Cybercrime, Offences and Legal Liability

Introduction

Cybercrime is conduct involving computers, networks, digital devices, data, or online services that violates criminal law or creates civil, regulatory, contractual, or professional liability. It includes traditional crimes conducted through digital means, such as fraud and harassment, as well as technology-dependent offences, such as unauthorized access, malware deployment, denial-of-service attacks, and unlawful interception.

For cybersecurity professionals, understanding cybercrime is not limited to memorizing offence names. A security practitioner must recognize the legal elements of conduct, preserve evidence, distinguish authorized testing from unlawful access, understand possible defenses, and respond proportionately to suspected incidents. The same technical action may be lawful in one context and criminal in another. For example, scanning a system under a signed penetration-testing authorization may be legitimate security work; scanning the same system without permission may be treated as unauthorized access preparation or unlawful interference, depending on the jurisdiction and circumstances.

Cybercrime law differs among countries. Statutory definitions, investigative powers, evidentiary rules, penalties, reporting duties, and extraterritorial jurisdiction vary considerably. This chapter therefore presents generally applicable legal principles rather than legal advice for a particular country. A professional must consult the relevant national cybercrime statute, data-protection law, criminal code, sector regulations, contracts, and institutional policies.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Classify major cyber offences, including unauthorized access, malware, fraud, identity theft, harassment, extortion, and service disruption.
2. Explain the actus reus and mens rea components of legal liability.
3. Distinguish criminal, civil, regulatory, contractual, and professional consequences.
4. Identify common defenses and explain their limits.
5. Apply responsible vulnerability-research principles.
6. Recommend appropriate evidence-preservation, reporting, and incident-response actions.
7. Evaluate a cyber incident from technical, legal, ethical, and governance perspectives.

1. The Legal Architecture of Cybercrime

1.1 Sources of legal authority

Cybercrime is governed by several overlapping sources:

• Criminal statutes: define offences and prescribe penalties such as imprisonment, fines, confiscation, or probation.
• Civil law: permits victims to seek compensation, injunctions, restitution, or declarations of rights.
• Regulatory law: imposes duties on organizations in areas such as privacy, financial services, telecommunications, health, and critical infrastructure.
• Contract law: creates obligations through employment agreements, acceptable-use policies, service-level agreements, and security clauses.
• Evidence and procedure law: determines how investigators may search, seize, intercept, preserve, and present digital evidence.
• Professional and organizational rules: may result in disciplinary action, loss of certification, dismissal, or prohibition from future work.

One incident can activate several regimes at once. A staff member who copies customer data without authorization may face criminal prosecution, a civil claim by affected customers, regulatory enforcement against the organization, dismissal, and professional sanctions.

1.2 Conduct, authorization, and harm

Three questions are central to legal classification:

1. What conduct occurred? For example, authentication bypass, data copying, malware execution, or threatening communication.
2. Was the conduct authorized? Authorization must be real, sufficiently specific, and current. General employment status does not automatically authorize every activity.
3. What harm or risk resulted? Relevant consequences may include confidentiality loss, integrity alteration, service unavailability, financial loss, privacy invasion, fear, reputational damage, or national-security risk.

Authorization should be interpreted narrowly. A permission to test a web application does not automatically authorize testing a connected production database, attacking third-party systems, or retaining personal data discovered during the test.

2. Elements of Legal Liability

2.1 Actus reus and mens rea

Criminal liability commonly requires both a prohibited act or omission and a legally sufficient mental state. These are often described using the Latin terms actus reus and mens rea.

• Actus reus is the external element: the act, omission, possession, transmission, access, alteration, or resulting circumstance prohibited by law.
• Mens rea is the mental element: intention, knowledge, recklessness, dishonesty, or another state specified by the offence.

The exact standard differs by jurisdiction. Some offences require intentional conduct; others apply to reckless or knowing conduct; a limited number are strict-liability offences in which proof of intent is reduced or unnecessary.

A cybersecurity analyst who accidentally opens a malicious attachment may have caused a technical event but may lack the criminal intent required for unauthorized access or malware deployment. Conversely, a person who deliberately uses stolen credentials may be liable even if no file is altered, because unauthorized access itself may be the prohibited conduct.

2.2 Causation and damage

Where an offence requires a harmful result, prosecutors generally must connect the accused person’s conduct to that result. Digital causation can be complex because attacks involve multiple actors, compromised systems, cloud providers, proxies, and automated tools. Investigators may need to establish:

• the identity of the actor;
• the relevant device, account, or infrastructure;
• the sequence of events;
• the technical mechanism of the harm; and
• the mental state required by law.

A person may be liable for an attempt even when the intended result does not occur, if the jurisdiction recognizes attempt and the conduct progressed beyond mere preparation. Assistance, conspiracy, procurement, or aiding and abetting may also create liability where a person knowingly helps another commit an offence.

2.3 Corporate and organizational liability

Organizations may be liable for acts of employees, agents, or senior managers where statutes recognize corporate responsibility or where inadequate governance contributed to the offence. Separate from criminal liability, organizations may face negligence claims, regulatory penalties, contractual claims, or data-breach notification duties.

An organization can reduce exposure through documented governance: role-based access, segregation of duties, logging, secure development, staff training, supplier oversight, incident response, and timely remediation. These controls do not guarantee immunity, but they demonstrate reasonable care and support accountability.

3. Major Categories of Cyber Offence

3.1 Unauthorized access

Unauthorized access occurs when a person intentionally enters, uses, or remains in a computer system, account, network, or data environment without permission or beyond the scope of permission. Common examples include:

• guessing or stealing passwords;
• bypassing authentication controls;
• using an employee’s session without consent;
• exploiting a vulnerability to enter a restricted system; and
• continuing to access a system after permission has been withdrawn.

Some laws distinguish basic unauthorized access from access with an aggravating purpose, such as obtaining confidential data, committing fraud, causing damage, or affecting critical infrastructure. Access may be unlawful even when no data is copied and no visible damage occurs.

A key professional issue is scope. A penetration tester may be authorized to test a named IP range, application, time window, and technique set. Testing an excluded system, launching a denial-of-service test without written approval, or downloading live personal records may exceed authorization.

3.2 Illegal interception and unlawful acquisition of data

Interception involves acquiring communications while they are being transmitted or accessing communications without lawful authority. Examples may include unauthorized packet capture, wiretapping, traffic monitoring, or reading another person’s private messages. Network administrators may lawfully monitor traffic for security or operational purposes when legislation, policy, notice, consent, or a lawful order supports that monitoring.

The legality of packet capture depends on context. Capturing traffic on a company network for a defined security investigation may be permissible; capturing credentials from an unrelated public network may constitute unlawful interception and privacy violation.

3.3 Malware and malicious code

Malware includes viruses, worms, trojans, ransomware, spyware, rootkits, botnet agents, and destructive wipers. Legal offences may concern creating, possessing, distributing, selling, deploying, or making malware available for criminal use. Some statutes criminalize tools designed primarily for unauthorized access or interference, but legitimate dual-use tools require careful interpretation.

The same code can have different legal status depending on purpose and authorization. A remote-administration tool installed with informed consent may be legitimate. The covert installation of the same tool to maintain unauthorized access may be criminal. Security professionals should therefore document purpose, authorization, safeguards, and limitations when developing or handling proof-of-concept code.

3.4 Data interference and system interference

Data interference involves deleting, corrupting, altering, suppressing, encrypting, or rendering data inaccessible. System interference involves seriously hindering the operation or availability of a computer system. Examples include destructive malware, ransomware, unauthorized configuration changes, resource exhaustion, and distributed denial-of-service attacks.

Service disruption can be an offence even where no permanent damage occurs. A temporary outage may affect emergency services, hospitals, payment systems, or public utilities and may therefore attract enhanced penalties. Authorized resilience testing must be carefully controlled, with rollback plans, monitoring, approval, and emergency contacts.

3.5 Computer-related fraud and forgery

Digital fraud involves intentionally obtaining unlawful benefit or causing loss through deception, manipulation of data, misuse of systems, or false digital representations. Examples include business-email compromise, online payment fraud, fraudulent invoices, manipulation of transaction records, and social-engineering attacks.

Computer-related forgery may involve creating or altering digital data so that it appears authentic and is relied upon as genuine. The legal issue is not merely whether a file was edited; it is whether the alteration was intended to create a false representation with legal or economic significance.

Fraud generally requires more than technical access. Investigators examine deception, reliance, gain or loss, identity of the actor, and the mental state required by the law.

3.6 Identity theft and credential misuse

Identity theft is the acquisition, possession, use, transfer, or sale of personal or identifying information for an unlawful purpose. Stolen information may include passwords, government identifiers, banking details, biometric data, authentication tokens, or full identity profiles.

Credential misuse may occur without stealing a person’s entire identity. Using another employee’s account to access files, impersonating a customer, or selling session tokens can create separate offences involving unauthorized access, fraud, privacy, or data trafficking.

Organizations should treat credentials as security assets. Strong authentication, phishing-resistant multifactor authentication, least privilege, rapid revocation, and anomaly monitoring reduce both the opportunity and impact of identity-related offences.

3.7 Harassment, stalking, threats, and image-based abuse

Digital harassment includes repeated unwanted communications, intimidation, humiliation, stalking, doxxing, impersonation, and targeted abuse. Threats may be criminal when they communicate an intention to cause unlawful harm and are sufficiently serious or credible under applicable law. Online conduct is not automatically protected merely because it occurs through social media or anonymous accounts.

Image-based abuse involves distributing or threatening to distribute intimate images without consent. It may violate criminal, privacy, civil, and platform rules. Investigators should avoid redistributing harmful material and should preserve only what is necessary and lawful for reporting or evidence.

3.8 Cyberextortion and ransomware

Extortion involves obtaining money, property, action, or advantage through threats or coercion. Cyberextortion may involve ransomware encryption, threats to publish stolen data, threats to disrupt services, or threats to expose confidential communications.

The victim’s payment decision involves legal, ethical, operational, and sanctions risks. Payment may encourage further crime and does not guarantee deletion or restoration. Organizations should involve legal counsel, law enforcement, insurers, regulators, and incident-response specialists. They should also screen transactions against applicable sanctions and anti-money-laundering requirements.

3.9 Content-related and intellectual-property offences

Cybercrime may involve unlawful distribution of child sexual abuse material, extremist content, illegal market activity, copyright infringement, trade-secret theft, or unauthorized software distribution. These areas are highly jurisdiction-specific and may impose severe penalties. Cybersecurity professionals who encounter illegal content should not investigate beyond their authority or make unnecessary copies; they should follow evidence-handling and reporting procedures.

4. Liability Beyond Criminal Prosecution

4.1 Civil liability

A victim may bring a civil claim for losses caused by unauthorized access, privacy invasion, negligence, breach of confidence, trespass to systems, or interference with business. Remedies may include damages, injunctions, restitution, and legal costs.

Civil liability often uses a lower standard of proof than criminal prosecution, depending on the jurisdiction. An acquittal does not necessarily eliminate civil exposure, and a person may face both proceedings.

4.2 Regulatory and contractual liability

Regulators may investigate failures to protect personal data, report incidents, maintain operational resilience, or supervise suppliers. Contracts may impose additional duties, including confidentiality, service availability, breach notification, audit cooperation, and secure disposal.

A security professional must therefore read the governing documents before testing or disclosing a vulnerability. A technical activity may be permitted by a general policy but prohibited by a customer contract or sector regulation.

4.3 Professional and managerial liability

Professionals may be disciplined for dishonesty, misuse of privileged access, negligent handling of evidence, unauthorized disclosure, or failure to follow approved procedures. Managers may be criticized or sanctioned for ignoring known risks, failing to maintain controls, or obstructing incident reporting.

5. Defenses and Limitations on Liability

Potential defenses vary by jurisdiction and must be assessed by qualified counsel. Common issues include:

• Authorization: documented permission covered the system, method, time, and purpose.
• Lack of required mental state: the person did not act intentionally, knowingly, dishonestly, or recklessly as required.
• Mistake of fact: the person reasonably believed an important fact that, if true, would make the conduct lawful.
• Necessity or emergency: conduct was required to prevent a greater and imminent harm, where recognized by law.
• Lawful authority or official duty: conduct was performed under a valid legal power or assigned professional function.
• Consent: a competent person or authorized organization consented to the relevant activity.
• Entrapment or improper state conduct: recognized in some jurisdictions where authorities induced an offence that otherwise would not have occurred.

A claimed defense is not established merely by good intentions. “I was testing security,” “the system was publicly accessible,” or “I wanted to warn the owner” may not excuse access without permission. Responsible professionals obtain written authorization before testing and stop when scope becomes uncertain.

6. Penalties and Aggravating Factors

Penalties depend on the offence, jurisdiction, victim, scale, intent, and resulting harm. Possible consequences include imprisonment, fines, forfeiture of devices or proceeds, compensation orders, probation, community orders, account restrictions, civil damages, regulatory penalties, dismissal, and professional disqualification.

Aggravating factors commonly include:

• targeting children, hospitals, elections, or critical infrastructure;
• obtaining commercial secrets or personal data;
• causing substantial financial loss or physical risk;
• using botnets, malware, or organized criminal networks;
• repeating the conduct after warnings;
• obstructing investigation or destroying evidence; and
• exploiting a position of trust.

Mitigating factors may include early cooperation, limited impact, genuine mistake, voluntary remediation, absence of prior misconduct, and assistance to victims. Mitigation does not erase the offence and should never be assumed.

7. Responsible Vulnerability Research

Vulnerability research can improve security, but unauthorized discovery, exploitation, or disclosure can create legal risk. A responsible process includes:

1. Define authority: obtain written permission, identify assets, establish dates, define permitted techniques, and name contacts.
2. Minimize harm: use non-destructive tests, avoid unnecessary personal-data access, rate-limit requests, and do not access unrelated systems.
3. Preserve confidentiality: protect discovered information and restrict internal access.
4. Document evidence: record timestamps, systems, tools, steps, results, and authorization without collecting excessive data.
5. Report privately: provide a clear description, affected component, severity, reproduction conditions, and mitigation advice.
6. Allow coordinated remediation: agree on communication and disclosure timelines.
7. Escalate responsibly: use a national computer emergency response team, regulator, platform process, or law enforcement channel when appropriate.
8. Stop when asked or when scope is exceeded: do not continue merely because additional access is technically possible.

A vulnerability disclosure policy or safe-harbor statement may reduce risk, but it does not automatically override criminal law, privacy law, contractual obligations, or third-party rights. Researchers should obtain legal advice where scope or public-interest disclosure is uncertain.

8. Digital Evidence and Incident Handling

Legal conclusions depend heavily on reliable evidence. Digital evidence is fragile, easily altered, and often distributed across systems in different countries. A basic evidence process should include:

• identifying relevant devices, accounts, logs, cloud resources, and communications;
• preserving volatile information where lawful and necessary;
• recording who collected each item, when, how, and from where;
• calculating and recording cryptographic hashes where appropriate;
• maintaining a chain-of-custody record;
• restricting access to authorized personnel; and
• documenting analytical methods and limitations.

A hash can help demonstrate that a collected file has not changed since acquisition, but it does not by itself prove who created the file, who used the device, or whether the original collection was lawful. Technical integrity and legal admissibility are related but distinct questions.

Incident responders should avoid speculative attribution. An IP address, domain registration, malware family, or language setting may provide an investigative lead but rarely proves the identity of an offender on its own. Reports should distinguish observed facts, technical inferences, confidence levels, and unresolved alternatives.

9. Applied Case: The Unauthorized Security Test

This is an illustrative fictional case.

Background

A diploma-level security trainee discovers that a local retailer’s customer portal exposes an administrative endpoint. The trainee uses a publicly available scanner, identifies a weakness, and retrieves a small sample of customer records to prove impact. The trainee then emails the retailer, publishes a social-media warning, and retains screenshots containing names and email addresses.

Problem

The trainee believes the activity was beneficial because the retailer had not responded to an earlier informal message. The retailer reports the matter to law enforcement and alleges unauthorized access, privacy violation, and unlawful acquisition of customer data.

Analysis

The technical finding may be genuine, but several legal issues arise:

• There was no clear written authorization.
• The trainee crossed from observation into active access and data retrieval.
• Customer information was collected beyond what was necessary to identify the vulnerability.
• Public disclosure increased privacy and reputational risk.
• The earlier informal message did not establish consent.
• The trainee’s good motive may not defeat an offence requiring unauthorized access.

The legality depends on the jurisdiction and exact facts, including the system’s access controls, the trainee’s conduct, the data obtained, and the applicable statute. However, the conduct clearly falls outside a cautious responsible-disclosure model.

Better approach

The trainee should have stopped after confirming the endpoint, collected non-sensitive evidence, reported through an official channel, and requested permission for any deeper validation. If no channel existed, the trainee could contact the organization’s security or legal department, a recognized coordination body, or an appropriate regulator. Any captured information should have been minimized, protected, and securely deleted according to legal advice and evidence requirements.

Outcome and learning points

The retailer closes the endpoint, rotates credentials, assesses exposure, and begins notification analysis. The trainee receives legal advice and cooperates with the investigation. The case demonstrates that technical skill does not replace authorization, data minimization, scope control, or professional judgment.

Key lessons are:

• public accessibility is not the same as permission;
• proof of impact should be proportionate and non-invasive;
• disclosure must protect affected individuals;
• written authorization is the foundation of lawful testing; and
• responsible researchers document decisions and seek advice when uncertain.

10. Contemporary Developments and Professional Practice

Artificial intelligence is changing both cybercrime and enforcement. Generative systems can support phishing, impersonation, malicious-code adaptation, deepfake production, and automated vulnerability discovery. They can also assist detection, triage, translation, and evidence analysis. The legal questions remain familiar: authorization, intent, deception, privacy, accountability, and harm. Using an AI system does not automatically transfer responsibility away from the human operator or organization.

Cross-border investigations create further challenges. Evidence may be stored by a cloud provider in one country, victims may be located in another, and the suspected actor may operate from a third. Mutual legal assistance, extradition rules, preservation requests, provider procedures, and data-protection restrictions affect the investigation. Organizations should maintain clear escalation routes and avoid unlawful self-help.

Best practice for cybersecurity personnel includes:

• maintain current acceptable-use and testing policies;
• use written scopes of work and rules of engagement;
• apply least privilege and strong authentication;
• preserve logs with appropriate retention and access controls;
• train staff on reporting and evidence preservation;
• establish legal, technical, communications, and executive contacts;
• maintain vulnerability-disclosure procedures;
• test incident-response and business-continuity plans; and
• review local law before collecting, transferring, or disclosing personal data.

Chapter Summary

Cybercrime law addresses both technology-dependent offences and traditional offences carried out through digital systems. Major categories include unauthorized access, unlawful interception, malware, data and system interference, fraud, identity theft, harassment, cyberextortion, and unlawful content or intellectual-property activity.

Legal liability commonly requires a prohibited act or omission, a specified mental state, and—in some offences—causation and harm. Authorization, scope, purpose, and proportionality are central to distinguishing lawful security work from criminal conduct. Liability may be criminal, civil, regulatory, contractual, professional, or organizational, and several forms may arise from one incident.

Defenses such as authorization, lack of intent, mistake, necessity, and lawful authority depend on jurisdiction and evidence. Good intentions alone are insufficient. Responsible vulnerability research requires written permission, limited and non-destructive testing, data minimization, confidential reporting, careful documentation, and coordinated disclosure.

Digital evidence must be collected lawfully, preserved reliably, and interpreted cautiously. Cybersecurity professionals should combine technical competence with legal awareness, ethical judgment, governance, and timely consultation with qualified legal and investigative authorities.

Key Terms

Actus reus: The external act, omission, or circumstance forming part of an offence.

Authorization: Permission to access, test, use, modify, or monitor a system within defined limits.

Botnet: A network of compromised devices controlled for coordinated activity.

Civil liability: Legal responsibility that may result in compensation, injunctions, or other private remedies.

Computer-related fraud: Deception or manipulation involving digital systems to obtain benefit or cause loss.

Cyberextortion: Obtaining money or advantage through digital threats or coercion.

Cybercrime: Criminal conduct involving computers, networks, data, or digital communications.

Data interference: Unlawful alteration, deletion, corruption, suppression, or encryption of data.

Digital evidence: Electronically stored or transmitted information relevant to an investigation or proceeding.

Identity theft: Unlawful acquisition or use of identifying information, usually for fraud or other benefit.

Interception: Unauthorized acquisition of communications during transmission.

Malware: Software designed or used to perform unauthorized, harmful, deceptive, or disruptive actions.

Mens rea: The legally required mental state accompanying prohibited conduct.

Phishing: Deceptive communication intended to obtain information, induce action, or deliver malicious content.

Ransomware: Malware or an associated scheme used to deny access to data or systems and demand payment.

Responsible disclosure: Controlled reporting of a vulnerability to enable remediation while minimizing harm.

System interference: Unlawful hindering or disruption of a computer system’s operation or availability.

Unauthorized access: Entry into or use of a system, account, or data without valid permission.

Vulnerability: A weakness that can be exploited to compromise confidentiality, integrity, or availability.

Review Questions

Short Answer Questions

1. What is the difference between actus reus and mens rea?
2. Why is written authorization important in penetration testing?
3. Name four forms of liability that may follow a cyber incident.
4. What is the difference between data interference and system interference?
5. Identify three principles of responsible vulnerability disclosure.

Long Answer Questions

1. Explain how unauthorized access may be distinguished from lawful security testing. Discuss scope, purpose, authorization, and evidence.
2. Describe the main categories of cybercrime covered in this chapter and provide one example of each.
3. Discuss how criminal, civil, regulatory, contractual, and professional liability may overlap in a data-breach incident.
4. Explain common defenses to cybercrime allegations and why good intentions alone may not be sufficient.
5. Describe a defensible process for preserving digital evidence during a suspected cybercrime investigation.

Analytical / Application Questions

1. An employee uses a colleague’s unlocked workstation to read confidential files but changes nothing. Analyze the possible offences and liability issues.
2. A researcher discovers a vulnerable public-facing server and downloads one thousand customer records to demonstrate risk. Evaluate the conduct and propose a lawful alternative.
3. A hospital suffers a ransomware attack that disrupts clinical services. Identify the relevant offences, aggravating factors, evidence requirements, governance duties, and immediate professional responses.

Multiple Choice Questions with Answers

Question 1

Which combination most accurately describes the usual components of criminal liability?

A. A prohibited act and the legally required mental state

B. A technical vulnerability and a public complaint

C. A financial loss and a security certification

D. A system outage and media coverage

Correct Answer: A. A prohibited act and the legally required mental state

Question 2

Which activity is most clearly within responsible vulnerability research?

A. Testing an excluded production server because it shares a domain name

B. Downloading all customer records to prove impact

C. Testing named systems under a written scope using non-destructive methods

D. Publishing exploit details before contacting the owner

Correct Answer: C. Testing named systems under a written scope using non-destructive methods

Question 3

What does unauthorized access primarily concern?

A. Entering or using a system without valid permission

B. Using a licensed security scanner with approval

C. Installing an approved software update

D. Reading publicly published security guidance

Correct Answer: A. Entering or using a system without valid permission

Question 4

Which example best represents system interference?

A. Changing a personal password through an approved portal

B. Launching a denial-of-service attack that makes a service unavailable

C. Reporting a vulnerability privately

D. Reviewing an organization’s acceptable-use policy

Correct Answer: B. Launching a denial-of-service attack that makes a service unavailable

Question 5

What is a central risk in identity theft?

A. Improving password complexity

B. Using identifying information for unlawful benefit or impersonation

C. Encrypting an organization’s backup

D. Updating an intrusion-detection rule

Correct Answer: B. Using identifying information for unlawful benefit or impersonation

Question 6

Which statement about good intentions is most accurate?

A. Good intentions always authorize access to a public system

B. Good intentions automatically eliminate privacy liability

C. Good intentions may be relevant but do not replace authorization or required legal defenses

D. Good intentions permit publication of confidential data

Correct Answer: C. Good intentions may be relevant but do not replace authorization or required legal defenses

Question 7

Which practice best supports digital-evidence integrity?

A. Allowing every responder to edit the original files

B. Maintaining collection records and restricting access

C. Deleting inconvenient logs immediately

D. Relying only on an IP address for attribution

Correct Answer: B. Maintaining collection records and restricting access

Question 8

Cyberextortion generally involves which conduct?

A. Obtaining money or advantage through digital threats or coercion

B. Applying a security patch after an incident

C. Conducting an approved vulnerability scan

D. Creating a lawful backup

Correct Answer: A. Obtaining money or advantage through digital threats or coercion

Question 9

Which factor commonly aggravates cybercrime liability?

A. Testing within a clearly authorized scope

B. Promptly reporting a vulnerability privately

C. Targeting critical infrastructure and causing substantial disruption

D. Minimizing collected personal data

Correct Answer: C. Targeting critical infrastructure and causing substantial disruption

Question 10

Why may one cyber incident create several forms of liability?

A. Only criminal law applies to digital conduct

B. The same conduct can breach criminal law, contracts, regulations, and private rights

C. Civil claims replace all criminal investigations

D. Professional rules apply only to non-technical staff

Correct Answer: B. The same conduct can breach criminal law, contracts, regulations, and private rights