Jurisdictional Challenges In Cyber Crime Prosecution
Author: LawSphereX
Category: Criminal Law
Published:
Updated:
JURISDICTIONAL
CHALLENGES
IN CYBER CRIME PROSECUTION
Vanita, Manav Rachna University
ABSTRACT
In the digital age, cybercrime presents significant jurisdictional challenges due to its borderless nature. Unlike traditional crimes confined to physical locations, cybercrimes occur across multiple jurisdictions simultaneously, exploiting the interconnectedness of the Internet. This paper explores the complexities of prosecuting cybercrime, examining issues of jurisdictional overlap, legal frameworks such as the Indian Penal Code (now Bharatiya Nyaya Sanhita, 2023), the Information Technology Act, 2000, and international legal principles. Emphasis is laid on how different nations approach jurisdiction, with comparative references to U.S. jurisprudence and the emerging need for a coordinated global response. Keywords: Cybercrime, Jurisdiction, IT Act, Bharatiya Nyaya Sanhita, Transnational Law, Cyberterrorism, International Law.
INTRODUCTION
TO CYBERSPACE AND CYBERCRIME Historical development of cyberspace The term “cyberspace” has gained widespread usage in describing the virtual environment established by interconnected computer systems and networks. Stemming from science fiction, this concept has become a reality following the advent of the Internet and the World Wide Web. 1 The historical evolution of cyberspace can be segmented into four primary phases. 2 First Phase- The Pre-Cyberspace Era (17th To 19th Century) During the pre-cyberspace era, which extended from the 17th to the 19th Century, significant advancements were made in mechanical calculation; this period witnessed the development and utilization of various calculating machines and mathematical tables for activities such as astronomy, navigation, engineering, and commerce.
Notably, Charles Babbage emerged as a pivotal figure during this phase, credited with designing the first general-purpose programmable calculating engines, including the Difference Engine and the Analytical Engine Second Phase- The Early Era of Cyberspace (Late 19th To the Mid-20th Century) The second phase of technological development was the early era of cyberspace, which extended from the late 19th to the mid-20th Century. This interval witnessed the evolution and refinement of networking and telecommunications technologies, such as the telegraph, telephone, radio, and television. This era also marked the genesis of electronic computing and artificial intelligence, along with the rise of theoretical computer science and information theory.
Noteworthy figures of this phase include Alan Turing, who introduced the notion of a universal Turing machine and established the groundwork of contemporary computing, and Claude Shannon, who established the mathematical underpinnings of communication and cryptography. Third Phase- The Modern Cyberspace Era (Latter Part of the 20th Century to the Early Years of the 21st Century) The third phase of technological development was the modern cyberspace era, which spanned
1 ORIGIN AND MEANING OF CYBERSPACE - Legal Vidhiya
2 The History of the Word "Cyber" — Mark Loveless
from the latter part of the 20th Century to the early years of the 21st Century. It was a time of significant advancements in global connectivity and information exchange, marked by the creation and expansion of the Internet and the World Wide Web; this period also witnessed the emergence of cybersecurity and cybercrime, along with the development of various applications and services in the cyberspace domain, such as email, social media, e-commerce, online gaming, and more. Prominent figures in this phase included Tim Berners-Lee, the inventor of the World Wide Web, and William Gibson, who first coined cyberspace in his novel Neuromancer. Fourth Phase- Future Era The fourth phase of cyberspace has brought forth a future era that is currently unfolding.
This period is characterized by an increasingly complex, dynamic, and pervasive cyberspace and the emergence of new technologies and challenges such as cloud computing, big data, artificial intelligence, blockchain, quantum computing, cyber warfare, and cyberterrorism. Furthermore, this phase has introduced new actors and stakeholders in cyberspace, including semi-state actors, non-state actors, and civil society groups. The future of cyberspace remains uncertain and unpredictable, yet it is sure to have far-reaching effects on numerous facets of human existence. Cyberspace is hence “the speculative environment in which communication over computer networks occurs. ” The term, derived from the ancient Greek word cybernetics, was first used in science fiction and cinema in the 1980s, was adopted by computer professionals, and became a household term in the 1990s.
During this period, the uses of the internet, networking, and digital communication were all growing dramatically, and the term “cyberspace” was able to represent the many new ideas and phenomena that were emerging. 3 Cyberspace refers to the interdependent network of digital technology, including the internet, telecommunications, and digital devices. Originally a fictional concept, cyberspace is now an essential part of daily life, encompassing computers, software, networks, and data. Cybercrime involves illegal activities either committed using digital devices or targeting such devices and systems. These crimes can range from hacking and data theft to cyberterrorism and digital
3 Cyberspace Explained - LawLex.Org
obscenity. Cybercrime is the use of a computer as an instrument to further illegal ends, such as committing fraud, trafficking in child pornography and intellectual property, stealing identities, or violating privacy. Cybercrime, especially through the Internet, has grown in importance as the computer has become central to commerce, entertainment, and government.4 Because of the early and widespread adoption of computers and the Internet in the United States, most of the earliest victims and villains of cybercrime were Americans. By the 21st century, though, hardly a hamlet remained anywhere in the world that had not been touched by cybercrime of one sort or another.5
LEGAL FRAMEWORK
IN INDIA Cybercrime in India is addressed primarily through the Information Technology Act, 2000, and the Bharatiya Nyaya Sanhita (formerly the Indian Penal Code). • Section 43: Damage to computer systems • Section 66B–66D: Data theft and hacking • Section 66E and Section 113 of BNS: Cyberterrorism • Section 67 and Section 292 of IPC: Obscenity • Section 66B (again): Child pornography These laws, while comprehensive, struggle with the intricacies of jurisdiction when cybercrimes involve foreign nationals, systems, or networks.6 THE PROBLEM OF JURISDICTION IN CYBERSPACE The legal definition of the term jurisdiction corresponds to the authority to decide upon matters by making decisions and judgments. Generally, jurisdiction can be classified as the power to
4 Where does the word cyber come from? | OUPblog
5 Cybercrime | Definition, Statistics, & Examples | Britannica
6 The Humanity and Evolution of Cyber | Tripwire
prescribe, the authority to adjudicate, and the clout to enforce (The power of a sovereign to effect implementation of its laws). The jurisdiction to prescribe relates to the right of a state to make its law applicable to the activities, relations, the status of persons, or the interests of persons in things. Cyberspace, being a borderless world, refuses to pact to the geopolitical limitations the admiration that private international law has always accorded to them and on which it is based. 7 The dilemma of jurisdiction crops up as it is only in the real world that there subsist mechanisms to bestow rights, immunities, privileges, etc. with no corresponding equivalent in the cyber world. In other words, rights are rights only vis-a-vis the real world.
On account of the disparity in the normative standards of conduct among the different political units in the real world, the issue of jurisdiction becomes particularly pertinent, for what may be legal in one legal system may be prohibited by another, and the same may be circumstantially justifiable in yet another. But in the real sense, the difference between legality and illegality is not maintained in the cyber world, independent of the real world. When the real-world players become cyber actors and perform acts not considering the legal frameworks, the following question frequently arises: whether each cyber actor is justified in acting pursuant to the philosophy of ‘‘legality’’ as established in his own legal system alone, whether based on nationality or domicile or mere territorial presence, and thereby imposing them on the whole world?
A related and more difficult question is one of choosing a judicial forum and seeking remedies, particularly where an act committed in cyberspace by a person, subject to the sovereignty of one state, amounts to the violation of a right guaranteed by another. Another significant question with regards to jurisdiction is the forum for adjudicating the issue and for seeking remedies, particularly when an act committed in cyberspace by a person, subject to the sovereignty of one state, amounts to the violation of a right guaranteed by another. 8 Jurisdiction refers to a court's authority to hear and decide a case. In cybercrime, determining jurisdiction becomes complex when crimes span multiple countries. For example, if a Japanese
7 HEI-P-U-0278_SelfLearning_20240614180051.pdf
8 An Introduction to Cyber Law - I.T. Act 2000 (India) | PPT
national is cyber-attacked in India by a perpetrator in Nigeria, the question arises: Whose laws apply, and which court can try the case?9 Types of Jurisdiction: • Territorial Jurisdiction: Where the offence occurred • Subject Matter Jurisdiction: Based on legal topic • Personal Jurisdiction: Based on individuals involved In cyberspace, overlapping jurisdictions often create legal confusion and enforcement challenges.10 NATIONAL AND TRANSNATIONAL JURISDICTION
National Jurisdiction: Applies when domestic laws authorize courts to try crimes affecting the nation. • Transnational Jurisdiction: Involves crimes spanning a few countries (e.g., SAARC nations). • International Jurisdiction: Involves global impact crimes (e.g., ILOVEYOU virus). Criteria for determining jurisdiction include where the content is hosted, where the victim resides, and the geographical reach of the crime. Jurisdiction in cyberspace is regarded as an international space. The same is the case with jurisdiction issues. i.e, jurisdiction within the ambit of cyberspace can be classified as: • Subjective Territoriality: Where the offence begins • Objective Territoriality: Where effects of the offence are felt • Nationality: Based on offender’s nationality
9 Cyberspace Explained - LawLex.Org
10 ‘Cyber': It's everywhere, but what does it mean?
Protective Principle: Protects state interests • Passive Nationality: Based on victim’s nationality • Universality: For crimes affecting all nations (e.g., cyberterrorism)
JURISDICTION IN THE CYBER WORLD AND INTERNATIONAL LAW: Keeping in view the principles of private International law and international comity, each state must accord to the doctrine of sovereignty and must not interfere with the aspects by which the supremacy is manifested by others. Jurisdiction principles, both personal and prescriptive, were originally derived from an assumption about the absoluteness of boundaries and sovereign power within them and were grounded in political practicality. 11 Cyberspace specifically disregards the general correspondence, existing in the real world, between physical borders and ‘‘law space’’—based on considerations of power, effects, legitimacy, and notice.
The law, in the ‘‘non-virtual world’’, works essentially on a two-way premise that a certain set of legal rules is applicable to only one set of persons, who are present within the limits of the sovereign prescribing such rules, and to none other; and that a certain set of persons are required to comply with only one set of standards, and with none other. It is this observation, which has been mutually recognised and accepted by most sovereigns, that gives the requisite strength and legitimacy to each sovereign to enforce its legal rules within its territory. 12 The Uploader-Downloader Theory The two main ways of interaction of the public with cyberspace are: • putting information into cyberspace • taking information out of cyberspace. Thus, legally, in cyberspace, there are two distinct actors: the uploader and the downloader.
Under this theory, the uploader and the downloader act like spies in the classic information
11 https://iibf.org.in/documents/Cyber-Laws-chapter-in-Legal-Aspects-Book.pdf
12 https://iibf.org.in/documents/Cyber-Laws-chapter-in-Legal-Aspects-Book.pdf
drop — the uploader inputs information into a site in cyberspace, and the downloader accesses it at a later time. Neither need be aware of the other’s identity. Unlike the classic information dive, however, there need not be any specific intent to communicate at all. Some areas of the internet are accessed by thousands of people from all over the world, while others fade away like downtrodden paving stones on the seemingly infinite paths of cyberspace. In both civil and criminal law, most actions engaged by uploaders and downloaders present no jurisdictional difficulties. A state can forbid, on its own territory, the uploading and downloading of material it considers harmful to its interests. A state can, therefore, forbid anyone from uploading a gambling site from its territory and can forbid anyone within its territory from downloading, i. e.
, interacting with a gambling site in cyberspace. 13 This theory can be very well demonstrated with the aid of two US cases. Namely the Schooner Exchange and the Cutting Edge case. In the former, it was held that a French war vessel was not subject to American law, although it was in an American port. Similarly, a webpage would be attributed to the nationality of its creator and thus not be subject to the law of wherever it happened to be downloaded. The Cutting Case provides an illustration as to how an uploader should be viewed in a foreign jurisdiction that is offended by material uploaded into cyberspace. Mr. Cutting published an article in Texas that offended a Mexican citizen. When Mr. Cutting visited Mexico, he was imprisoned on criminal libel charges. The United States Secretary of State instructed the U. S.
ambassador in Mexico to inform the Mexican government that, “[T]he judicial tribunals of Mexico were not competent under the rules of international law to try a citizen of the United States for an offence committed and consummated in his own country, merely because the person offended happened to be a Mexican. ” Thus, the general rule is that where uploading certain material is a crime, it is an offence “committed and consummated” in the state where the uploader is located. US PERSPECTIVE: The general rule of jurisdiction is that in order to exercise jurisdiction, there must be a reasonable nexus with the defendant and the location of the forum adjudicating the case. This
13 Cyber Law in India
A Comprehensive Overview approach has been modified in the American Jurisprudence by applying the minimum contacts principle for the out-of-state parties. The fundamental principles of the doctrine can be summarised as follows:14 • Jurisdiction over foreign defendants: In the case of foreign defendants, the US Supreme Court exercises its jurisdiction by considering the out-of-state doctrine. According to the decision in Hess v. Pawloski, there are two requirements subject to which a court can exercise personal jurisdiction over an out-ofstate defendant. The first one is the statutory authority granting the court jurisdiction over the defendant, and the second one is the fulfilment of the due process clause of the Constitution. • Territoriality Mere physical presence in a state is always a basis for personal jurisdiction.
The exercise of jurisdiction is permitted over people and property within the territorial borders. In such a case, physical presence in a forum state is a basis for personal jurisdiction, even when an out-of-state individual enters the forum state for a brief time. Physical attendance in the forum state satisfies the requirement of constitutional due process. Minimum contacts theory In the scenario of conflicting jurisdictional issues in cyberspace, the courts around the world face the difficult question of deciding whether to develop a new body of jurisprudence to deal with the novel legal problem. To provide a solution for the same, the US Supreme Court in Pennoyer v. Neff formulated two broad principles of jurisdiction:
1. Every state possesses exclusive jurisdiction within its territory.
2. No state can exercise jurisdiction over persons without its territory.
The minimum contacts theory was sketched in International Shoe v. Washington. The court ruled that a non-resident may be sued if the party has certain minimum contacts with the state
14 Cybercrime law around the world | Links and updates - Michalsons
such that maintenance of the suit does not affect traditional concepts of ensuring substantial justice. The defendant's contact with the state must be established to invoke the jurisdiction. 15 Also, the jurisdiction can be classified into two as: General jurisdiction: General jurisdiction is permitted over an out-of-state defendant for nonforum-related activities when the defendant has engaged in systematic and continuous activities in the forum state. Specific jurisdiction: may be invoked under the test of the International Shoe case, and such jurisdiction may be established if a defendant has such minimum contacts with the state that it would comply with due process rights to require the defendant to find a lawsuit in the forum state.
Reasonable anticipation In order to further safeguard the rights of out-of-state defendants, a further caveat was added to the ‘‘quality and nature of minimum contacts test. This was that the defendant’s contact with the forum state should be foreseeable, i. e. , a court would not have jurisdiction unless it could be revealed that the defendant had ‘‘purposefully availed’’ himself of the privilege of conducting business in the forum. This ‘‘critical’’ test of ‘‘foreseeability’’ is not the mere likelihood that a product will find its way into the forum state, but required a reasonable anticipation of being hauled into court there. Effects cases This concept is based on the principle that the action of the defendant reasonably has some effect in the forum state. In Calder v.
Jones, the Supreme Court based jurisdiction on the principle that the defendant knew that his action would be injurious to the plaintiff; therefore, he must be presumed to have anticipated being hauled into court where the injury occurred. The effects cases are of particular importance in cyberspace because any conduct in cyberspace has effects in various jurisdictions
15 Pavan Duggal, Textbook on cyber Laws, Universal Law Publishers, 2014 Edition, p. 2
Personal jurisdiction in cyberspace The principle applied by the US courts in determining the jurisdiction of the forum in matters relating to insurance can be summed up as ‘the likelihood that personal jurisdiction can be constitutionally exercised is directly proportionate to the nature and quality of commercial activity that an entity conducts over the Internet.” This has been decided by the US Supreme Court in Zippo Manufacturing Co v Zippo.Com, Inc 952 F. Supp.1119 by considering the ratio of the International Shoe case. UK POSITION:
Personal Jurisdiction: The English law recognises the rule of territoriality as the principle of adjudicative jurisdiction. The law recognises personal jurisdiction when the defendant is present within England and the writ is served upon him and when he is served at the discretion of the court or he submits to the jurisdiction of the court. The case law to the point is Deverall v. Grant Advertising Inc. • The Brussels Regulation The publication of the defamatory material within the jurisdiction of a court is a basis for the exercise of jurisdiction under the traditional rules, the Conventions, and the Regulation since this constitutes the place where the harmful event occurred.16
GLOBAL PERSONAL JURISDICTION: In the international phase, systematic and continuous contact may be required, and hence, websites by themselves may not subject a party to global jurisdiction. However, tortious acts using the internet directed towards in the forum acts using the internet directed towards in the forum state may be subject to its jurisdiction. Firstly, where the defendant actively does business over the internet directed at the forum state, the same can exercise jurisdiction over the defendant. Secondly, where the website provides a lower level of interactivity by permitting the defendant to transmit information with customers over the Internet, the court must assess
16 Mishra J.P., An Introduction to Cyber laws, Central law Publications
First Edition: 2012, p. 14. the level of interactivity and the commercial nature of the website to determine if sufficient contacts exist to warrant the exercise of jurisdiction. WEBSITES: ACTIVE, PASSIVE, AND INTERACTIVE In a German case, the court found that it could exercise jurisdiction over a defendant based in Kansas City based on the fact that the website operated at the defendant’s domain name was accessible at the plaintiff’s location in Germany. BUDAPEST TREATY The Convention on Cybercrime was opened in Budapest on November 2001. The same marked as the first ever treaty on criminal offences committed against or with the help of computer networks, including the internet. The Convention aims at pursuing a common criminal policy aimed at the protection of society against cyber crime by adopting appropriate legislation and fostering international co-operation.
The Convention on Cyber Crime regards cyber crimes as extraditable offences. By virtue of Article 24, the offence is extraditable if punishable under the laws in both contracting parties by imprisonment for more than 1 year or by a more severe penalty. CONFLICT OF LAWS- EXAMPLES: Cyberspace, being a borderless framework, raises legal questions that are required to be dealt with internationally. For instance, an act or any network may be illegal in India but legal in the US. They can be viewed in India by anyone, and this amounts to an offence under the IT Act
2000 but not under the US legislation.17
1 The Dow Jones Case
Dow Jones & Co., the publisher of the Wall Street Journal, was sued in Victoria, Australia by Joseph Gutnick, for publishing an online Article named ‘Unholy Gains’ on servers maintained at New Jersey, US. The court held that as the materials complained of were made comprehensible when downloaded in Victoria, the courts in Victoria had jurisdiction.
17 Mishra J.P., An Introduction to Cyber laws, Central law Publications
First Edition: 2012, p. 15
2. The Young Case
The suit was filed against two newspapers that had made defamatory comments about a prison warden in Virginia. The jurisdiction of the court was objected. The District court accepted the jurisdiction, but the same was reversed by the US Court 4th Circuit. The appellate court ruled that the newspapers did not target their websites nor had they published the same for the Virginia audience, so merely because anyone could download the articles from the website did not bestow jurisdiction to the Virginia court.
3. The Yahoo case
Yahoo, the Internet Service Provider, displayed Nazi materials and provides auction of Nazi insignia. The French Law considered it as illegal, but a French user could see Nazi material and also purchase Nazi insignia from Yahoo site. A suit for injunction filed against Yahoo was allowed. Yahoo simultaneously filed a suit in the US court to declare the French order unenforceable as it violated the First Amendment to the US Constitution. The district Court ruled that the Constitution protects free speech and trumped the French court requiring Yahoo to remove Nazi material from the website. CYBERSPACE: INDIAN PERSPECTIVE Effective legal machinery can be identified by how properly rules and regulations are drafted by legislators and, more importantly, how precisely principles of jurisdiction are laid down.
A court must have jurisdiction, venue, and appropriate service of process in order to hear a case and render an effective judgment. The jurisdiction of civil courts is classified into three parts:
1. Pecuniary jurisdiction
2. Territorial and
3. Subject matter
The concept of Jurisdiction in Cyber space can be discussed under the following heads: • Personal Jurisdiction In Ramanatha Chettaiar v. Soam Suntharam Chettiar, the court held that India follows the well-established principle of private International law that the law of the forum in which the legal proceedings are instituted governs all matters of procedure. In BulBul Roy Mishra v. City Public Prosecutor, the court held that the approach adopted is similar to the minimum contacts approach of the United States, coupled with the compliance of the proximity test of the Code. 18 • Agreement between parties In case there is more than one court having jurisdiction over a subject matter, an agreement between the parties to confer jurisdiction only on one of the courts to the exclusion of others is valid. The case law to the point is Hakkam Singh v. Gammon India Ltd AIR 1971 SC 740.
This party autonomy, however, does not extend to confer jurisdiction upon a forum that inherently lacks the same. In the case of jurisdiction in cyberspace, the principle followed in India is that when the contract contains a choice of court clause, the Indian courts do give due consideration to the clause. On the other hand, if the same is not provided in the agreement, the Indian Courts would apply the test contained in Section 20 of the Civil Procedure Code. To determine whether the cause of action arose in the local limits of a court, the court generally evaluates the conclusion of the contract. However, this principle has much less relevance with regard to e-contracts. There exists an opaque confusion between the rules governing the completion of communication, acceptance, and revocation.
Thus, the general trend is that the courts do not decline jurisdiction merely on the ground that the international contract is entered electronically. It takes into account the basic principle in ascertaining the jurisdiction, ie. Domicile of the defendant and proximity to the cause of action. The Indian courts assume jurisdiction even if a single condition is satisfied. The plaintiff has to establish that no other courts can assume a better jurisdiction. The case law to the point is Independent News Service v. India Broadcast Live (2007)
18 New York
Berkley Publishing Group, 1989, p. 128 India has entered into multi-lateral treaties with nearly 20 countries to attain legal compatibility while dealing with cyber matters. However, by virtue of sec. 188 Cr. P. C. , previous permission of the Central Government has to be obtained to deal with offences committed outside India. JURISDICTION UNDER INFORMATION TECHNOLOGY ACT 2000 According to Section 75 of the IT Act, the Act also applies to any offence or contravention committed outside India by any person, irrespective of his nationality, if the act or conduct constituting the offence or contravention involves a computer, computer system, or computer network located in India. jurisdiction issues in Cyberspace have much relevance with regards to Copyright matters and defamation(libel) suits.
India's IT Act, 2000, under Section 1(2) and Section 75, grants extraterritorial jurisdiction where any offence involves Indian systems, persons, or interests. 19 The Indian approach to personal jurisdiction can be summarised as the jurisdiction based on the Forum of choice and the jurisdiction based on the Code of Civil Procedure. Judicial precedents such as: • SMC Pneumatics v. Jogesh Kwatra • Sony Sambandh. com Case • State of MP v. Suresh Kaushal affirm India’s jurisdictional authority in cyber-related matters, especially when Indian parties are affected. PROPOSALS: Besides giving undue weightage to the minimum contact theory, it would be better if the courts could analyse the facts to ascertain the actual proximate cause. For this purpose, judicial mind has to be applied to determine the actual cause.
This approach would ensure that the state imparts justice in each individual case in accordance with the Constitutional mandates. 20
19 (PDF) Critical Assessment of Information Technology Act, 2000
20 IJIRT173727_PAPER.pdf
Effects approach: The ultimate effect of the action should be considered as the basis of jurisdiction. However, in cases pertaining to social welfare, including consumer matters, a much liberal approach has to be adopted. The courts, while dealing with Cyber cases, have to ensure that the principles of natural justice are properly met. Cyberspace is an amorphous space that operates logically, covering different spheres of law, including Intellectual property rights infringement issues. The confusion as to the jurisdiction of the forum in the matters relating to this borderless world forms a vital aspect in Cyber Jurisprudence. Yet, cyberspace plays a vital role in the day-to-day affairs of a human being in this modern millennium.
GLOBAL FRAMEWORKS AND
CHALLENGES
Efforts to create unified frameworks, such as the UNCITRAL Model Law on E-commerce (1996), highlight the importance of cross-border cooperation. Still, global consensus remains elusive due to differing national priorities, legal definitions, and technological capabilities.21
CONCLUSION
Jurisdiction in cybercrime cases remains a dynamic and challenging domain. The borderless nature of the internet demands novel legal interpretations, international cooperation, and harmonization of laws. While India has taken significant steps via the IT Act and evolving jurisprudence, gaps remain. Comparative approaches, such as those followed in the U.S., provide valuable insights. The future of cybercrime prosecution lies in collaborative legal reforms, transnational treaties, and responsive legislation that adapts to the ever-evolving cyberspace. 21 Treaties & International Agreements - International and Foreign Cyberspace Law Research Guide - Guides at Georgetown Law Library