Octopus Cybercrime Community

The UK’s cybercrime legislation is found in a range of different statutory measures, as the UK does not have a unified criminal code or criminal procedure.

Both substantive and procedural criminal law framework of United Kingdom, with recent updates in 2015, are fully in line with the Convention requirements.

The criminal conduct detailed in Articles 2 (illegal access); 4 (data interference), 5 (system interference) and 6 (misuse of devices) is found in the Computer Misuse Act 1990: Section 1 (unauthorised access to computer material); section 3 (unauthorised acts); section 3A (making, supplying or obtaining articles for use). This Act is currently being further amended.

The criminal conduct detailed in Article 3 is found in the Regulation of Investigatory Powers 2000: Section 1 (unlawful interception).

The criminal conduct detailed in Article 7 (computer-related forgery) is found in the Forgery and Counterfeiting Act 1981; while Article 8 (computer-related fraud) is found in the Fraud Act 2006.

The criminal conduct detailed in Article 9 (child pornography) is found in the Protection of Children Act 1978 and the Criminal Justice Act 1988, section 160.

The criminal conduct detailed in Article 10 (copyright infringement) is found in the Copyright Designs and Patents Act 1988.

Attempts are criminalized under the Criminal Attempts Act 1981; while aiding and abetting are addressed in the Accessories and Abettors Act 1861, s. 8 (for indictable offences) and the Magistrates’ Courts Act 1980, s. 44(1) (for summary offences).

As a general principle under UK law, legal persons can be held liable for criminal conduct either on the basis of vicarious liability or where the prohibited act of an individual can be attributed to the company.

The jurisdictional reach of each type of offence (Article 22) is detailed in the applicable statutory measure, e.g. Sections 4-8 of the Computer Misuse Act 1990. In terms of extraterritorial jurisdiction (Article 22(3)), UK does not generally adopt such measures.

Rules requiring the preservation of data (Articles 16 and 17) are found in the Police and Criminal Evidence Act 1984. In addition, a preservation request from a foreign law enforcement agency can be made under the Crime (International Co-operation) Act 2003.

Rules requiring the production of data (Article 18(1)(a)) are found in various pieces of pieces of UK legislation, including the Police and Criminal Evidence Act 1984, the Terrorism Act 2002, the Proceeds of Crime Act 2002 and the Social Security Administration Act 1992. The production of subscriber data by service providers (Article 18(1)(b)) is provided for under the Regulation of Investigatory Powers 2000, Part I Chapter II.

General powers of search and seizure (Article 19) are contained in the Police and Criminal Evidence Act 1984.

The real-time collection of data (Articles 20 and 21) from a service provider through interception is provided for under the Regulation of Investigatory Powers 2000, Part I, Chapter I.

General rules and safeguards apply. The Human Rights Act 1998 incorporates the European Convention on Human Rights into UK law, applicable to public authorities such as law enforcement agencies and any other person carrying out a “function of a public nature”.

Besides an extensive legal framework on technical aspects, there are important acts on this field respecting:

• Data Protection Act 1998: http://www.legislation.gov.uk/ukpga/1998/29/contents;
• The Privacy and Electronic Communications Regulations 2003: http://www.legislation.gov.uk/uksi/2003/2426/contents/made
• Data Retention Regulations 2014: http://www.legislation.gov.uk/uksi/2014/2042/contents/made
• Electronic Commerce Regulations 2002: http://www.legislation.gov.uk/uksi/2002/2013/contents/made

(Note that there is no public source of these laws that is maintained in a completely up-to-date form.)

The legal competence to begin and direct criminal investigations and obtain evidence belongs to the police and other specified law enforcement agencies.

Requests for evidence from abroad may be made by a judicial authority or a designated prosecuting authority, e.g. the Crown Prosecution Service.

MLA authority in he absence of other treaties (Art. 27)

For matters related to England, Wales and Northern Ireland:

UK Central Authority

Home Offie

5^th Floor Peel building

2, Marsham Street

London

SW1P 4DF

For matters related to Scotland:

International Co-operation Unit

Argyle House

C Floor

3 Lady Lawson Street

Edinburgh

EH3 9DR

For matters related to indirect taxation:

Law Enforcement and Internationam Advisory Division

HM Revenue and Customs – Solicitor’s Office

Room 2/74

100 Parliament Street

London

SW1A 2BQ

Authority for extradition and provisional arrests in the absence of other treaties (Art. 24)

Home Office

Judicial CO-operation Unit

5^th Floor Peel building

2, Marsham Street

London

SW1P 4DF

Scottish Government (when the person is believed to be in Scotland)

Criminal Procedure Division

St. Andrew’s House

Regent Road

Edinburgh

EH1 3DG

24/7 Point of contact (Art. 35)

National Crime Agency – National Cyber Crime Unit

PO Box 8000

London, SE11 5EN

Specific procedures and best practices for International Cooperation

The United Kingdom has signed the main treaties and conventions on judicial international cooperation within the European Union and the Council of Europe, specifically the European Convention on Mutual Assistance in Criminal Matters (1959) and the Convention on Mutual Assistance in Criminal Matters between Member States of the European Union (2000). The primary legislation for obtaining evidence abroad for use in domestic proceedings or investigations, and for the provision of domestic evidence in response to a request from abroad, is the Crime (International Co-operation) Act 2003. Requests for evidence within the UK have to be made to the UK Central Authority, which is part of the Home Office.