Introduction

Having examined the purposes of judicial punishment as applied in connection with cyber crime, and reviewed some of the sanctions that courts have used in recent decisions, we now consider the sentencing process itself and the extent to which certain punishments have been imposed. We also seek to find out the extent to which the presence of a computer in the commission of a crime affects the sentence imposed by the court. We shall do this by examining a small sample of cases decided in Australia and New Zealand involving serious fraud, some of which had computer involvement, and others of which did not.

In achieving the various aims of punishment, courts are required to take into account any aggravating factors (or what are known in the United States as ‘enhancements’ to the level of penalty applicable to the offence, as specified in the United States Sentencing Commission's Sentencing Guidelines (2003b)), in addition to mitigating factors raised on behalf of the defendant (or what are known in the United States as ‘downward departures’ from the Commission's Guideline sentences). This enables the court to adopt an individualised punishment adapted to the circumstances of the offender, while at the same time taking into consideration matters of more general import to the community as a whole, such as the need to demonstrate denunciation of the conduct in question and to achieve general deterrence.

The material presented in this book comes from a wide range of sources. Apart from recourse to secondary sources and commentaries on the judicial process in this area, we have drawn on a number of government reports dealing with cyber crime. The Internet itself provides a good deal of information, and of course many unreported judicial decisions are now available online.

In addition, we sought input and advice from senior practitioners in the field. This was achieved through informal discussions with personal contacts and, more formally, by holding a number of Roundtable Discussions in which we called together the most senior people in a variety of jurisdictions who are involved in the investigation and prosecution of cyber crime. The purpose of these was to seek their understanding of the key issues that affect their daily work.

Two such Roundtable Discussions were held, one in Canberra on 4 April 2002 at the Australian Institute of Criminology and one in London on Tuesday 16 July 2002 at the Home Office. In the United States, discussions were held with key informants in Washington DC on 7 and 8 November 2002. Attending each were senior police, prosecutors and/or representatives from regulatory agencies in each country, with each discussion facilitated by one of the authors. Each discussion followed the plan of the chapters of this book.

Introduction

One of the most important characteristics distinguishing computer-related crime from ‘terrestrial crime’ is the matter of jurisdiction. The global nature of cyberspace makes it much easier than ever before for a person sitting on one side of the world to commit a crime on the other side. The offending activity (whether it involves the sending of illicit images of children, malicious code, or fraudulent stock tips) can pass through numerous sovereign nations at the speed of light on the way to the target. Which of these nations can prosecute such cases: the jurisdiction where the activity was initiated, the place where it had its effect (that is, where the loss or damage was sustained), or a nation through which the offending communication may have passed on its path from origin to destination?

It is up to the prosecutor to decide whether a case should be prosecuted within his or her jurisdiction. It is up to the judge whether the court has jurisdiction to hear the case, on the basis of general statutory rules or the specific substantive offence with which the accused has been charged. Traditionally, jurisdiction required a substantial link with the territory in which the matter would be heard. Merely having been passed through by a communication en route from Country A to Country C was not always sufficient to achieve jurisdiction in Country B. A good deal of energy is now being devoted to expanding jurisdiction, as we shall soon see.

The Need for Adequate Cyber Crime Laws

Cyber crime laws may be relative newcomers to the substantive criminal law of most jurisdictions, but their evolution has followed a more or less familiar path. The starting point has been the observation, whether driven by national or international experience, that certain harmful or potentially harmful behaviours appear to be beyond the reach of existing criminal laws. The identification of deficits in the criminal law may emerge from academic analysis or the work of law reform bodies, occasionally even a far-sighted legislature, but most often such problems show up first in prosecutorial failures. The inability to find appropriate charges to lay, or the failure or abandonment of criminal proceedings when it emerges that the criminal law does not in fact extend to the conduct alleged, indicate most clearly that a legislative gap may exist.

Few cases provide a better illustration than the infamous ‘Love Bug’ computer virus, discussed in Chapter Four. The inability of prosecutors in that case to obtain a conviction under the Access Devices Regulation Act prompted the Philippines legislature within weeks to introduce new laws relating to electronic commerce. From 15 June 2000, a penalty of six months to three years imprisonment applies to ‘hacking’, ‘cracking’ and computer virus offences in the Philippines, with fines ranging to a maximum commensurate to the damage incurred.

This book has provided the first international study of the ways in which cyber criminals have been dealt with by the judicial process.We have provided a preliminary analysis of some salient cases from around the globe and identified some of the principal concerns that face prosecutors and judges when dealing with the sometimes novel considerations raised by cyber crime.

Principal Conclusions

In relation to our central arguments, we are now able to offer some concluding observations.

Does Cyber Crime Raise Unique Problems?

First, we have found that the prosecution and judicial disposition of cases involving cyber crime do indeed raise certain considerations that make these cases different from cases involving conventional crime. Prosecutors have been presented with some truly novel arguments, such as the computer addiction defence. Difficult evidentiary issues have also been raised. When relevant and irrelevant data on a copied hard drive cannot be differentiated, the admissibility of the evidence is brought into question.

On the other hand, however, many computer-related cases raise the same conventional issues that prosecutors face in other complex cases involving financial fraud or dishonesty. It seems, for example, that a similarly high proportion of offenders plead guilty in cyber crime cases, making it unnecessary for full and protracted criminal trials to be conducted. Were this not the case, the difficulties associated with prosecution and trial would be greatly exacerbated.

Prosecuting Cyber Crime

The extent of the prosecutor's involvement with cyber crime will vary from one country to another depending upon the prosecutor's role in the criminal justice system and on constitutional issues more generally. In civil law countries, the decision to begin an investigation may rest with the prosecutor, depending on whether coercive measures are necessary or special proceedings are required. Japanese prosecutors routinely direct investigations (Johnson 2002). Prosecutors also play a central investigative role in Korea and China (UNAFEI 1995). In the United States, especially at the federal level, prosecutors are involved well before a criminal charge is brought, and are often engaged in the planning, organisation and execution of criminal investigations. This early involvement tends to arise from constitutional restraints on criminal investigation that invite detailed and exacting prosecutorial oversight. The National District Attorneys Association, the peak body of all US prosecutors, has specified that the office of the prosecutor should review and approve all applications for search warrants, arrest warrants, and all applications for the use of electronic surveillance (National District Attorneys Association 1991, Standards 40.1–40.3).

In Scotland, the office of the Procurator Fiscal has direct involvement with the investigation of offences from the outset. In Northern Ireland, prosecutors have traditionally been relatively ‘passive’ recipients of evidence collected and presented to them by police. This reflects the British tradition of prosecutorial independence, which favours a degree of insulation from the police and from executive government.

The Definition of Judicial Punishment

Grotius, the seventeenth-century jurist and philosopher of law, defined punishment as ‘the infliction of an ill suffered for an ill done’. This definition contains the four essential elements of punishment:

• the deed complained of and the punishment inflicted are linked;

• punishments are intentionally inflicted for a reason;

• the individual who is punished is answerable for his or her actions; and

• the infliction of punishment is a socially regulated activity.

Judicial punishment, which is controlled by the state, should also be distinguished from punishments which are inflicted informally, such as by parents on children (see generally Hart 1968, Walker 1991 and Flew 1969).

Punishments differ from acts of personal revenge in that they are administered by the state and are subject to rules as to consistency and appropriateness. Certain categories of people are exempt from judicial punishment, namely, children under certain specified age limits (usually ten years of age); slightly older children (usually between ten and fourteen years of age) who do not know that what they did was wrong; and individuals who are unfit to plead or found to be legally insane. These rules exist to protect those whom society determines to be not legally responsible for their actions.

In cyberspace, however, the imposition of judicial punishment poses some difficulties, particularly where young offenders are concerned. On occasions they may have inflicted enormous damage, sometimes extending across the globe, as in the case of the creation and release of malicious code.

Before proceeding with our substantive discussion it is important to examine the definition, nature and scope of cyber crime, in order to delimit our inquiry as well as to place the discussion of the cases we have chosen for analysis in some theoretical context. In the following discussion we shall examine some of the key terms and their relationship to other descriptive categories of crime that overlap to some extent with our topic of inquiry.

Clearly, digital technologies lie at the heart of cyber crime and these include computers, communication technologies and networked services. Grabosky and Smith (1998) describe the wide range of services included within the concept of digital technologies and for the purposes of the present discussion we shall assume that computers, communications technologies and other networked services form the infrastructure in which cyber crime may be committed. References to computers and digital technologies will be used interchangeably.

Cyber Crime Not Cybrecrime

There is, at present, a wide range of adjectives used to describe computer crime – virtual, online, cyber-, digital, high-tech, computer-related, Internet-related, telecommunications-related, computer-assisted, electronic, and ‘e-’ (as in ‘e-crime’). In the same way that the term ‘white collar crime’ sparked fifty years of discussion and controversy, these terms coined to delimit the scope of computer-related misconduct are likely to be similarly problematic.

For present purposes we have chosen to adopt the term ‘cyber crime’ to describe our subject matter, although any of the other terms could justifiably have been chosen.