Alisdair A. Gillespie

As is well known, there is no general duty to act under English criminal law. Legally, a person could sit down on the banks of a river and watch a stranger drown without incurring legal liability. Of course, there are exceptions to this general rule. Williams suggested that certain professionals owe a duty to rescue, but the limits of this duty are opaque. Additionally, rescuers are not restricted to professionals. There is a strong tradition of volunteers, including passers-by, rescuing people in distress, but does that mean they can then become culpable if they fail to rescue? Building on previous work by the authors, this chapter will review how the principles of causation apply to rescuers. It will explore the limits under which a person can be found liable for failing to rescue another. This is an increasingly important area of the law because what constitutes ‘a rescue’ in a conjoined environment of ubiquitous communications could be as simple as calling for help. The chapter concludes by considering the argument that a ‘Good Samaritan’ rule should apply, obliging people to take ordinary steps to help others.

This chapter considers the issue of Child Sexual Abuse Material. This used to be referred to as Child Pornography, but the chapter notes that this is a term that is now not used because it downplayed the abusive nature of the images. This chapter provides a comprehensive introduction to the issue of Child Sexual Abuse Material. It sets out the definition of such material, including the definition of ‘a child’, which is surprisingly difficult to define. It also notes that most laws tend to focus on photograph-based forms of material but that Artificial Intelligence has transformed the way that photograph-quality material can be produced. The chapter also considers the harms that are caused by child sexual abuse material. While the production will inevitably lead to harm being caused, the chapter notes that both the distribution and the simple possession or viewing of material can cause harm. This harm is sometimes known as secondary victimisation and is based on the psychological harm that is caused by knowing that the material is in circulation, and that people are using it for sexual gratification. The chapter considers how international law seeks to tackle child sexual abuse material before turning to the law in England and Wales. This prohibits an indecent photograph of a child, and the chapter considers what indecent means, and how the age of the child can influence this. The chapter also considers so-called Virtual Child Sexual Abuse Material, which is now largely AI derived. It considers whether the law has managed to keep pace with the technological changes in this area.

This chapter considers how policing is organised around cybercrime. Having laws is no use if there is not the ability to enforce them. The chapter begins by discussing traditional law enforcement agencies (‘the police’) and notes that in the UK, they are organised into forty-five constabularies (forty-three in England and Wales, one in Scotland and one in Northern Ireland). The chapter discusses how they are organised, including through high-tech crime units. Police forces also come together to create Regional Organised Crime Units, and these have an important role to play in cybercrime, particularly in respect of child sexual exploitation. Alongside the local forces are the national forces, led by the National Crime Agency, the latest attempt at a UK-wide police force. Again, this has a cybercrime capability, particularly through the Child Exploitation and Online Protection Command (CEOP). The chapter also looks at the issue of fraud. Despite this being one of the most prolific forms of cybercrime (as discussed in Chapter 5) you cannot report crime to the police. Instead, it must proceed via Action Fraud. The chapter notes how less than 1% of fraud is now actioned by law enforcement, and questions whether that means it can truly be said that fraud is taken seriously. International law enforcement agencies, such as INTERPOL and EUROPOL, are considered, with it being noted that only a truly international approach can tackle international crime such as cybercrime. Finally, the chapter considers private policing. In this context, it means how the internet industry itself is seeking to address some of the issues it experiences. This chapter also includes consideration of the new requirements in the Online Safety Act 2023.

This chapter builds on Chapter 2 and looks at the legal responses to hacking and malware. It begins by looking at the Cybercrime Convention and how the offences are set out. The Cybercrime Convention requires that things are done without right, and the chapter explores what that means. The Convention considers illegal access (which can cover both hacking and malware), illegal interception (where data is captured because of tampering), data interference and system interference. It is noted that the conjoined environment means that we should now be more worried about access to data rather than systems as data is now the most important commodity. The chapter notes that jurisdiction and cross-border crime is the biggest issue in this area as most hacking and malware originates from outside of one’s borders. The Computer Misuse Act 1990 is then introduced and it notes that this requires that actions be done without authority. As with the Convention, the Act considers unauthorised access as being the key offence; this applies when someone secures access without permission. There is then the aggravated offence of accessing a computer intending to commit a further crime, which could cover situations where bots are used to do illegal acts. Data Protection is also considered as this is an important aspect of the law and blackmail is considered for ransomware.

This final chapter considers the investigative powers that the police use. It includes an examination of digital evidence, and notes that often this is what poses challenges to the police. Gaining possession of the device in order to investigate it can be a real challenge, particularly when the offender or the victim’s computer is outside of the jurisdiction. Even when both parties are within the same country, the sheer amount of material that is stored on electronic devices can pose real challenges to law enforcement. The chapter then turns its attention to communications data. This is an extremely controversial area of the law, and it is where the police and security services can gather data in respect of the use of the internet, device or telephone. While the content of a communication cannot be gathered (as that constitutes an illegal interception), it does include the who, what and how. This allows the police or other agencies to build up a picture of what sites are being accessed, or who a suspect is talking to. The issue of bulk data collection – where large numbers of people’s data are gathered – is also considered in this chapter. There have been many challenges to this area, and the courts have considered some of the powers to breach human rights. The principal challenges to the investigatory power’s regime are considered, and an analysis is made of where the courts draw the line. The final section of the chapter looks at online surveillance, including OpenSource Intelligence. This is how law enforcement can use publicly available information such as websites and social media postings to gather intelligence on a group or individual’s online dealings. The second aspect of surveillance that is considered is the use of Covert Human Intelligence Sources (CHIS), who will act as undercover agents to talk to people online. This is particularly common in respect of the sexual solicitation of children, and the chapter notes how the courts have reacted to this.

This chapter looks at two issues that are often taken together: stalking and bullying. As with fraud, there is a disagreement as to whether these should be called cyberbullying and cyberstalking or not. The argument against using cyber in the title is that the internet and other technologies are simply a tool to undertake the bullying and stalking. That the stalking would happen in any event, but technology allows it to take place online. Bullying is similar where there is some evidence that even online bullying takes place when the two parties know each other. So, the technology simply allows other forms of bullying to be brought online. That said, there are undoubtedly circumstances when bullying does only take place only online and here jurisdiction can be a problem as bullying can take place across international borders. The chapter considers how the law can respond. It notes that nonfatal offences are quite difficult to use because under English law an assault requires a person to apprehend immediate and unlawful violence, something sometimes tricky over computers. That said, when the impact on a victim is such as to cause psychiatric harm, then some of the more serious offences can be used. Stalking is covered by the Protection from Harassment Act 1997 although some question the extent to which it covers online stalking. The more usual offences are the communication offences but the proposals under the Online Safety Act 2023 could make that more difficult. It shows that while freedom of speech has been the main focus of these offences, an unintended consequence could be that there is more bullying.

This chapter considers two key issues in respect of online content. The first is hate content, which is typically racist or extremist content. The second relates to self-harm. The first issue – hate crime – relates to hate speech and its interaction with free speech/freedom of expression. The chapter notes that the internet has led to a significant increase in hate content, particularly anti-Semitic content and racism. The chapter explores what hate speech is and what the value of ‘hate’ is, noting that it has to be beyond a dislike for a particular minority group. The controversy over extending hate speech to cover certain lifestyle choices is also explored, and it is noted that while there are common characteristics, it would not be appropriate to consider these as hate crimes (as distinct to bullying or harassment). The chapter considers some of the key forms of hate crime on the internet, including Holocaust denial and white supremacy sites. The reasons for posting such content are also considered, which include normalising such views and seeking to portray them as normal. The chapter notes that there is a transatlantic divide over how the law tackles this material, with European countries (including the UK) treating the matter as criminal whereas the Americas tend not to consider it as seriously, fearing that it interferes with free speech. The second half of the chapter notes how the internet has been used to promote suicide, self-harm and eating disorders. Again, the chapter goes through the different ways that the internet can be used to promote self-harm. By focusing on eating disorders the chapter notes that the language becomes personified and that while some websites seek to act as recovery sites, they are often misused by others. The limits of the law in tackling this material are explored, including how the new Online Safety Act 2023 could affect this.

This chapter introduces two of the main forms of cybercrime: hacking and malware. However, the chapter first discusses what the legal meaning of a computer is, and notes the fact that neither domestic nor international law ever defines it. The chapter then turns to hacking. It notes that hackers were once thought to be innocent. They helped develop our understanding of technology. However, the media now portrays hackers as being the bad guys and making things happen to computers. The motivation of hackers is considered, with the hat system (white hat, black hat and grey hat) sometimes being used to discuss why people act, although this is overly simplistic. The chapter looks at what hackers do, including theft of information, theft of resources, Denial of Service attacks, Distributed Denial of Service attacks and the distribution of malicious software. The second half of the chapter looks at malware, particularly the virus, trojan and worms. Viruses have existed for a long time and spread through physical media. The internet meant viruses could spread quickly. Some viruses turn computers into bots, meaning that a user can control them to undertake Denial of Service attacks. Spyware, Adware and Ransomware are also examined.

Chapter 1 introduces the concept of cybercime. It begins by tracking the history of the computer and information communication technologies, showing how we have moved from physical computers to cloud-based systems. It shows how criminals have exploited technology throughout time and questions whether there is anything truly called cybercrime. It introduces the Dark Web (and notes that this has legitimate purposes too) and also the use of Artificial Intelligence. It then turns to definitions of cybercrime and considers how you can classify cybercrime. This includes computer-assisted crimes and computer-focused crimes and focuses on whether the crime takes place wholly in the physical world, wholly in the online world or both. The chapter also considers some of the problems of cybercrime, including its scale, the fact that people can be anonymous and that it has a global reach. The chapter concludes by looking at the Budapest Convention, also known as the Cybercrime Convention, and how this has become the key international instrument. It notes that a new United Nations Convention is being drafted but that it is unlikely to surpass the Budapest Convention.

This chapter considers the issue of jurisdiction. While this is something introduced in other chapters as a challenge for cybercrime, it is considered in depth during this chapter. Jurisdiction is both an international and a national concept. The chapter begins by noting that the general rule is that countries can legislate however they wish within their own borders, and technically they can prescribe illegal conduct elsewhere in the world, but the question then is how they get custody of the offender to try him. This then gives rise to the main rule within jurisdiction known as the ‘territorial principle’. Countries will then typically extend jurisdiction (extraterritorial jurisdiction) in one of several ways. The first is the active personality principle, which is where the state criminalises the actions of their own citizens or residents whilst abroad. This has historically been used to combat child sex tourism. The second form of extraterritoriality is known as the passive personality principle, which is when a country claims the right to try offenders who offend against one of their citizens or residents who is abroad (i.e. the same as the active personality but for victims). The third basis is the protective principle which tends to be used to safeguard the security of the state or important state interests. This can include cyberattacks on important national infrastructure. The final basis is universal jurisdiction. This is where a matter is considered so serious that a state can try a citizen of any crime for acts committed against anyone. This tends to be rarely used and is only for the most severe crimes, such as genocide and other crimes against humanity. Of course a problem with exercising extraterritorial jurisdiction is that you need to gain custody of the offender through extradition, and the challenges of this are discussed in the chapter. The chapter also considers calls for a cyberspace jurisdiction where cyberspace is recognised as an international space. The chapter notes that this is impractical and so the normal rules of jurisdiction apply.