\u201d

Managing partner at AО \u201cTarasyuk & Partners\u201d, Sergey Tarasyuk, believes the proposed changes could violate the constitutional right to the secrecy of correspondence.

\u201cLaw enforcement is significantly eased in intruding into private correspondence,\u201d he told ForkLog.

Forcing operators to install equipment and provide temporary access to subscriber information is described as \u201ca direct path to a police state\u201d by Artem Afyan of Juscutum.

Kuna exchange founder Mikhail Chobanian said such steps \u201chave long been the reality of a new world\u201d.

\u201cBut there is another side of the coin — a huge incentive to develop decentralised systems. For every action there is a reaction. That is how all systems balance,\u201d he noted.

Dmitry Budorin sees another potential upside of adopting the bills: a higher level of tech awareness among the population. He says that unless a \u201cGreat Firewall of China\u201d is built, most people will move to VPNs.

\u201cFighting crime will be easier, constitutional rights will be further eroded, and virtual assets will become less safe repositories of hard-earned funds,\u201d summed up lawyer Sergey Tarasyuk.

Subscribe to ForkLog news on Telegram: ForkLog Feed  all the latest news and polls on ForkLog.