Remarks of the Director General

Opening Underground Economy Conference
Intervention of the Director general of human rights
and rule of law on 8 September 2026 (09:15)

Excellencies, distinguished guests, dear colleagues, ladies and gentlemen,

Good morning, and welcome to the 7th edition of the Underground Economy Conference here at the Council of Europe in Strasbourg.

It is a great pleasure to see so many of you gathered once again: Permanent Representatives of the Member States to the Council of Europe, representatives of criminal justice authorities and international organisations, cybersecurity experts, researchers, technology companies, financial institutions, and members of academia.

On behalf of the Council of Europe, I would like to warmly welcome Team Cymru¹ and express our appreciation to you all, our longstanding partners, for the continued commitment and excellent cooperation that make this conference possible.

The Underground Economy Conference has become an important meeting point for the global cybercrime community. It is a place where technical expertise meets investigative experience.

The 2025 edition gathered experts from 70 countries and featured 80 sessions. This year’s programme is even broader and reflects an important reality: cybercrime is not a single category of crime, and its impact is not confined to the online world.

The digital environment has become a force multiplier for criminal activities. It allows offenders to rapidly reach thousands of victims and rebuild infrastructure after disruption. On the other hand, the same technologies can strengthen investigations and enable more effective prevention. Blockchain analytics can help trace illicit financial flows. Network intelligence can reveal hidden infrastructure. Digital forensics can recover evidence from devices and platforms. AI can assist with the analysis of large datasets. 

But technology alone is not enough. Effective action against cybercrime requires a combination of legal powers and international cooperation. At the heart of all that is trust.

This is where the Council of Europe’s work is particularly relevant. The Budapest Convention on Cybercrime remains the leading international framework on cybercrime. The Convention is not only a legal instrument. It is also a platform for cooperation. Its 24/7 Network provides a channel for urgent contact between competent authorities, particularly when immediate action is required.

Its Second Additional Protocol further strengthens this framework. It introduces tools for enhanced cooperation and disclosure of electronic evidence, including cooperation with service providers and registrars.

We all know that electronic evidence is crucial to investigations. It is often distributed across several jurisdictions and controlled by different actors. In many cases, the evidence is linked to an account created under a false identity or distributed across ephemeral infrastructure. Traditional investigative approaches alone cannot always respond at the required speed. This is why legal clarity and practical cooperation are essential. 

The Second Additional Protocol is designed to respond to the realities of modern investigations, while ensuring that access to data remains subject to human rights, the rule of law, data protection, and proportionality safeguards. 

This year’s agenda includes sessions on the industrialisation of fraud, the abuse of legitimate tools, the role of residential proxies, and new approaches to disruption. There will also be a variety of hands-on practical workshops.

These sessions are important because they move beyond describing threats. They ask what can be done in practice:
•    How can investigators identify the infrastructure behind a criminal service? 
•    How can law enforcement and private companies coordinate a takedown? 
•    How can evidence be preserved before it disappears? 

These are not abstract questions. The answers determine whether investigations progress or not.

The agenda also reflects the reality of the importance of public-private cooperation. 
The private sector often has access to data, technical expertise, and operational visibility that public authorities do not possess. Public authorities, in turn, have legal powers and investigative responsibilities. Neither side can address the current threat landscape alone. Cooperation, however, must be structured and supported by clear legal frameworks with appropriate safeguards. The objective is not simply to exchange more data, but to exchange the right data for clearly defined purposes, in a way that can support lawful and effective proceedings.

The Council of Europe’s approach is grounded in human rights. And it is worthwhile stating here that security and human rights are not opposing objectives. A response that disregards fundamental rights will not provide sustainable security. Conversely, a rights-based framework must be accompanied by effective investigative powers and institutional capacity if it is to protect individuals and society in practice. Citizens require trust in outcomes and processes, the two go hand in hand.

This is particularly important as AI changes both the criminal threat landscape and the investigative environment. It can help offenders generate and scale illegal material. It can also help law enforcement analyse large volumes of data. 

AI raises important questions regarding accountability and the protection of human rights. Human expertise remains essential. AI-generated results must be verified and investigative decisions must remain subject to professional judgment and legal safeguards.

This conference brings these different perspectives together. It allows practitioners to share both success stories and operational challenges and lessons learned. It encourages honest discussion about what works, what does not, and where additional cooperation is needed. The Council of Europe’s experience confirms that sustainable progress depends on continuity. Capacity-building cannot be limited to a single training course or one legislative amendment. It requires sustained engagement and networks, such as Underground Economy, that remain active beyond individual projects.

We should build on that momentum. Over the next few days, I encourage you to use this conference not only to attend sessions, but also to engage with one another. Share your experience. Identify a counterpart you need to contact. Explore how a technical capability can support an investigation. This will generate tangible results both individually and collectively.

Our response to cybercrime is not owned by one institution, one country, or one technology. It is owned by every single person working in the area. Cooperation is key. The Council of Europe is committed to supporting that cooperation through the Budapest Convention, its Second Additional Protocol, the 24/7 Network, and its capacity-building programmes.

Thank you once again for joining us in Strasbourg. I wish you a productive, informative, and inspiring conference.