Home › Cybercrime Law › Module 6 · Jurisdiction

Module 6 · Criminal jurisdiction

What this module covers and why it matters. Module 6 asks when a state may prosecute a cybercrime that crosses its borders. It sits at the hinge of the subject, after the offence modules and before investigations and cooperation, because a state must have jurisdiction before any of its powers bite. The starting point is the set of traditional bases of jurisdiction that public international law recognises, both territorial and extraterritorial. This module then shows how the internet strains them. Australia extends its reach through Division 15 of the Criminal Code and the computer offences in Part 10.7 attract the narrowest of those extensions, which is Category A. When several states can each prosecute, the Eurojust guidelines supply the factors that decide the forum. For the research essay the live contest is whether extraterritorial jurisdiction should be expanded at all and so the Debate section carries most of the weight.

Instruments at a glance

Instrument	Key provisions	What it does
Budapest Convention on Cybercrime (ETS 185, 2001)	Jurisdiction (art 22); consultation where jurisdiction is shared (art 22(5))	Sets the territorial principle as the default, encourages but does not require active-personality jurisdiction, and asks states to consult to settle the most appropriate forum
Criminal Code Act 1995 (Cth), Division 15	Extended geographical jurisdiction, Categories A to D (ss 15.1 to 15.4)	Four graduated extensions of Australian jurisdiction beyond territory, from the narrowest (Category A) to the unrestricted (Category D)
Criminal Code Act 1995 (Cth), Part 10.7	Computer offences; geographical jurisdiction (s 476.3)	Applies Category A extended geographical jurisdiction to the Commonwealth computer offences
Eurojust, Guidelines for deciding 'Which jurisdiction should prosecute?' (revised 2016)	Territoriality, location of the accused, availability of evidence, witnesses, victims, stage and length of proceedings, and further factors	A non-binding checklist of the factors that weigh for and against prosecuting in each candidate state where several have jurisdiction

Attack plan

Attack plan. Work the jurisdiction question in a fixed order so nothing is skipped. First, identify the base or bases of jurisdiction available, starting with territoriality and turning to an extraterritorial base only if territory does not reach the conduct. Second, identify which Division 15 extended category the offence attracts, which for a Part 10.7 computer offence is Category A (s 476.3). Third, ask whether jurisdiction is concurrent or multiple, meaning whether other states can also prosecute the same conduct or separate offences arising from it. Fourth, apply the Eurojust venue factors to choose the most appropriate forum. Fifth, resolve the outcome, whether the state prosecutes or extradites the suspect to a state better placed to prosecute.

The concept of jurisdiction

RULE. Jurisdiction has three distinct senses: jurisdiction to prescribe, jurisdiction to adjudicate and jurisdiction to enforce. A state may prescribe widely but it cannot enforce its law on the territory of another state without that state's permission (Gillespie ch 12).

A claim to jurisdiction is of limited use without custody of the suspect. A state may assert jurisdiction but it can exercise it only once it secures the person, which is why extradition sits at the centre of cross-border prosecution (Gillespie ch 12).

The bases of jurisdiction

RULE. keyring Territorial jurisdiction is the general rule. A state has jurisdiction over a crime that occurs within its geographical borders, and the modern territorial principle reaches conduct that occurs there in whole or in part (Gillespie ch 12).

RULE. Territoriality has a subjective and an objective form. Subjective territoriality attaches where the conduct occurs and objective territoriality attaches where the result occurs, so a single cross-border act can found jurisdiction in more than one state (Gillespie ch 12).

RULE. keyring Beyond territory, international law recognises four grounds of extraterritorial jurisdiction: universal jurisdiction, the protective principle, the active personality principle and the passive personality principle. Any one base suffices to found jurisdiction (Gillespie ch 12).

RULE. Universal jurisdiction may be exercised by any state and is reserved for the most serious offences, reflecting their gravity. It is of little relevance to the everyday cybercrimes in this subject (Gillespie ch 12).

RULE. The protective principle allows a state to reach conduct abroad that threatens its security or an important state interest, such as an attack on military infrastructure. It is available but rarely engaged for ordinary cybercrime (Gillespie ch 12).

RULE. The active personality principle founds jurisdiction on the nationality of the offender and the passive personality principle on the nationality of the victim. Each can be extended to habitual residence, a form sometimes called 'active plus' in the child-exploitation context (Gillespie ch 12).

For most cybercrimes the territorial base is enough because the conduct takes place at least in part within the state's territory. Extraterritorial jurisdiction is invoked rarely, with child sexual exploitation the clearest exception (Gillespie ch 12).

How cybercrime strains the bases

The internet does not defeat traditional jurisdiction so much as multiply its claims. Servers sit in physical territory, so the territorial principle still applies, but a single online act can touch many states at once and generate overlapping claims (Gillespie ch 12). The suggestion that cyberspace is a new international space, like the high seas or outer space, does not hold. Those spaces lie outside all national borders, whereas the internet exists on servers inside states, so treating it as international would require states to surrender sovereignty over their own territory (Gillespie ch 12).

RULE. Cross-border cybercrime usually produces multiple jurisdiction rather than concurrent jurisdiction. Where the same conduct injures machines or victims in several states, the offender commits separate offences in each, so double jeopardy does not bar successive prosecutions (Gillespie ch 12).

Australia's extended geographical jurisdiction

RULE. The Criminal Code provides four graduated levels of extended geographical jurisdiction, Categories A to D, all built on territory but variously widened. Category A is the narrowest and Category D the broadest (Criminal Code Div 15; Urbas 12.15).

RULE. Category A reaches conduct that occurs wholly or partly in Australia, or wholly outside Australia where a result occurs in Australia, or wholly outside Australia where the person is an Australian citizen or an Australian body corporate (Criminal Code s 15.1).

RULE. The computer offences in Part 10.7 attract Category A extended geographical jurisdiction, the narrowest of the four categories. The wider categories drop the Australian connection and are reserved for other offence types (Criminal Code s 476.3; s 15.1).

RULE. Australian citizenship is not required to found territorial jurisdiction over a computer offence. Category A reaches conduct or a result in Australia whoever the offender is, and adds nationality only as a further alternative connection (Criminal Code s 15.1).

The Budapest Convention on jurisdiction

RULE. The Budapest Convention makes the territorial principle its default. Article 22 requires parties to criminalise offences committed within their territory, extends this to their flagged ships and registered aircraft, and invites but does not require active-personality jurisdiction (Budapest art 22).

RULE. compass Where more than one party has jurisdiction over the same offence, article 22(5) requires the parties, where appropriate, to consult to determine the most appropriate jurisdiction for prosecution. It does not list the factors that consultation should weigh (Budapest art 22(5)).

Choosing the forum: the Eurojust factors

Where several states have jurisdiction, the Eurojust guidelines supply the factors that decide which should prosecute. They are a non-binding checklist and the weight of each factor varies with the case. Read them as a compass, because no single factor decides and the needle settles differently in every case (Eurojust guidelines 2016).

The Eurojust factors.

Territoriality leads. A prosecution should presumptively take place where the majority, or the most important part, of the criminality occurred or the loss was sustained, measured in both quantity and importance.
Location of the accused. This includes where the person is found, their nationality or residence, and the possibility of surrender or extradition. Custody of the suspect is what makes a jurisdictional claim effective.
Availability and admissibility of evidence, and the availability of witnesses and victims to give it.
Stage and likely length of proceedings, with resources and relative sentencing powers treated as tie-breakers only.

Division 15 categories compared

Category	Section	Connection required	Reach
Category A	s 15.1	Conduct or a result in Australia, or an Australian citizen or Australian body corporate offender	Narrowest. The Part 10.7 computer offences sit here (s 476.3)
Category B	s 15.2	As Category A, plus offenders resident in Australia	Slightly wider, adding residence as a further connection
Category C	s 15.3	None required as to place, subject to a foreign-law defence	Broad and largely unrestricted, whether or not conduct or result occurs in Australia
Category D	s 15.4	None required, and no foreign-law defence	Broadest. Unrestricted in the same terms as Category C but without the foreign-law defence

Common confusions

Confusion. Concurrent jurisdiction and multiple jurisdiction are not the same. Concurrent jurisdiction is two states able to try the one offence, while multiple jurisdiction is separate offences arising in each affected state. Double jeopardy bars the first from repeat prosecution but not the second (Gillespie ch 12).

Confusion. Extradition to a state the offender never physically visited is not a change in jurisdiction law. It follows from action at a distance over the internet, where uploading files to servers abroad means the conduct occurs there, so no legislative extension of jurisdiction is needed (Urbas 12.17).

Confusion. Category A is an extension of jurisdiction rather than a narrowing of it. It adds nationality and result-based reach on top of territorial jurisdiction, so a foreign offender who attacks an Australian system is still within reach whether or not they are Australian (Criminal Code s 15.1).

Confusion. Budapest article 22(5) does not resolve competing claims. It requires consultation to find the most appropriate forum but it supplies no ranking of factors, which is why the Eurojust guidelines fill the gap in practice (Gillespie ch 12; Budapest art 22(5)).

Debate

The Debate section is the centre of gravity for the research essay, so each strand is set out as a contest with the leading voices named. Each closes with questions to test a position rather than settle it.

Should transnational and extraterritorial jurisdiction be resisted? Arnell and Faturoti argue that the expansion of transnational and extraterritorial jurisdiction over cybercrime should be resisted (Arnell and Faturoti 2023). They ground the argument in five strands: the foundations of international law and state sovereignty, the human rights of the accused including privacy and fair process, the interests of justice, the complexity and cost of extraterritorial prosecution, and the underlying purposes of criminalisation, which they say expansive jurisdiction does not serve. Against that stands the enforcement case, that cybercrime is borderless by nature, so a jurisdiction confined to strict territory would leave an enforcement gap and a real risk of impunity where no single state holds all the pieces (Gillespie ch 12). The essay question is where the line between reach and restraint should fall.

Does the sovereignty objection still hold when the conduct produces a real result inside the prosecuting state?
Which of the five Arnell and Faturoti concerns is hardest for the enforcement case to answer?

Does the internet need a new jurisdictional order? One view treats cyberspace as a new dimension that national law cannot govern, and proposes an international space or an extended International Criminal Court jurisdiction to try cybercrime (Gillespie ch 12). Gillespie rejects both, because the internet sits on servers within states rather than outside all borders, and because an international court could not absorb tens of thousands of cybercrimes a day. The counter-position is that harmonised national laws rather than a new forum are the realistic answer, though even the Budapest Convention shows how hard universal agreement is to reach (Gillespie ch 12).

Is the objection to an international cybercrime court one of principle or only of capacity?
If harmonised national laws are the realistic answer, what does the slow uptake of the Budapest Convention suggest about that path?

Who should prosecute when several states can? The Budapest Convention leaves the choice of forum to consultation without ranking the factors, which Podgor criticises as leaving no coherent system for deciding who prosecutes (Gillespie ch 12). The Eurojust guidelines answer with a structured checklist led by territoriality and the location of the accused (Eurojust guidelines 2016). The McKinnon extradition illustrates the tension, where the United Kingdom held custody but the United States held the harm, the evidence and the witnesses, and the forum was contested for years before the extradition was ultimately refused (Gillespie ch 12).

Is a non-binding checklist enough, or should a treaty rank the factors that decide the forum?
In McKinnon, was custody or connection to the harm the stronger claim to prosecute?

Does custody or harm decide the forum? The practical driver is often custody, because a state that holds the suspect can prosecute at once while a state that holds only the evidence cannot (Gillespie ch 12). Yet the state where the harm and evidence sit may have the stronger substantive claim, as the United States did in McKinnon. The unresolved question is whether the law should privilege the state best placed to enforce or the state most closely connected to the wrong.

Should the law prefer the state that can act now or the state with the closest connection to the crime?
Would a rule that favours the place of harm create incentives that a rule favouring custody does not?

Discussion prompts

Set out the traditional bases of jurisdiction in public international law and explain why territoriality remains the general rule for cybercrime rather than the extraterritorial bases.
Explain how the borderless character of the internet strains the traditional bases of jurisdiction, and assess whether it truly creates a new problem or an old one at greater speed.
Using the Division 15 categories, explain why the Part 10.7 computer offences attract only Category A, and what conduct would fall outside Australian jurisdiction as a result.
Where a cybercrime offence touches several states, explain how a state should decide whether to prosecute or extradite, drawing on the Eurojust factors and the McKinnon example.
Identify the factors that weigh most heavily for, and most heavily against, a state prosecuting a cross-border cybercrime, and argue which should be decisive when they conflict.
Evaluate the Arnell and Faturoti argument that extraterritorial jurisdiction should be resisted against the enforcement-gap case for broad jurisdiction, and defend the position you find stronger.

Check your understanding

Auto-marked drills. Answer, then read the authority in the feedback.