Pages: 27

Chapter 1 introduces the concept of cybercime. It begins by tracking the history of the computer and information communication technologies, showing how we have moved from physical computers to cloud-based systems. It shows how criminals have exploited technology throughout time and questions whether there is anything truly called cybercrime. It introduces the Dark Web (and notes that this has legitimate purposes too) and also the use of Artificial Intelligence. It then turns to definitions of cybercrime and considers how you can classify cybercrime. This includes computer-assisted crimes and computer-focused crimes and focuses on whether the crime takes place wholly in the physical world, wholly in the online world or both. The chapter also considers some of the problems of cybercrime, including its scale, the fact that people can be anonymous and that it has a global reach. The chapter concludes by looking at the Budapest Convention, also known as the Cybercrime Convention, and how this has become the key international instrument. It notes that a new United Nations Convention is being drafted but that it is unlikely to surpass the Budapest Convention.

Pages: 28

This chapter introduces two of the main forms of cybercrime: hacking and malware. However, the chapter first discusses what the legal meaning of a computer is, and notes the fact that neither domestic nor international law ever defines it. The chapter then turns to hacking. It notes that hackers were once thought to be innocent. They helped develop our understanding of technology. However, the media now portrays hackers as being the bad guys and making things happen to computers. The motivation of hackers is considered, with the hat system (white hat, black hat and grey hat) sometimes being used to discuss why people act, although this is overly simplistic. The chapter looks at what hackers do, including theft of information, theft of resources, Denial of Service attacks, Distributed Denial of Service attacks and the distribution of malicious software. The second half of the chapter looks at malware, particularly the virus, trojan and worms. Viruses have existed for a long time and spread through physical media. The internet meant viruses could spread quickly. Some viruses turn computers into bots, meaning that a user can control them to undertake Denial of Service attacks. Spyware, Adware and Ransomware are also examined.

Pages: 40

This chapter builds on Chapter 2 and looks at the legal responses to hacking and malware. It begins by looking at the Cybercrime Convention and how the offences are set out. The Cybercrime Convention requires that things are done without right, and the chapter explores what that means. The Convention considers illegal access (which can cover both hacking and malware), illegal interception (where data is captured because of tampering), data interference and system interference. It is noted that the conjoined environment means that we should now be more worried about access to data rather than systems as data is now the most important commodity. The chapter notes that jurisdiction and cross-border crime is the biggest issue in this area as most hacking and malware originates from outside of one’s borders. The Computer Misuse Act 1990 is then introduced and it notes that this requires that actions be done without authority. As with the Convention, the Act considers unauthorised access as being the key offence; this applies when someone secures access without permission. There is then the aggravated offence of accessing a computer intending to commit a further crime, which could cover situations where bots are used to do illegal acts. Data Protection is also considered as this is an important aspect of the law and blackmail is considered for ransomware.

Pages: 32

This offence looks at Intellectual and Virtual Property. The internet poses a serious threat to intellectual property. The chapter notes how Napster and other services used to allow people to copy music or films from the internet without charge. The chapter notes that most people do not own software or music, they simply have a licence to use it. It notes that the term piracy is used for intellectual property crimes. This is not a new term and the use of pirates in this way dates back to the days of the printing presses. Copyright and Patents are considered and how the law can be used to help firms protect themselves from intellectual property theft. Trade Marks are also considered and how the internet can be used to trade fake or counterfeit goods. The chapter considers whether this is always a crime if people know that they are buying counterfeit goods. The chapter then turns to virtual property. This looks at digital objects, particularly in computer games such as Massively Multiplayer Online Role Playing Games where the character (an Avatar) can collect objects. If someone steals those objects is that a crime or not? It notes that under current law, the law of theft would not cover this and so alternatives must be used.

Pages: 30

Chapter 5 introduces the concept of cyber-fraud or fraud. Indeed, at the beginning of the chapter, there is a discussion on whether all fraud is now cyber-fraud, and whether ‘cyber’ adds anything. There are lots of different types of fraud, including low-level trickery and story-based frauds. Both of these are versions of old scams. There can be frauds through obligations (where people think that they need to do something) and frauds that take place as a result of appeals (charity fraud). There are also things like romance fraud which is increasingly common. Commerce fraud is looked at which includes shill bidding and auction frauds. It also looks at advertising fraud and frauds against sellers, including chargeback fraud and loyalty fraud. The chapter questions whether all of these examples are actually frauds. 419 frauds, also known as advance fee frauds, are considered. These are perhaps the most common attempted fraud, with most people having received an email that tries this. Confidence frauds, with romance fraud being the best known, are also considered in detail. These frauds rely on storytelling and try to get someone to feel sorry for them. The impact of victims is also considered, and how they can suffer psychological harm and distress. The law is examined, particularly the Fraud Act 2006 and how the concept of dishonesty is at the heart of the law. Fraud by representation is the most common offence and will tackle most of the frauds outlined in this chapter. Conspiracy to defraud is a common-law offence and is still used, and its use is also considered in this chapter.

Pages: 22

This is a new chapter and considers the issue of malicious and abusive communications. These are issues that have become increasingly controversial in recent years, because there is a belief that they can harm free speech or freedom of expression. There are two key offences that currently apply. The first is the Malicious Communications Act 1988. This applies to people who send a letter or electronic communication that is indecent or grossly offensive. The second offence is the Communications Act 2003 and this prohibits the sending of a message that is grossly offensive, indecent or of an obscene or menacing character. These offences have been heavily amended by the Online Safety Act 2023, which sought to abolish the communication offences and replace them with new offences, but which did not get Parliamentary approval. The definition of gross offensiveness has been one of the most controversial aspects in this area. The courts have tried to ensure that the law does not preclude free speech although some people still think it does. However, while it is easy to point to cases where it may be thought the law went too far, it is also easy to identify situations where if the law did not apply then bullying and other conduct may thrive. The chapter ends by looking at the Online Safety Act 2023 and the new harms-based offences that it wished to introduce.

Pages: 16

This chapter looks at two issues that are often taken together: stalking and bullying. As with fraud, there is a disagreement as to whether these should be called cyberbullying and cyberstalking or not. The argument against using cyber in the title is that the internet and other technologies are simply a tool to undertake the bullying and stalking. That the stalking would happen in any event, but technology allows it to take place online. Bullying is similar where there is some evidence that even online bullying takes place when the two parties know each other. So, the technology simply allows other forms of bullying to be brought online. That said, there are undoubtedly circumstances when bullying does only take place only online and here jurisdiction can be a problem as bullying can take place across international borders. The chapter considers how the law can respond. It notes that nonfatal offences are quite difficult to use because under English law an assault requires a person to apprehend immediate and unlawful violence, something sometimes tricky over computers. That said, when the impact on a victim is such as to cause psychiatric harm, then some of the more serious offences can be used. Stalking is covered by the Protection from Harassment Act 1997 although some question the extent to which it covers online stalking. The more usual offences are the communication offences but the proposals under the Online Safety Act 2023 could make that more difficult. It shows that while freedom of speech has been the main focus of these offences, an unintended consequence could be that there is more bullying.

Pages: 24

This chapter considers two key issues in respect of online content. The first is hate content, which is typically racist or extremist content. The second relates to self-harm. The first issue – hate crime – relates to hate speech and its interaction with free speech/freedom of expression. The chapter notes that the internet has led to a significant increase in hate content, particularly anti-Semitic content and racism. The chapter explores what hate speech is and what the value of ‘hate’ is, noting that it has to be beyond a dislike for a particular minority group. The controversy over extending hate speech to cover certain lifestyle choices is also explored, and it is noted that while there are common characteristics, it would not be appropriate to consider these as hate crimes (as distinct to bullying or harassment). The chapter considers some of the key forms of hate crime on the internet, including Holocaust denial and white supremacy sites. The reasons for posting such content are also considered, which include normalising such views and seeking to portray them as normal. The chapter notes that there is a transatlantic divide over how the law tackles this material, with European countries (including the UK) treating the matter as criminal whereas the Americas tend not to consider it as seriously, fearing that it interferes with free speech. The second half of the chapter notes how the internet has been used to promote suicide, self-harm and eating disorders. Again, the chapter goes through the different ways that the internet can be used to promote self-harm. By focusing on eating disorders the chapter notes that the language becomes personified and that while some websites seek to act as recovery sites, they are often misused by others. The limits of the law in tackling this material are explored, including how the new Online Safety Act 2023 could affect this.

Pages: 29

This is a new chapter that considers sexual offending on the internet. It does not consider pornographic material that is considered in later chapters. It focuses on three key topics. The first is cyberflashing (also known as Dick Pics), the second is voyeurism (including upskirting) and the third is the sexual solicitation of children (also known as Grooming). The first, cyberflashing, is when people send unsolicited sexually explicit photographs to others, usually in a public space. It is an issue that has attracted considerable public attention in recent years. The chapter outlines the behaviour and notes that it should not be dismissed as a trivial issue because it can have significant emotional harm on victims, who are invariably female. The chapter outlines how a recent law has specifically been introduced into English law to tackle this behaviour. The second topic considered is that of voyeurism and upskirting. The chapter notes how this now invariably uses technology, including hidden cameras but sometimes through infecting a computer with a trojan virus and taking over the webcam. The chapter notes the differences between voyeurism and upskirting and details its prevalence and how it affects victims. It notes that this is a crime that affronts the dignity and sexual autonomy of the victim. The final part of the chapter looks at the sexual solicitation of children/grooming. It notes that this is an issue that captured a lot of attention at the turn of the millennium. The internet allows new opportunities for adults to talk sexually to children. It notes that there are different forms of child solicitation, including those where an adult seeks to meet a child so that they can sexually abuse them. However, some offenders will solicit children online to perform sexual acts online. It notes with this latter behaviour this will also include blackmailing the child. The chapter outlines the legal solutions to this behaviour, including a specific offence of grooming and also sexual offences that tackle inciting a child to perform a sexual act.

Pages: 27

This chapter considers the issue of Child Sexual Abuse Material. This used to be referred to as Child Pornography, but the chapter notes that this is a term that is now not used because it downplayed the abusive nature of the images. This chapter provides a comprehensive introduction to the issue of Child Sexual Abuse Material. It sets out the definition of such material, including the definition of ‘a child’, which is surprisingly difficult to define. It also notes that most laws tend to focus on photograph-based forms of material but that Artificial Intelligence has transformed the way that photograph-quality material can be produced. The chapter also considers the harms that are caused by child sexual abuse material. While the production will inevitably lead to harm being caused, the chapter notes that both the distribution and the simple possession or viewing of material can cause harm. This harm is sometimes known as secondary victimisation and is based on the psychological harm that is caused by knowing that the material is in circulation, and that people are using it for sexual gratification. The chapter considers how international law seeks to tackle child sexual abuse material before turning to the law in England and Wales. This prohibits an indecent photograph of a child, and the chapter considers what indecent means, and how the age of the child can influence this. The chapter also considers so-called Virtual Child Sexual Abuse Material, which is now largely AI derived. It considers whether the law has managed to keep pace with the technological changes in this area.

Pages: 36

This chapter considers Adult Sexual Material, also known as pornography. It notes that in the 1970s there was a general liberalisation of laws relating to adult pornography, but the internet has raised concerns that the range and accessibility of material means that questions arise over whether the law remains appropriate. The chapter opens by examining the competing arguments around the criminalisation of pornography. The chapter highlights that there is a dispute between different generations of feminists as to whether pornography should be outlined. While traditionally seen as degrading of women, some modern producers suggest that it is possible to have empowered pornography and that we should not make assumptions as to how it is produced. The chapter continues by focusing on obscene publications, noting that these are not restricted to sexual content. The chapter also notes that the law relating to obscenity dates back to the 1960s, and is largely out of date. The chapter notes that this means attention has been paid to alternative ways of criminalising problematic behaviour. Specific legislation is introduced in respect of so-called ‘extreme pornography’. This is a specific type of sexualised material that includes bestiality, necrophilia and acts of severe violence. The chapter considers the legality of the provisions and notes that in some instances it is not possible to differentiate between real and simulated images. Finally, the chapter turns its attention to the distribution of images without consent, also known as ‘revenge pornography’. The chapter outlines what the behaviour is and how it can cause significant emotional harm to those who are the subject of disclosure. The chapter highlights how the law has recently changed so as to increase protection for victims.

Pages: 21

This chapter considers the issue of jurisdiction. While this is something introduced in other chapters as a challenge for cybercrime, it is considered in depth during this chapter. Jurisdiction is both an international and a national concept. The chapter begins by noting that the general rule is that countries can legislate however they wish within their own borders, and technically they can prescribe illegal conduct elsewhere in the world, but the question then is how they get custody of the offender to try him. This then gives rise to the main rule within jurisdiction known as the ‘territorial principle’. Countries will then typically extend jurisdiction (extraterritorial jurisdiction) in one of several ways. The first is the active personality principle, which is where the state criminalises the actions of their own citizens or residents whilst abroad. This has historically been used to combat child sex tourism. The second form of extraterritoriality is known as the passive personality principle, which is when a country claims the right to try offenders who offend against one of their citizens or residents who is abroad (i.e. the same as the active personality but for victims). The third basis is the protective principle which tends to be used to safeguard the security of the state or important state interests. This can include cyberattacks on important national infrastructure. The final basis is universal jurisdiction. This is where a matter is considered so serious that a state can try a citizen of any crime for acts committed against anyone. This tends to be rarely used and is only for the most severe crimes, such as genocide and other crimes against humanity. Of course a problem with exercising extraterritorial jurisdiction is that you need to gain custody of the offender through extradition, and the challenges of this are discussed in the chapter. The chapter also considers calls for a cyberspace jurisdiction where cyberspace is recognised as an international space. The chapter notes that this is impractical and so the normal rules of jurisdiction apply.

Pages: 26

This chapter considers how policing is organised around cybercrime. Having laws is no use if there is not the ability to enforce them. The chapter begins by discussing traditional law enforcement agencies (‘the police’) and notes that in the UK, they are organised into forty-five constabularies (forty-three in England and Wales, one in Scotland and one in Northern Ireland). The chapter discusses how they are organised, including through high-tech crime units. Police forces also come together to create Regional Organised Crime Units, and these have an important role to play in cybercrime, particularly in respect of child sexual exploitation. Alongside the local forces are the national forces, led by the National Crime Agency, the latest attempt at a UK-wide police force. Again, this has a cybercrime capability, particularly through the Child Exploitation and Online Protection Command (CEOP). The chapter also looks at the issue of fraud. Despite this being one of the most prolific forms of cybercrime (as discussed in Chapter 5) you cannot report crime to the police. Instead, it must proceed via Action Fraud. The chapter notes how less than 1% of fraud is now actioned by law enforcement, and questions whether that means it can truly be said that fraud is taken seriously. International law enforcement agencies, such as INTERPOL and EUROPOL, are considered, with it being noted that only a truly international approach can tackle international crime such as cybercrime. Finally, the chapter considers private policing. In this context, it means how the internet industry itself is seeking to address some of the issues it experiences. This chapter also includes consideration of the new requirements in the Online Safety Act 2023.

Pages: 37

This final chapter considers the investigative powers that the police use. It includes an examination of digital evidence, and notes that often this is what poses challenges to the police. Gaining possession of the device in order to investigate it can be a real challenge, particularly when the offender or the victim’s computer is outside of the jurisdiction. Even when both parties are within the same country, the sheer amount of material that is stored on electronic devices can pose real challenges to law enforcement. The chapter then turns its attention to communications data. This is an extremely controversial area of the law, and it is where the police and security services can gather data in respect of the use of the internet, device or telephone. While the content of a communication cannot be gathered (as that constitutes an illegal interception), it does include the who, what and how. This allows the police or other agencies to build up a picture of what sites are being accessed, or who a suspect is talking to. The issue of bulk data collection – where large numbers of people’s data are gathered – is also considered in this chapter. There have been many challenges to this area, and the courts have considered some of the powers to breach human rights. The principal challenges to the investigatory power’s regime are considered, and an analysis is made of where the courts draw the line. The final section of the chapter looks at online surveillance, including OpenSource Intelligence. This is how law enforcement can use publicly available information such as websites and social media postings to gather intelligence on a group or individual’s online dealings. The second aspect of surveillance that is considered is the use of Covert Human Intelligence Sources (CHIS), who will act as undercover agents to talk to people online. This is particularly common in respect of the sexual solicitation of children, and the chapter notes how the courts have reacted to this.