Serbia - Octopus Cybercrime Community

Back Serbia

Status regarding Budapest Convention

Status : Party Declarations and reservations : Declaration contained in a letter from the Chargée d'affaires a.i. of Serbia, dated 16 July 2009, registered at the Secretariat General on 16 July 2009 – Or. Engl. See legal profile

Cybercrime policies/strategies

In light of the EU accession negotiations, Serbia adopted the Strategy for Combating Cybercrime 2019-2023, with the Action Plan (2019 - 2020) for the implementation of the Strategy on 15 September 2018. Chapter 6 of the Strategy includes the need to amend relevant legislation, by the 4^th quarter of 2020, to increase institutional capacity and training, foster inter-agency cooperation and awareness raising and prevention in the area of high-tech crime.

This strategy stipulates four specific goals in the field of high-tech crime, namely:

1. Improved and harmonized legislation of the Republic of Serbia with legal norms and standards of the European Union in the field of combating high-tech crime

2. Improved organizational, personnel, technical and operational capacity of the state authorities competent for suppression of high-tech crime

3. Improved preventive and proactive approach in the fight against high-tech crime

4. Improved cooperation at the national, regional and international level.

The Ministry of the Interior is competent authority responsible for the implementation of the strategy and most activities are carried out by the Department for Cybercrime.

Additionally, Serbia adopted the Strategy for development of information security for the period 2017 - 2020 on 30 May 2017. The Ministry of Trade, Tourism and Telecommunications is the competent authority responsible for the implementation of the strategy. National CERT is also involved.

Cybercrime legislation

State of cybercrime legislation

Law on the Ratification of the Convention on Cybercrime;
Law on the Ratification of the Additional Protocol to the Convention on Cybercrime Concerning the Criminalisation of Acts of a Racist and Xenophobic Nature Committed through Computer Systems;
Law on the ratification of the Council of Europe Convention on the Protection of Children against Sexual Exploitation and Sexual Abuse;
Criminal Code;
Criminal Procedure Code;
Law on Special Measures to Prevent the Commission of Criminal Offences Against Sexual Freedom of Minors;
Law on Electronic Communication;
Law on Information Security;
Law on Organisation and Competences of Government Authorities Combating Cybercrime;
Law on Mutual Legal Assistance in Criminal Matters.

Substantive law

Article 302 of the CC. – Unauthorised Access to Computer, Computer Network or Electronic Data Processing;
Article 304 of the CC. – Unauthorised Use of Computer of Computer Network;
Article 142 of the CC. – Violation of Privacy of Letter and other Mail;
Article 143 of the CC. – Unauthorised Wiretapping and Recording;
Article 146 of the CC. – Unauthorised Collection of Personal Data;
Article 298 of the CC. – Damaging Computer Data and Programs;
Article 299 of the CC. – Computer Sabotage;
Article 303 of the CC. – Preventing or Restricting Access to Public Computer Network;
Article 300 of the CC. – Creating and Introducing of Computer Viruses;
Article 355 of the CC. – Forging a Document;
Article 356 of the CC. – Special Cases of Forging Documents;
Article 357 of the CC. – Forging an Official Document;
Article 301 of the CC. – Computer Fraud;
Article 185 of the CC. – Showing procuring and possession of Pornographic Material and Juvenile Pornography;
Article 198 of the CC. – Violation of Moral Right of Author and Performer;
Article 199 of the CC. – Unauthorised Use of Copyrighted Work or other Work Protected by Similar Right;
Article 200 of the CC. – Unauthorised Removal or Altering of Electronic Information on Copyright and Similar Rights;
Article 201 of the CC. – Violation of Patent Rights;
Article 202 of the CC. – Unauthorised Use of another’s Design;
Article 30 of the CC. – Attempt;
Article 34 of the CC. – Incitement;
Article 35 of the CC. – Aiding and Abetting;
Article 12 of the CC. – Liability of Legal Entities for Criminal Offences;
Article 6 of the Law on the liability of legal entities for criminal offences.

Procedural law

Constitution
Article 82 of the CPC. – Proving Facts in Proceedings;
Article 83 of the CPC. – Subject-matter of Evidentiary Actions;
Article 3 of the CPC. – Presumption of Innocence;
Article 6 of the CPC. – Legality of Criminal Prosecution;
Article 16 of the CPC. – Assessing Evidence and Finding of Fact;
Article 68 of the CPC. – The Defendant’s Rights;
Article 84 of the CPC. – Unlawful Evidence;
Article 161 of the CPC. – Requirements for Ordering;
Article 163 of the CPC. – Treatment of Collected Materials;
Article 237 of the CPC. – Excluding Transcripts and Information;
Article 358 of the CPC. – Excluding Unlawful Evidence;
Article 445 of the CPC. – Actions Taken by the Court of Second Instance with the Files;
Article 282 of the CPC. – Actions to be taken by the Public Prosecutor upon Receiving a Criminal Complaint;
Article 152 of the CPC. – Subject-matter and Grounds for a Search;
Article 147 of the CPC. – Objects Being Seized;
Article 166 of the CPC. – Conditions for Ordering.

Safeguards

Constitution and Articles 3, 6, 16, 68, 84, 161, 163, 237, 358, 407 and 445 of the CPC.

Related laws and regulations

Law on the liability of legal entities for criminal offences;
Regulation on conditions for providing Internet services and other data traffic and content of the approval;
Regulation on conditions for providing services of voice transmission on Internet and content of the approval;
Law on Special Competencies for Efficient Protection of Intellectual Property Right;
Law on Personal Data Protection.

Specialised institutions

The Public Prosecutor’s Office – Special Prosecutor Office for High-Tech Crime;
The Ministry of Interior - Department for Combatting Cybercrime;
The Ministry of Interior - Service for Special Investigation Techniques, Electronic Surveillance Unit (Digital Forensic Unit);
The Ministry of Interior – Financial Investigations Unit, Service for Combating Organised Crime;
The Ministry of Interior – Section for Suppression of Money Laundering, Service for Combating Organised Crime;
The Ministry of Justice – E-justice Department;
The Ministry of Justice - Central Authority for Mutual Legal Assistance

Other relevant authorities:

Higher Court in Belgrade;
Ministry of Foreign and Internal Trade and Telecommunications;
Republic Agency for Electronic Communications;
Republic Broadcasting Agency.

International cooperation

Competent authorities and channels

Ministry of Justice is the designated central authority for mutual legal assistance in criminal matters.

Mutual legal assistance requests shall be submitted in the form of letters rogatory and together with other annexed documents of the national judicial authority shall be transmitted to foreign authorities through the Ministry of Justice. At the request of the requested state, letters rogatory and other supporting documents shall be transmitted through diplomatic channels.

Letters rogatory and supporting documents, subject to reciprocity, shall be transmitted directly to a foreign judicial authority and in case of urgency they may be transmitted through INTERPOL.

In compliance with Article 35 of the Budapest Convention, 24/7 point of contact was established in the Department for Fight Against High-Tech Crime of the Ministry of Interior and the Special Prosecutor for High-Tech Crime.

Practical guides, templates and best practices

Specific procedures and best practices for International Cooperation.

Jurisprudence/case law

Case study 1 – “POWER OFF” (Art. 5 and 6 of Convention)

At the end of April 2018, the international action “Power Off” was conducted by the competent authorities of the Netherlands, Great Britain, Serbia, Croatia, Spain, Italy, Germany, Austria, Hong Kong, Canada and the USA participated. On the basis of a request of the Kingdom of the Netherlands sent to the Special Prosecutor's Office for High-Tech Crime, an investigation was commenced against two persons, against M.J. due to the existence of the suspicion that in the period from September 2015 until the end of April 2018, according to instructions of K.R. from Croatia, against whom the investigation was commenced by the Croatian judicial authorities, created the “Webstresser” server, whose Internet presentation was on the webpage https://www.webstresser.org/, whose domain was leased via the Panama Internet Service Provider, and the location of the server itself was protected by “Cloudflare” service.

Through this website, users were able to lease the capacity of DDoS attacks servers, in order to disable or significantly interfere with the electronic data processing process, as well as to prevent legitimate users from accessing the Internet sites that were the subject of the attack. D.V., according to the instructions of K.R. from Croatia, was in charge for leasing and payment via virtual currency or PayPal.

As a reward for the performed activities, M.J. received 15% of the reported monthly salary from K.R. from Croatia.

Second defendant D.V. opened PayPal accounts that were used for receiving payments for the “Webstresser” server users. He transferred received amounts to the accounts under the control of K.R. from Croatia, who, as a reward for the performed activities, gave him monthly 10% of the reported salary for that month.

It is estimated that the accused obtained unlawful property gain in the amount of about 100,000 EUR. From the first suspect, 1.87465457 BTC were temporarily seized, while on several PayPal accounts which were used by the second suspect 6.282,18 USD were frozen.

A criminal investigation and a parallel financial investigation are under way before the Special Prosecution Office for High-Tech Crime.

Case study 2 – “SKRILL” (Art. 7 and 8 of Convention)

In January 2018 the suspect D.D. contacted M.K. from Croatia via Telegram application. M.K. offered D.D. to work with him and create accounts for him and bet on the Russian website www.betsucsess.ru, by purchasing predictions of basketball matches results from a certain person. M.K. explained him how to bet on these results on the www.bet365.com online bet. D.D. would receive a 20% fee from the gain, as well as 50 euros after opening a "ready-made" account.

On a weekly basis, D.D. created 50-60 Scrill accounts, invested 50,000 to 60,000 EUR on bets, and the profit was about 25,000 to 30,000 EUR a week. In opening Scrill accounts, D.D.was helped by one unknown person.

D.D. through the Telegram application, sent M.K. opened Skrill accounts and access parameters. Money gained from betting D.D. transferred to several Skrill accounts according to the instructions of M.K. and then from these accounts the third person transferred money to other Skrill accounts, from these to other Skrill accounts until the final point, which was the Skrill account of M.K. On a reversed path, M.K., once a month, paid the agreed percentage of his earnings to D.D.'s account.

M.K. told D.D. that he was in arms trafficking with the foreign nationals and that he had a website for crypto currencies trading. He explained that another 20 people worked for him, but that they only bet for him, and that only D.D. is opening accounts and selling it.

In May of 2018, via Telegram application, D.D.contacted B.M. from Croatia, M.K.`s acquaintance. He received an offer to open and sell Skrill orders and bet for B.M. He asked for a number of orders from D.D., so D.D. began to buy a large number of photographs of ID cards and “selfie” photographs from the persons from dozens of known and unknown persons.

Those persons, using the business name and logo (trademarks) of domestic and international companies created pages on the social network "Facebook", where they published false prize games, misleading thousands of customers and users of these companies services to obtain unauthorized personal data from them (name, surname, address of residence, telephone numbers) as well as photographs of personal documents and “selfie” photos of a person with a personal document.

Case study 3 – “Armagedon” (Art. 9 of Convention)

Special Prosecution Office for High-Tech Crime and Cybercrime Department of the Ministry of Interior of the Republic of Serbia are conducting permanent operation called “Armageddon” related exclusively to sexual abuse of children on the Internet. This operation commenced in 2011. In line with the Lanzarote Convention, these cases are considered as urgent.

With regard to this case, preliminary proceedings were initiated based on information from a Hungarian authority received via INTERPOL.

Information from the Hungarian authorities stated that Hungarian authorities received criminal complaint of a minor victim who had met an unknown person on the social network registered in Hungary with whom she started communication. After gaining victim’s trust, the defendant threatened her and forced her to send him her pictures without clothes and perform sexual activities in front of the camera.

Hungarian authorities submitted to the Serbian prosecution the IP logging records for the accounts that the defendant had used on the social network, and it belonged to Serbian internet provider. The Special Prosecution Office for High-Tech Crime obtained Court Order to locate the place of communication based on which requested data from the provider were acquired and the communication place was located. Knowing the address from which the communication had taken place, the Prosecutor’s Office obtained a search warrant. Upon obtaining the warrant, police performed the search of the premises and found evidence of the committed criminal offence on electronic devices belonging to the defendant. Devices were seized and expert opinion on the content was provided.

Simultaneously, the Special Prosecution Office for High-Tech Crime submitted request for mutual assistance, and received from the competent prosecutor's office in Hungary statements by witnesses (victim and other witnesses), as well as material evidence in the form of electronic communications that the victim had.

Based on all gathered evidence an indictment was filed. According to an indictment defendant, in the period of 2 years, on more occasions, used minor to produce photographs and audio-visual items of pornographic content. He threatened that he would post on the Internet victim`s pictures in her swimsuit and later her pictures without clothes as well as aforementioned video materials. Those threats and orders were sent via social network and via Skype. All pictures and video material defendant kept it in his computer.

The defendant was convicted for committing criminal offence Showing, procuring and possession of Pornographic Material and Juvenile Pornography under art 185 in concurrence with the criminal offense Coercion under art.135 paragraph 1 CC.

What is important to underline in relation to this case is effective and efficient mutual assistance. Not only that all requested evidence was gathered in short period of time, but the Hungarian liaison officer in Serbia brought those evidence to the prosecutor.