Cyber attacks on critical infrastructure's objects can have dire consequences, as our entire lives depend on the working capacity of such systems. In Ukraine, cybercrime provides for criminal and civil liability under the Criminal and Civil Codes of Ukraine, and under the Law of Ukraine “On the Fundamental Principles of Cyber Security in Ukraine”. A successfully implemented decision-making support system that can provide a conclusion of legal responsibility in the cybersecurity domain, namely, propose sanctions recommended in the case of an offence or multiple offences, can significantly improve the productivity of the Ukrainian cyber police. This paper explores the legal and organizational principles of cybersecurity in today's information society, and first time develops the method and production rules of forming a logical conclusion about legal responsibility in the cybersecurity domain, that are used to form the conclusion about legal responsibility, namely for the selection of a sanction or set of sanctions recommended in the event of a particular offence or multiple cyber-security offences.
The modern development of an information society is directly linked to the need to collect, process and transmit vast amounts of information. The main criteria of the information society are the amount and quality of available information, the efficiency of its transmission and processing, the accessibility of information for everyone.
So, information management is becoming a business-critical function. So the main
strategic goal of the development of the information society in Ukraine is providing
the security and protection of information. The issue of information security becomes
more acute [
Copyright © 2020 for this paper by its authors. Use permitted under Creative Commons License Attribution 4.0 International (CC BY 4.0).
Cyber-attacks on critical infrastructure's systems pose real threats to the safety of the human community, lead to human casualties, environmental disasters, and significant financial losses.
Today, on a monthly basis, Ukraine undergoes cyber attacks 3000-3500 times. In the
last 12 months, every second industrial company in the world has experienced one to
five cyber incidents. The loss of the world economy as a result of cyber-attacks is 445
billion USD. Losses to Ukrainian businesses caused by the cyber-attacks amount to 25
million USD [
So the actual problem with using computer systems is the robust protection of information against cyber threats.
Therefore, most countries in the world carry out comprehensive measures to ensure
national cybersecurity. These measures relate, first and foremost, to the development and
improvement of regulations, as well as to the establishment of departmental and state
structures that regulate and be responsible for ensuring the security in the cyberspace [
In 2001, the European Commission presented the first document entitled "Network and
Information Security: A Proposal for A European Policy Approach" [
In Ukraine, cybercrime provides for criminal and civil liability under the Criminal
Code [
Problem Statement
A successfully implemented decision-making support system that can provide a conclusion about legal responsibility in the cybersecurity domain, namely, propose sanctions recommended in the case of an offence or multiple offences, can significantly improve the productivity of the Ukrainian cyber police. For developing this decision support system, a method and production rules of forming a logical conclusion about legal responsibility in the cybersecurity domain should be developed, which is the purpose of this research.
Such a decision support system, like any decision support system (DSS), can be represented as a formal system:
C =<A, PR, M>, where C is the set of alternatives (conclusions) that are generated by DSS; A is the set of the basic elements (set of actions (offences), which entail certain sanctions under the current legislation of Ukraine); PR is the set of rules by which alternatives are generated for objects with A; M are methods used in data processing.
The DSS inputs (set A) are actions (offences), which entail certain sanctions under the current legislation of Ukraine. The outputs of the DSS (set C) are the results of the data analysis, on the basis of which the decisions are generated, as well as the decisions (conclusions about the sanction(s), which recommended in the case of committing an action (offence) or a few actions (offences)). Then the relationship between the input and output parameters is a mathematical description of DSS:
C=M(A), (1) (2) where M is a method that allows to parameters of A to match an alternative of C using the production rules of PR.
In order to achieve the purpose of this research, the following tasks must be solved: developing the production rules (set PR) and method (M) of forming a logical con
clusion about legal regulations in the cybersecurity domain; design of decision support system for forming a logical conclusion about legal regulations in the cybersecurity domain, for the selection of sanctions, which are recommended in the case of the cybersecurity offence or multiple offences. 3
Production Rules and Method of Forming a Logical Conclusion
about Legal Responsibility in the Cybersecurity Domain
First of all, we will develop production rules of forming a logical conclusion about
legal responsibility in the cybersecurity domain (set PR = {pr1,…, pr13}) based on
the norms of the Criminal [
For this purpose, we will form a set of actions (offences), which entail certain sanctions under the current legislation of Ukraine: A = {a1,…, a10}, where a1 – unauthorized interference with the operation of computers, automated systems, computer networks or telecommunication networks, that have led to leakage, loss, tampering, blocking of information, distortion of the information processing process or disruption of established routing order; a2 – re-committing; a3 – preliminary conspiracy of a group of persons; a4 – causing significant damage (damage that exceeds the tax-free minimum income of citizens 100 times or more); a5 – creation for the purpose of use, distribution or sale, as well as distribution or sale of malicious software or hardware, which intended for unauthorized interference with the operation of computers, automated systems, computer networks or telecommunication networks; a6 – unauthorized sale or distribution of restricted information, which stored in computers, automated systems, computer networks or on special media of such information; a7 – unauthorized modification, destruction or blocking of information, that is processed in computers, automated systems or computer networks or stored on special media of such information; a8 – unauthorized interception or copying of information, that is processed in computers, automated systems, computer networks or stored on special media of such information, which led to information leakage; a9 – violation of the rules of operation of computers, automated systems, computer networks, telecommunication networks or of the order or rules of protection of the processed information, which caused significant damage; а10 – intentional mass distribution of messages, which was made without the prior consent of the addressees, that has led to the disruption or termination of the operation of computers, automated systems, computer networks or telecommunication networks.
Given the set of actions (offences) A, the production rules of forming a logical conclusion about legal regulations in the cybersecurity domain are the set {pr1,…,pr13}:
pr1=“if the person has committed action a1, then and only then such person shall be punished by a fine of six hundred to one thousand tax-free minimum incomes, or by restriction of liberty for a term of two to five years, or imprisonment for up to three years, with deprivation of the right to occupy certain positions or engage in certain activities for a term up to two years”;
pr2=”if the person has committed action a1 and action a2 and/or action a3 and/or action a4, then and only then such person shall be punished by imprisonment for a term of three to six years, with deprivation of the right to occupy certain positions or engage in certain activities for up to three years”;
pr3=”if the person has committed action a5, then and only then such person shall be punished by a fine of five hundred to one thousand tax-free minimum incomes, or by correctional labour for a term up to two years, or imprisonment for the same term”;
pr4=”if the person has committed action a5 and action a2 and/or action a3 and/or action a4, then and only then such person shall be punished by imprisonment for a term up to five years”;
pr5=”if the person has committed the action a6, then such person shall be punished by a fine of five hundred to one thousand tax-free minimum incomes, or imprisonment for a term up to two years”;
pr6=”if the person has committed action a6 and action a2 and/or action a3 and/or action a4, then and only then such person shall be punished by imprisonment for a term of two to five years”;
pr7=”if the person has committed action a7, then and only then such person shall be punished by a fine of six hundred to one thousand tax-free minimum incomes or corrective labour for a term up to two years”;
pr8=”if the person has committed action a7 and action a2 and/or action a3 and/or action a4, then and only then such person shall be punished by imprisonment for a term of three to six years, with deprivation of the right to occupy certain positions or engage in certain activities for up to three years”;
pr9=”if the person has committed the action a8, then and only then such person shall be punished by imprisonment for a term up to three years, with deprivation of the right to occupy certain positions or engage in certain activities for the same term”;
pr10=” if the person has committed action a8 and action a2 and/or action a3 and/or action a4, then and only then such person shall be punished by imprisonment for a term of three to six years, with deprivation of the right to occupy certain positions or engage in certain activities for up to three years”;
pr11=”if the person has committed action a9, then and only then such person shall be punished by a fine of five hundred to one thousand tax-free minimum incomes, or a restriction of liberty for a term up to three years, with deprivation of the right to occupy certain positions or engage in certain activities for the same term”;
pr12=”if the person has committed action a10, then and only then such person shall be punished by a fine of five hundred to one thousand tax-free minimum incomes, or by restriction of liberty for a term up to three years”;
pr13=”if the person has committed action a10 and action a2 and/or action a3 and/or action a4, then and only then such person shall be punished by restriction of liberty for a term up to five years, with deprivation of the right to occupy certain positions or engage in certain activities for up to three years”.
On the basis of the developed production rules, we will develop the method of forming a logical conclusion about legal regulations in the cybersecurity domain: 1. the set of actions (offences) Аreal = {a1real,…,anreal}, which are committed by the offender, is formed, where n is the number of offences committed by a concrete offender; 2. by the method of searching in the breadth in the forward direction, in the set of production rules {pr1,…,pr13}, a rule(s) is(are) searched for each of the elements of the set {а1real,…,anreal}; 3. according to the selected rules, the conclusion is drawn about the sanction(s), which recommended in the case of committing an action (offence) or a few actions (offences); if the rule is not found, then there is no sanction(s) accordance with the modern legislation of Ukraine.
The scheme of the developed method of forming a logical conclusion about legal regulations in the cybersecurity domain is represented on Fig. 2.
Examples of forming a logical conclusion about legal regulations in the cybersecurity domain. Person1 has created and distributed a new computer virus V1, which is designed for unauthorized interference with the operation of the computer network of Enterprise1. Then for this case the set Аreal = {“creation for the purpose of use, distribution or sale, as well as distribution or sale of malicious software or hardware, which intended for unauthorized interference with the operation of computers, automated systems, computer networks or telecommunication networks”}. In the set of production rules, the search of rule for the action (offence) from the set Аreal is executed – this is pr3. According to this rule, the conclusion about the sanction, which recommended in the case of committing this action (offence), has the form: “Person1 shall be punished by a fine of five hundred to one thousand tax-free minimum incomes, or by correctional labour for a term up to two years, or imprisonment for the same term”.
Person2 perefromed unauthorized modification of information, that is processed in automated system of Enterprise2. Then for this case the set Аreal = {“unauthorized modification, destruction or blocking of information, that is processed in computers, automated systems or computer networks or stored on special media of such information”}. In the set of production rules, the search of rule for the action (offence) from the set Аreal is executed – this is pr7. According to this rule, the conclusion about the sanction, which recommended in the case of committing this action (offence), has the form: “Person2 shall be punished by a fine of six hundred to one thousand taxfree minimum incomes or corrective labour for a term up to two years”.
Discussions. The authors analyzed the materials of 20 cases initiated against persons who committed cybersecurity offences, in which the court decided to return for revision to the cyber police due to incorrectly formulated requests for sanctions.
Analysis of the data from these cases using the developed rules method of forming a logical conclusion about legal regulations in the cybersecurity domain showed that if the developed method was used before the case was sent to court, all correct decisions on the necessary sanction would be made. Therefore, the use of developed rules and methods can increase the level of correctness of decisions on the required sanction to 100%. Thus, the decision support system for the selection of sanctions, which are recommended in the case of cybersecurity offences or multiple offences, will provide rapid and automatic verification of all cases against perpetrators of cybersecurity offences, in terms of the choice of sanctions for such persons. 5
At present, in the age of the information society, cyber weapons in terms of efficiency and impact can be equated with weapons of mass destruction. The faster humanity develops information technologies, the greater is the need to protect them, to ensure their cybersecurity. Today, no state can say with certainty that its networks are fully secure and able to withstand multi-vector cyberattacks, so cybersecurity has become a priority in many countries. At first glance, it may seem that cyberattacks cannot do much harm or take lives, but attacks on critical infrastructure's objects can have dire consequences, since our entire lives depend on the working capacity of such systems.
A successfully implemented decision-making support system that can provide a conclusion of legal responsibility in the cybersecurity domain, namely, propose sanctions recommended in the case of an offence or multiple offences, can significantly improve the productivity of the Ukrainian cyber police.
This paper first time develops the method and production rules of forming a logical conclusion about legal responsibility in the cybersecurity domain, that are used to form the conclusion about legal responsibility, namely for the selection of a sanction(s) recommended in the event of a particular offence or multiple cyber-security offences.
The perspective directions of future authors’ work are the designing, developing and implementing the decision support system for the selection of sanctions, which are recommended in the case of the cybersecurity offence or multiple offences. The basis of such the system will be developed in this paper production rules and method of forming a logical conclusion about legal responsibility in the cybersecurity domain.