Cybercrime and Prohibited Online Conduct

Introduction and Context

Digital networks support banking, education, government, health care, commerce and social communication. The same connectivity, however, creates opportunities for unlawful access, deception, harassment, disruption and theft. Cybercrime is not a single offence. It is a broad category of conduct in which computers, networks, digital data or online services are the target, the instrument, or the environment of offending.

Cyber law attempts to protect confidentiality, integrity, availability, identity, privacy, property and personal security. The precise offence names, jurisdictional boundaries, evidentiary rules and penalties differ between countries. Students must therefore distinguish universal principles from the law of a particular jurisdiction. A practical investigation should always begin by identifying the applicable statute, the location of relevant conduct, the location of affected systems and any cross-border issues.

Learning Objectives

By the end of this chapter, the learner should be able to:

• distinguish major categories of cybercrime and prohibited online conduct;
• explain the usual actus reus and mens rea elements of cyber offences;
• recognize unauthorized access, malware, ransomware, fraud, identity theft, phishing, cyberstalking and attacks on critical systems;
• identify common defenses, limitations and jurisdictional difficulties;
• explain basic prevention, preservation and reporting procedures; and
• evaluate the ethical and professional responsibilities of a person handling a cyber incident.

1. Understanding Cybercrime

Cybercrime may be classified according to the role of technology:

A second useful classification is based on the protected interest:

• Confidentiality: preventing unauthorized disclosure of information.
• Integrity: preventing unauthorized alteration or destruction.
• Availability: ensuring systems and services remain usable.
• Authenticity and identity: ensuring that a person, device or message is genuine.
• Property and economic security: preventing theft, fraud and extortion.
• Personal safety and dignity: preventing threats, harassment, abuse and stalking.
• Public and national security: protecting critical infrastructure and essential services.

Elements of an Offence

Most criminal offences require both a prohibited act and a legally required mental state. The prohibited act is often called the actus reus. The mental element is the mens rea, such as intention, knowledge, recklessness or dishonesty. Some regulatory offences may impose liability on a different basis, but this cannot be assumed.

For example, unauthorized access may require proof that a person:

1. accessed a computer, account or network;
2. lacked permission, exceeded the permission granted, or knew that access was restricted; and
3. acted intentionally or with the mental state specified by the relevant law.

The prosecution generally must prove the elements beyond the applicable criminal standard of proof. Evidence may include authentication logs, access-control records, system images, emails, payment records, device data, witness testimony and statements made by the suspect. Mere suspicion, possession of a hacking tool or presence of malicious software is not automatically proof of every offence.

2. Unauthorized Access and System Intrusion

Unauthorized access occurs when a person enters or uses a computer system, account, application or network without lawful permission. It can involve guessing or stealing passwords, exploiting a software vulnerability, bypassing authentication, using another person’s session, or accessing an employee account after permission has been withdrawn.

The legal distinction between authorized security testing and unlawful intrusion is crucial. A penetration tester normally acts under a written scope of work defining the systems, dates, methods and reporting duties. Testing outside that scope may create legal and professional risk, even when the initial engagement was authorized.

Unauthorized access may be accompanied by:

• Privilege escalation: obtaining higher permissions than originally granted;
• Data exfiltration: copying data from a system;
• Persistence: maintaining access after an initial compromise;
• Credential theft: obtaining passwords, tokens or keys; and
• Covering tracks: deleting or altering logs.

Common defenses or limiting issues include valid authorization, lack of the required mental state, mistaken identity, inadequate proof of access, or access within the person’s lawful role. An employee who is allowed to view a record may nevertheless commit a separate offence by copying, disclosing or altering it. Authorization is often limited by purpose, time, system and permitted action.

3. Malware and Ransomware

Malware is software designed or used to perform unauthorized, harmful or deceptive activity. Important forms include viruses, worms, trojans, spyware, keyloggers, botnet software and destructive wipers. Malware can steal information, control devices, damage data, monitor users or provide a platform for later offences.

Ransomware commonly encrypts or locks data and demands payment for restoration. Modern campaigns may also steal data and threaten public disclosure. The conduct can therefore involve unauthorized access, interference with data or systems, extortion, fraud and money-laundering offences.

The existence of malicious code alone does not resolve criminal responsibility. Investigators must examine who created, deployed, distributed or knowingly possessed it, the purpose of the conduct, the resulting harm and the connection between the accused and the act. A researcher may lawfully possess malware samples in a controlled environment for analysis, subject to institutional policy and applicable law.

Organizations should maintain offline or otherwise protected backups, apply security updates, restrict privileges, segment networks, use multifactor authentication and rehearse an incident-response plan. Paying a ransom does not guarantee recovery and may create sanctions, regulatory or ethical concerns. Decisions should involve legal counsel, management, technical responders and, where appropriate, law enforcement.

4. Fraud, Phishing and Identity Theft

Online fraud uses deception to obtain money, property, services, credentials or another advantage. The essential pattern is usually a false representation, concealment or deceptive act that causes another person to act, resulting in or intending economic loss.

Phishing is a deceptive communication designed to induce a person to reveal information, click a harmful link, transfer money or install software. Variants include:

• Spear phishing: targeted messages directed at a particular person or organization;
• Whaling: targeting senior executives or high-value individuals;
• Smishing: phishing through SMS or messaging services; and
• Vishing: phishing through voice calls.

Business email compromise commonly involves impersonating an executive, supplier or professional adviser and requesting an urgent payment or change to bank details.

Identity theft involves obtaining, possessing, using or transferring identifying information without lawful authority, often to impersonate the victim or obtain a benefit. Relevant information may include account credentials, national identification numbers, payment details, biometric data and personal security answers.

A person who merely receives a suspicious message is not necessarily an offender. Liability depends on conduct and mental state. Deliberately creating a deceptive website, harvesting credentials and using them to withdraw funds are materially different acts from unknowingly forwarding a message.

Defensive practice includes independent verification of unusual payment requests, password managers, multifactor authentication, transaction limits, domain-name scrutiny, staff training and rapid notification of financial institutions. Victims should preserve messages and transaction information rather than deleting them.

5. Cyberstalking, Online Abuse and Unlawful Communications

Cyberstalking is repeated or serious unwanted digital conduct that causes fear, distress or a reasonable concern for safety. It may include persistent messages, monitoring, doxxing, impersonation, location tracking, threats, publication of private material and attempts to contact family, employers or colleagues.

Online abuse may include unlawful threats, harassment, discriminatory abuse, non-consensual intimate-image distribution, child sexual exploitation material, incitement to violence and targeted intimidation. Freedom of expression protects substantial communication in many legal systems, but it does not provide a universal defense to threats, coercion, criminal harassment or exploitation.

Important assessment questions are:

• Was the conduct repeated, severe or targeted?
• Did the person know, or should the person have known, that it was unwanted or threatening?
• Was there a credible threat or a pattern creating fear?
• Was private information obtained or disclosed unlawfully?
• Are there special protections for children or vulnerable persons?

A person experiencing abuse should preserve URLs, usernames, timestamps, screenshots and original files; use platform reporting and blocking tools; strengthen account security; and contact emergency services where there is an immediate threat. Evidence should be collected safely and without provoking further contact.

6. Attacks on Critical Information Infrastructure

Critical infrastructure includes systems essential to public health, safety, economic stability or government functioning. Examples may include electricity, water, telecommunications, transport, banking, emergency services and health-care systems. A cyberattack against such systems may produce physical, economic or societal harm beyond the affected computer.

Common attacks include distributed denial-of-service, destructive malware, unauthorized operational-technology access, supply-chain compromise and theft of sensitive infrastructure information. Some jurisdictions create aggravated offences where the target is a protected system or where the conduct threatens national security or human life.

Organizations operating critical systems should identify essential services, separate operational technology from ordinary business networks, maintain manual fallback procedures, restrict remote access, monitor anomalous activity and coordinate with sector regulators and national cyber authorities. Incident planning must address continuity of service, public communication and safety—not only restoration of computers.

7. Defenses, Liability and Penalties

Potential defenses vary by statute but may include:

• valid authorization or consent;
• lack of intention, knowledge or dishonesty required by the offence;
• mistake of fact;
• duress or necessity, where recognized and strictly limited;
• lawful security research conducted within authorization and applicable safe-harbor conditions;
• lack of causation or insufficient evidence; and
• jurisdictional failure, where a court lacks authority over the conduct.

Good intentions do not automatically excuse unauthorized access. Similarly, a person cannot normally rely on the claim that no data were stolen if the law criminalizes access or interference itself. Security professionals should obtain written authorization, define scope, minimize collection, protect findings and report vulnerabilities responsibly.

Penalties may include imprisonment, fines, confiscation of devices or proceeds, compensation, restitution, civil damages, regulatory sanctions, professional discipline and contractual consequences. Aggravating factors commonly include significant financial loss, repeated conduct, targeting children or vulnerable persons, use of botnets, attacks on essential services, personal gain, concealment and cross-border organization. Exact penalties must be checked against current local law.

8. Reporting, Evidence and Incident Response

A basic incident-response sequence is:

1. Ensure safety and contain harm. Disconnect or isolate affected systems when appropriate, without destroying evidence.
2. Preserve evidence. Keep original messages, logs, headers, device details, timestamps and transaction records. Record who collected each item and when.
3. Notify responsible parties. Contact the organization’s security team, management, service provider, financial institution, regulator or data-protection authority as applicable.
4. Report to law enforcement. Use the appropriate cybercrime reporting channel, especially for threats, extortion, major fraud, child exploitation or attacks on essential services.
5. Recover and learn. Eradicate malicious access, restore from trusted backups, reset credentials, identify root causes and improve controls.

Evidence integrity matters. A screenshot may be useful, but original logs, message headers and forensic images generally provide stronger evidence. Investigators should avoid unnecessary alteration of devices, record time zones and preserve a clear chain of custody. Privacy and data-minimization obligations continue during an investigation.

Applied Case: Illustrative Ransomware Incident at a Community Hospital

Background

A fictional community hospital discovers that several scheduling and laboratory systems are unavailable. A message demands cryptocurrency and claims that patient records were copied. The hospital has a backup system, but its most recent connected backups are also encrypted.

Problem

The hospital must protect patient safety, maintain essential services, determine the scope of compromise, meet reporting obligations and decide whether to communicate with the attacker or pay.

Analysis

The incident may involve unauthorized access, malware deployment, interference with computer data and systems, extortion, privacy breaches and potential offences relating to critical or health-care infrastructure. The hospital should not assume that the ransom message is accurate; it must investigate whether data were actually exfiltrated. It should also preserve evidence before widespread system rebuilding.

Approach and Solution

The incident commander activates the response plan and separates affected networks while maintaining safe clinical operations. Clinical leaders move essential processes to documented manual procedures. Technical responders preserve volatile and persistent evidence where feasible, identify the initial access vector, disable compromised accounts and notify legal counsel, the relevant health-data authority, law enforcement and affected partners as required. Backups are tested before restoration. Payment is not treated as an automatic solution; sanctions, financing restrictions, recovery uncertainty and ethical consequences are assessed.

Outcome

The hospital restores priority services from a verified offline backup, resets privileged credentials, closes the exploited remote-access weakness and provides legally required notifications. A post-incident review identifies inadequate multifactor authentication and insufficient network segmentation.

Learning Points

The case demonstrates that cyber law, technical response, patient safety, privacy and governance are interconnected. Evidence preservation must occur alongside containment. Critical-service organizations require tested offline recovery, clear authority structures and communication plans. A ransom demand is evidence of an incident, not proof that payment is lawful, effective or required.

Ethical, Governance and Contemporary Issues

Cybersecurity work involves dual-use knowledge. The same tools used to identify a vulnerability can be used to exploit it. Ethical practice requires authorization, proportionality, confidentiality, minimum necessary access and responsible disclosure. Organizations should maintain acceptable-use rules, access reviews, incident plans, staff training and independent oversight.

Artificial intelligence can improve phishing detection, malware analysis and anomaly monitoring, but it can also produce convincing fraudulent messages, automate reconnaissance and scale harassment. AI-generated content should therefore be assessed for provenance, authorization, privacy impact and human accountability. Automated detection is not a substitute for lawful investigation or fair decision-making.

Cross-border investigations create difficulties involving conflicting laws, cloud-hosted evidence, mutual legal assistance, data-transfer rules and differing definitions of offences. Attribution is also challenging: technical indicators may identify infrastructure or tools without proving who controlled them. Legal conclusions must be based on admissible evidence, not merely on an IP address or a malware resemblance.

Best-Practice Checklist

• Obtain written authorization before testing systems.
• Use unique passwords and multifactor authentication.
• Patch exposed systems and restrict administrative privileges.
• Maintain tested, protected and offline-capable backups.
• Verify unusual payment or credential requests through a second channel.
• Preserve evidence and document actions during incidents.
• Report threats, fraud, exploitation and critical-system attacks promptly.
• Minimize collection and protect personal information.
• Do not retaliate or conduct unauthorized counterattacks.
• Consult current local law, regulators and qualified legal advisers.

Chapter Summary

Cybercrime includes conduct in which computers and networks are targets, tools or environments. Major forms include unauthorized access, malware and ransomware, online fraud, phishing, identity theft, cyberstalking, online abuse and attacks on critical infrastructure. Legal analysis requires attention to the prohibited act, the required mental state, authorization, harm, causation, evidence and jurisdiction. Security testing is lawful only within appropriate authority and scope. Effective response combines containment, evidence preservation, reporting, recovery and governance. Ethical practice requires proportionality, privacy protection, responsible disclosure and refusal to engage in retaliation. Because statutes and penalties differ, professionals must verify current law in the relevant jurisdiction.

Key Terms

Actus reus: The prohibited physical or external element of an offence.

Authentication: Verification of a user, device or system identity.

Business email compromise: Deceptive manipulation of email communications to obtain payment or information.

Chain of custody: Documented history of the collection, handling and transfer of evidence.

Confidentiality: Protection against unauthorized disclosure.

Cybercrime: Criminal conduct involving computers, networks, digital data or online services.

Cyberstalking: Repeated or serious digital conduct that causes fear, distress or safety concerns.

Data exfiltration: Unauthorized copying or removal of data.

Identity theft: Unauthorized obtaining or use of identifying information for impersonation or gain.

Integrity: Protection against unauthorized alteration or destruction.

Malware: Software used to conduct unauthorized, harmful or deceptive activity.

Mens rea: The legally required mental element of an offence.

Phishing: Deceptive communication intended to induce disclosure, payment, harmful action or installation.

Ransomware: Malware that blocks access to data or systems and demands payment.

Unauthorized access: Entry into or use of a system without valid permission.

Privilege escalation: Obtaining permissions greater than those legitimately granted.

Critical information infrastructure: Systems essential to safety, public services or economic stability.

Vishing: Voice-based phishing.

Review Questions

Short Answer Questions

1. What is the difference between a computer as a target and a computer as a tool?
2. Define actus reus and mens rea.
3. What is phishing, and how does spear phishing differ from ordinary phishing?
4. State two important steps for preserving digital evidence.
5. Why is written authorization important in penetration testing?

Long Answer Questions

1. Explain the main legal and practical issues involved in an unauthorized-access case.
2. Discuss how ransomware can involve several offences at the same time.
3. Compare fraud, identity theft, phishing and business email compromise.
4. Explain the special risks created by attacks on critical information infrastructure.
5. Describe an organization-wide cyber incident-response process from discovery through recovery.

Analytical / Application Questions

1. An employee uses valid credentials to download a confidential customer database for a personal business. Analyze the possible authorization, intent, evidence and offence issues.
2. A university researcher discovers a vulnerability in a public website and tests beyond the system named in the research agreement. Evaluate the legal and ethical risks and propose a responsible course of action.
3. A hospital receives a ransomware demand while patient services are disrupted. Using the case principles, design a prioritized response that addresses safety, evidence, reporting, recovery and the payment decision.

Multiple Choice Questions with Answers

Question 1

Which classification applies when a computer system itself is attacked?

A. Computer as target

B. Computer as environment

C. Computer as witness

D. Computer as property register

Correct Answer: A. Computer as target

Question 2

What does mens rea refer to?

A. The physical damage caused by an offence

B. The required mental element of an offence

C. The location of a server

D. The chain of custody for evidence

Correct Answer: B. The required mental element of an offence

Question 3

Which activity is most clearly an example of privilege escalation?

A. Changing a public website's color scheme with permission

B. Obtaining administrator rights after receiving only ordinary-user access

C. Updating software under a maintenance contract

D. Reading a publicly available web page

Correct Answer: B. Obtaining administrator rights after receiving only ordinary-user access

Question 4

What is the defining purpose of ransomware?

A. To improve backup performance

B. To encrypt or lock data and demand payment

C. To authenticate legitimate users

D. To publish software documentation

Correct Answer: B. To encrypt or lock data and demand payment

Question 5

A deceptive voice call requesting account credentials is best described as:

A. Smishing

B. Whaling

C. Vishing

D. Data exfiltration

Correct Answer: C. Vishing

Question 6

Which action best supports evidence integrity after a cyber incident?

A. Deleting suspicious logs immediately

B. Recording collection and handling details

C. Reformatting every affected device before review

D. Posting raw evidence publicly

Correct Answer: B. Recording collection and handling details

Question 7

Why is an IP address alone usually insufficient to prove who committed a cybercrime?

A. IP addresses cannot identify networks

B. An address may be shared, spoofed, compromised or used through intermediaries

C. IP addresses are never recorded

D. Courts do not consider technical evidence

Correct Answer: B. An address may be shared, spoofed, compromised or used through intermediaries

Question 8

Which is an appropriate principle for authorized security testing?

A. Test any system owned by the same industry

B. Remain within the written scope and agreed methods

C. Publish confidential findings immediately

D. Retaliate against suspected attackers

Correct Answer: B. Remain within the written scope and agreed methods

Question 9

Which system is most likely to be considered critical information infrastructure?

A. A personal music playlist

B. A public electricity control system

C. A private game server with no public function

D. A personal photo archive

Correct Answer: B. A public electricity control system

Question 10

What should an organization do before restoring systems from backups after ransomware?

A. Assume every backup is clean

B. Test that the backup is trusted and uncompromised

C. Pay the demand automatically

D. Delete all forensic records

Correct Answer: B. Test that the backup is trusted and uncompromised