Cybercrime: Offences, Liability and Defences

Introduction and Context

Cybercrime is conduct involving computers, networks, digital devices, data or online services that is prohibited by criminal law. Some offences are directed specifically at information systems, such as unauthorized access or denial of service. Others are traditional crimes—fraud, extortion, harassment or identity theft—committed through digital means. This distinction is important because technology changes the method, scale and evidence of offending, but it does not automatically change the legal principles governing responsibility.

Cybercrime law seeks to balance several interests: protecting confidentiality, integrity and availability of information; preserving privacy and personal security; enabling investigation; protecting freedom of expression and legitimate security research; and ensuring that state and private actors do not exceed lawful authority. Exact offences and penalties differ between jurisdictions. Accordingly, this chapter explains generally applicable legal concepts and should be read with the legislation and case law of the relevant country.

Learning Objectives

By the end of this chapter, students should be able to:

• classify major cybercrime offences;
• distinguish conduct, intention, recklessness and negligence;
• explain attempt, aiding, abetting, conspiracy and joint participation;
• evaluate individual and corporate liability;
• distinguish lawful authorization from unauthorized activity;
• identify common defences and their limitations; and
• apply these concepts to a practical cyber incident.

1. The Legal Structure of a Cyber Offence

A criminal offence normally consists of two broad components:

1. The actus reus: the prohibited act, omission, result or circumstance.
2. The mens rea: the required mental state, such as intention, knowledge, recklessness or dishonesty.

A prosecutor generally must establish each required element beyond the applicable criminal standard of proof. Some regulatory or statutory offences modify this structure by creating strict or limited-liability offences, but such provisions are usually interpreted carefully because criminal punishment is serious.

For example, an unauthorized-access offence may require proof that a person:

• caused a computer to perform a function;
• accessed a program or data;
• lacked authorization or exceeded the authorization granted; and
• acted knowingly or intentionally.

The precise elements depend on the statute. Merely showing that a person’s account was used is not necessarily enough to prove that the person performed the act or possessed the required mental state.

Intent, knowledge, recklessness and negligence

Intention exists when a person aims to bring about conduct or a result. A person who deliberately deploys ransomware intends to interfere with availability and may also intend to obtain payment.

Knowledge means awareness of a fact or circumstance. A system administrator may know that a scanning tool sends packets to external systems, even if the administrator does not know whether a vulnerability exists.

Recklessness generally involves conscious awareness of a substantial and unjustifiable risk followed by unreasonable disregard of that risk. Sending exploit code to an unknown public address without checking authorization may be reckless.

Negligence involves failure to meet the legally required standard of care. Negligence alone is not sufficient for every cybercrime; it must be relevant to the specific offence. It may, however, support civil liability, regulatory enforcement or an offence expressly based on negligent conduct.

A useful professional question is: What did the person know, what did the person intend, what risks were apparent, and what authorization existed at the time? Logs, messages, code comments, tickets, contracts and forensic timelines may all be relevant.

2. Principal Cybercrime Offences

2.1 Unauthorized access

Unauthorized access, sometimes called illegal access or computer intrusion, occurs when a person intentionally enters or uses a computer system, account, network or data without permission, or beyond the scope of permission.

Examples include:

• guessing or stealing a password;
• bypassing multifactor authentication;
• exploiting a vulnerability to enter a server;
• using another person’s session token; and
• continuing to use an account after permission has been withdrawn.

Authorization may be limited by user, system, time, purpose, data or method. An employee authorized to view payroll records may not be authorized to copy them for personal use. A penetration tester authorized to test a web application may not be authorized to attack production systems or third-party infrastructure.

A difficult issue is whether exceeding contractual conditions amounts to criminal access or only a disciplinary or civil breach. Courts differ. The strongest criminal cases generally involve technical circumvention, use of stolen credentials, clear notice of restriction, or access to systems for which the person had no permission at all.

2.2 Malware offences

Malware is software or code designed to compromise confidentiality, integrity or availability. Relevant offences may include creating, acquiring, supplying, distributing or using malware, especially where the conduct is intended to facilitate another offence.

Types include:

• viruses and worms that replicate or spread;
• trojans that conceal malicious functionality;
• spyware and keyloggers that collect information;
• botnet malware that recruits devices;
• wipers that destroy data; and
• remote-access tools used without authorization.

Possession alone may not always be criminal. A security researcher may lawfully possess malware samples for analysis under institutional controls. Liability may arise from intent, supply, deployment, possession in prohibited circumstances, or creation of tools primarily designed for crime. Context, purpose, safeguards and authorization are therefore central.

2.3 Ransomware and extortion

Ransomware commonly encrypts or exfiltrates data and demands payment. The conduct may involve several offences:

• unauthorized access;
• interference with data or systems;
• unlawful interception or acquisition of data;
• extortion or blackmail;
• fraud, if deceptive payment methods are used; and
• money laundering or sanctions violations.

Ransomware is not legally defined only by encryption. A threat to publish stolen data may constitute extortion even when systems remain operational. Payment also creates legal and governance concerns: an organization must consider sanctions, anti-money-laundering rules, reporting duties and the risk of financing further crime. A payment does not erase the original offence.

2.4 Unlawful interception and surveillance

Interception generally means acquiring the content of communications during transmission without lawful authority. Examples include packet capture of private traffic, unauthorized wiretapping, interception of messages, or installation of a device that captures communications.

The legal analysis should distinguish:

• content from traffic or metadata;
• communications in transit from stored data;
• consent of one participant from consent of all required parties; and
• authorized monitoring from covert surveillance.

Employers may have legitimate monitoring interests, but policies, notice, proportionality and applicable privacy law matter. A company’s ownership of a network does not automatically authorize unrestricted access to every communication carried on it.

2.5 Identity crime and credential offences

Identity crime includes obtaining, possessing, transferring or using identifying information without authorization, usually to impersonate a person or obtain a benefit. Relevant information may include passwords, government identifiers, biometric records, authentication tokens and financial details.

Conduct can be criminal even before financial loss occurs. For example, buying a database of stolen credentials may support an offence involving possession or trafficking of identity information. Using those credentials to access an account may create additional unauthorized-access and fraud offences.

Organizations should treat credentials as security-sensitive assets. Password reuse, weak identity verification and excessive privileges increase both victimization and evidential complexity.

2.6 Online fraud and deception

Online fraud usually involves a dishonest representation, omission or manipulation intended to cause another person to act, resulting in financial or property loss or an unlawful gain. Common forms include phishing, business-email compromise, fake investment schemes, romance fraud, auction fraud and payment-redirection attacks.

A typical fraud analysis asks:

1. What representation or deception was made?
2. Was it false or misleading?
3. Did the accused know this or act recklessly?
4. Was there an intention to obtain a benefit or cause loss?
5. Did the victim rely on it or suffer legally relevant loss?

A technically sophisticated attack is not required. A simple message can satisfy the elements if it intentionally deceives a victim. Conversely, an inaccurate automated output is not necessarily fraud without the required dishonest mental state.

2.7 Cyberstalking and online harassment

Cyberstalking is repeated or persistent digital conduct that causes fear, serious distress or a substantial invasion of privacy. It may include tracking, repeated unwanted contact, doxxing, impersonation, threats, monitoring or publication of intimate material.

Harassment offences vary considerably. Lawful criticism, political expression and legitimate reporting must not be confused with criminal intimidation. Relevant factors include repetition, threats, targeting, power imbalance, context, foreseeability of harm and whether the conduct was objectively threatening or seriously abusive.

Organizations should preserve evidence without amplifying harmful content. Victims may need account protection, platform reporting, safety planning and referral to law enforcement or specialist support.

2.8 Denial-of-service offences

A denial-of-service attack intentionally makes a service unavailable or degrades its performance. Distributed denial-of-service attacks use many compromised devices or traffic sources. Conduct may include sending excessive requests, exploiting protocol weaknesses, renting a botnet or supplying attack infrastructure.

The offence may be framed as interference with a computer system, impairment of availability, unauthorized transmission or damage to property. The legal outcome depends on intent, scale, authorization and actual or threatened impact. A controlled load test can resemble an attack technically, which is why written scope, source addresses, time windows, rate limits and emergency contacts are essential.

3. Inchoate Offences and Participation

Attempt

Attempt occurs when a person intends to commit an offence and performs an act sufficiently close to its commission, but the complete offence does not occur. Preparatory conduct—such as purchasing a domain name or researching a vulnerability—may not be enough by itself, whereas deploying exploit code against a target may be a substantial step, depending on the law.

Abandonment is not universally a defence. Voluntarily stopping may be relevant, but it does not necessarily erase liability once an attempt is complete.

Aiding, abetting and counselling

A person may be liable without personally pressing the final button. Providing credentials, hosting infrastructure, technical instructions, money or transportation can constitute assistance if the person knows of the criminal purpose and intentionally assists it. Mere association or accidental assistance is generally insufficient.

Conspiracy and joint enterprise

Conspiracy usually involves an agreement between two or more persons to commit an offence. The planned offence need not always be completed. Evidence may include coordinated communications, shared infrastructure, division of tasks and financial arrangements. Joint-liability doctrines differ by jurisdiction and must not be applied mechanically.

Corporate and organizational liability

A company can face criminal, regulatory or civil liability where legislation attributes the acts and mental state of officers, employees or agents to the organization. It may also be liable for failure to prevent bribery, inadequate reporting, unsafe processing or defective controls where the statute creates such duties.

Corporate liability does not mean that every employee’s crime automatically becomes the company’s crime. Investigators examine authority, benefit, management involvement, compliance systems, reporting lines and whether the organization encouraged or tolerated the conduct.

A useful governance model is the three-lines approach:

Strong policies are not enough if the organization ignores warnings, rewards unsafe behavior or fails to investigate credible alerts.

4. Lawful Authorization and Professional Boundaries

Authorization is a central defence and a central professional duty. It should be specific, current, informed and documented. A valid authorization normally identifies:

• the owner or approving authority;
• systems, domains, accounts and data in scope;
• permitted techniques and prohibited actions;
• dates and times;
• rate or volume limits;
• data-handling requirements;
• emergency contacts; and
• reporting and deletion obligations.

A security professional should never infer authorization merely because a system is publicly reachable. Public availability is not the same as permission to exploit, bypass controls, extract personal data or cause disruption.

Security testing example

A consultant is engaged to test a company’s website. The contract authorizes vulnerability scanning of the staging environment from 22:00 to 02:00, prohibits social engineering, and excludes the payment provider. The consultant discovers that the production site is vulnerable and runs the same exploit there without approval. Even if the purpose is defensive, the production access may be unauthorized. The correct response is to stop, preserve minimal evidence, notify the client through the agreed channel and seek written authorization before proceeding.

5. Defences and Their Limits

A defence may challenge an element of the offence or provide a legally recognized justification or excuse. Common issues include:

Lack of authorization or mistaken identity

The accused may argue that another person used the account, that credentials were compromised, or that the accused believed permission existed. The strength of the argument depends on evidence such as access logs, device records, messages, approval documents and security practices. A weak password or shared account does not automatically identify the offender.

Consent and authorization

Consent may defeat an unauthorized-access allegation when it is valid and within scope. Consent obtained by deception, granted by someone without authority, or exceeded by the conduct may not be effective. Informed consent should specify what will happen and what risks are accepted.

Necessity or emergency action

Necessity may apply where conduct was reasonably required to prevent a greater and imminent harm and no lawful alternative was practical. For example, isolating a compromised device during an active attack may be justified in an emergency. The defence is narrow; convenience, curiosity or a desire to investigate usually does not establish necessity.

Duress and coercion

A person forced by immediate threats of serious harm may raise duress, subject to statutory limits. Duress is fact-specific and may not apply to all offences.

Lawful authority and official functions

Law-enforcement officers, intelligence agencies, regulators and authorized investigators may possess statutory powers to search, intercept or access systems. Those powers normally require procedure, necessity, proportionality and sometimes judicial authorization. An official title does not justify action outside the legal power granted.

Honest and reasonable mistake

A genuine mistake may negate intention or knowledge. However, a person who ignores clear warnings, bypasses written restrictions or fails to check an obvious authorization boundary may have difficulty relying on mistake.

Freedom of expression and public-interest activity

Investigative journalism, whistleblowing, academic research and vulnerability disclosure may engage public-interest protections. These protections are not universal licences to access systems or publish personal data. Responsible disclosure, minimization, non-exploitation and use of established reporting channels reduce legal and ethical risk.

6. Evidence, Attribution and Due Process

Cybercrime investigations face an attribution problem: an IP address identifies a network endpoint, not necessarily a human offender. Shared devices, proxies, virtual private networks, botnets, compromised accounts and spoofed addresses complicate attribution.

A sound investigation combines multiple evidence sources:

• authentication and access logs;
• endpoint and network telemetry;
• cloud audit records;
• email headers and message content;
• malware artifacts and file metadata;
• payment and cryptocurrency records;
• witness testimony; and
• seized devices examined under proper authority.

Evidence must be collected, preserved and documented so that its integrity and continuity can be assessed. Investigators should avoid altering original data, record timestamps and time zones, calculate and document file hashes where appropriate, and maintain a chain of custody. Digital evidence remains subject to search, privacy, disclosure and admissibility rules.

7. Applied Case: The “Northbridge Health” Incident

This is an illustrative fictional case.

Background

Northbridge Health Services contracts SecureAxis, a cybersecurity consultancy, to conduct a penetration test. The signed authorization covers two staging servers, excludes patient systems, prohibits denial-of-service testing and permits testing only during a specified weekend.

Problem

During the test, a consultant discovers that staging credentials also work on a production server. The consultant logs into production, downloads a directory listing containing patient-record filenames, and sends exploit code that briefly disrupts a production application. The consultant then reports the issue to a team leader but deletes local copies of the directory listing.

Analysis

The initial access to staging is authorized. The production login is potentially unauthorized because the production system is expressly excluded. The directory listing may involve unauthorized access to protected data. The exploit code and disruption may support an interference or availability offence. The consultant’s purpose was defensive, but purpose alone does not expand the written authorization.

Potential liability may extend to:

• the consultant, if the required intent or knowledge is proven;
• the team leader, if the leader knowingly encouraged continuation;
• SecureAxis, if corporate-liability rules attribute the conduct or reveal inadequate supervision; and
• Northbridge, if its credential configuration or monitoring failures breach regulatory duties, although victim status does not itself create criminal liability.

Deletion of local copies may be sensible data minimization, but it should occur only under the agreed evidence procedure. Deleting evidence after an incident can create a separate legal problem if done to obstruct an investigation.

Appropriate response

Northbridge should isolate affected systems, preserve logs, engage incident counsel and forensic specialists, assess whether personal data was accessed, and notify regulators or affected individuals if required. SecureAxis should preserve its engagement records, stop testing, disclose the scope deviation and cooperate with the investigation. Both organizations should avoid speculative public attribution.

Outcome and learning points

The central lesson is that authorization is bounded by scope, not by professional intention. A written rules-of-engagement document protects both client and tester. It should be supported by least privilege, separate test credentials, production safeguards, escalation procedures and independent review.

8. Contemporary and Governance Issues

Artificial intelligence can increase the speed and scale of phishing, code generation, impersonation, malware adaptation and vulnerability discovery. It can also improve detection, triage and incident response. The legal analysis remains conduct-based: using an AI system does not remove responsibility for unauthorized access, deception or harmful deployment. Organizations should maintain approval controls, logging, human review and restrictions on uploading confidential data to external AI services.

Cross-border cybercrime creates jurisdictional problems. The victim, offender, infrastructure, cloud provider and evidence may all be located in different countries. Mutual legal assistance, preservation requests, extradition rules, privacy law and differing definitions of offences affect investigations.

Regulatory duties increasingly require incident reporting, risk management, protection of personal data and supply-chain oversight. Criminal law is only one part of the compliance environment. An organization may face simultaneous criminal investigation, regulatory enforcement, civil claims, contractual disputes and reputational damage.

Best-practice control framework

Professionals should:

1. obtain written authorization before testing or accessing systems;
2. define scope, exclusions and technical limits;
3. use least privilege and segregated test accounts;
4. maintain accurate time-synchronized logs;
5. minimize collection of personal and sensitive data;
6. establish escalation and stop-work procedures;
7. preserve evidence under a documented process;
8. report vulnerabilities responsibly;
9. train staff on phishing, identity and reporting duties; and
10. review incidents for both technical and legal lessons.

Chapter Summary

Cybercrime consists of diverse offences involving systems, data, communications and digital identities. Unauthorized access, malware, ransomware, interception, identity crime, online fraud, cyberstalking, harassment and denial of service may overlap in one incident, producing multiple potential charges. Liability depends on the prohibited conduct and the required mental state, commonly intention, knowledge or recklessness. Attempt, conspiracy, aiding and abetting allow responsibility even when the principal offence is incomplete or performed by another person. Corporate liability depends on statutory attribution, organizational benefit, management conduct and compliance failures. Authorization must be specific and within scope; public accessibility or defensive purpose does not by itself create permission. Defences such as consent, mistake, necessity, duress and lawful authority are fact-specific and limited. Sound governance combines legal advice, documented rules of engagement, technical controls, evidence preservation and responsible disclosure.

Key Terms

Actus reus: The physical act, omission, result or circumstance required for an offence.

Authorization: Valid permission to access, use, test or interfere with a system within defined limits.

Botnet: A network of compromised devices controlled for coordinated activity.

Corporate liability: Legal responsibility attributed to an organization for conduct connected with its officers, employees, agents or statutory duties.

Cyberstalking: Persistent digital conduct that causes fear, serious distress or substantial invasion of privacy.

Denial of service: Conduct that makes a computer service unavailable or materially degrades it.

Digital evidence: Electronically stored or transmitted information relevant to an investigation.

Duress: A defence based on coercion by threats of serious harm.

Identity crime: Unauthorized obtaining, possessing, transferring or using identifying information.

Interception: Acquisition of communications, commonly during transmission, without lawful authority.

Malware: Malicious software or code designed to compromise systems or data.

Mens rea: The mental element required for criminal responsibility.

Necessity: A narrow defence involving conduct reasonably required to prevent a greater imminent harm.

Online fraud: Deception conducted through digital systems to obtain benefit or cause loss.

Ransomware: Malware or an associated attack that restricts access to data or systems and demands payment.

Recklessness: Conscious disregard of a substantial and unjustifiable risk.

Rules of engagement: Written limits and procedures governing authorized security testing.

Unauthorized access: Intentional access to a system, account or data without permission or beyond permission.

Review Questions

Short Answer Questions

1. What are the actus reus and mens rea of an offence?
2. Why is public accessibility not the same as authorization?
3. Define ransomware and identify two related offences it may involve.
4. What is the difference between intention and recklessness?
5. Why is an IP address alone usually insufficient to prove human attribution?

Long Answer Questions

1. Explain the legal and professional significance of written rules of engagement in penetration testing.
2. Compare unauthorized access, unlawful interception and denial-of-service offences.
3. Discuss how attempt, aiding, abetting and conspiracy extend cybercrime liability.
4. Explain the basis and limits of corporate liability for cybercrime.
5. Evaluate the main defences available in a cybercrime prosecution.

Analytical / Application Questions

1. An employee uses valid payroll credentials to access salary records of senior executives for personal curiosity. Analyze possible offences, mental states and evidential issues.
2. A researcher discovers a vulnerability in a public website, accesses a small sample of records to confirm it, and publishes screenshots after unsuccessfully contacting the owner. Assess authorization, public interest, privacy and responsible-disclosure issues.
3. A company pays a ransomware demand after attackers steal and encrypt customer data. Analyze the possible offences, regulatory duties, evidence requirements and governance decisions for the company and attackers.

Multiple Choice Questions with Answers

Question 1

Which element refers to the mental state required for a criminal offence?

A. Actus reus

B. Mens rea

C. Chain of custody

D. Jurisdiction

Correct Answer: B. Mens rea

Question 2

Which statement best describes lawful authorization for penetration testing?

A. Any publicly reachable system may be tested

B. Authorization is valid only when testing causes disruption

C. Authorization should define systems, methods, time and limits

D. A tester’s defensive purpose automatically creates authorization

Correct Answer: C. Authorization should define systems, methods, time and limits

Question 3

Which conduct most clearly represents unlawful interception?

A. Reading a publicly published security advisory

B. Capturing private communications while they are transmitted without authority

C. Reviewing an organization’s approved audit report

D. Changing one’s own password

Correct Answer: B. Capturing private communications while they are transmitted without authority

Question 4

What is a common feature of ransomware?

A. It always improves system availability

B. It restricts access to data or systems and demands payment

C. It is legally harmless if encryption is used

D. It can never involve extortion

Correct Answer: B. It restricts access to data or systems and demands payment

Question 5

Why is an IP address generally insufficient by itself to prove the identity of an offender?

A. IP addresses cannot be recorded

B. An IP address identifies a network endpoint, which may be shared or compromised

C. IP addresses are always encrypted

D. Courts do not permit any technical evidence

Correct Answer: B. An IP address identifies a network endpoint, which may be shared or compromised

Question 6

Which situation most strongly supports an attempt charge?

A. Thinking about attacking a website

B. Reading a general cybersecurity textbook

C. Deploying exploit code against a target with the required criminal intent, although the offence fails

D. Attending a lawful security conference

Correct Answer: C. Deploying exploit code against a target with the required criminal intent, although the offence fails

Question 7

Which principle is most relevant when an employee accesses payroll records beyond their work duties?

A. Authorization may be limited by purpose and data

B. Employment always authorizes access to every company record

C. Ownership eliminates privacy obligations

D. Access is lawful whenever a password works

Correct Answer: A. Authorization may be limited by purpose and data

Question 8

Which statement about corporate liability is most accurate?

A. Every employee crime automatically becomes the company’s crime

B. A company can never be criminally liable

C. Liability depends on applicable attribution rules, organizational conduct and statutory duties

D. Corporate policies always eliminate liability

Correct Answer: C. Liability depends on applicable attribution rules, organizational conduct and statutory duties

Question 9

Which is a narrow, fact-specific defence involving prevention of a greater imminent harm?

A. Necessity

B. Curiosity

C. Profit

D. Publicity

Correct Answer: A. Necessity

Question 10

Which practice best protects the integrity of digital evidence?

A. Editing original logs to make them easier to read

B. Deleting all incident data immediately

C. Documenting collection, preservation and chain of custody

D. Relying only on an unverified IP address

Correct Answer: C. Documenting collection, preservation and chain of custody