{"id":970,"date":"2022-09-21T16:06:50","date_gmt":"2022-09-21T15:06:50","guid":{"rendered":"https:\/\/www.mediadefence.org\/ereader\/?post_type=publication&p=970"},"modified":"2022-09-22T11:07:10","modified_gmt":"2022-09-22T10:07:10","slug":"types-of-cybercimes","status":"publish","type":"publication","link":"https:\/\/www.mediadefence.org\/ereader\/publications\/modules-on-litigating-freedom-of-expression-and-digital-rights-in-south-and-southeast-asia\/module-7-cybercrimes\/types-of-cybercimes\/","title":{"rendered":"Types of Cybercrimes"},"content":{"rendered":"\n

Data Policy Violations<\/strong><\/em><\/h2>\n\n\n\n

The use of data, including the volume of cross-border data flows, is increasing every year, and this includes personal data.  However, there is a lack of adequate regulations in many countries for the collection and processing of personal information which can have significant ramifications, making data protection laws critical.  In recent years, increasing attention to the issue of data protection has led to a number of Asian states enacting new privacy laws.[footnote]For an overview of regional trends, see Deloitte, \u2018The Asia Pacific Privacy Guide 2020-2021: Stronger Together\u2019(2020) (accessible: https:\/\/www2.deloitte.com\/ph\/en\/pages\/risk\/articles\/asia-pacific-privacy-guide.html<\/a>) and Graham Greenleaf, \u2018Advances in South Asian Data Privacy Laws: Sri Lanka, Pakistan and Nepal\u2019, (2019) Privacy Laws & Business International Report<\/em>, 22-25 (accessible at: https:\/\/papers.ssrn.com\/sol3\/papers.cfm?abstract_id=3549055<\/a>).[\/footnote] However, many states continue to protect individuals\u2019 privacy only inadequately, especially from state surveillance activities.[footnote]Digital Reach, \u2018Digital Rights in Southeast Asia 2021\/2022\u2019, (2022)<\/em> (accessible at: https:\/\/digitalreach.asia\/event\/report-launch-digital-rights-in-southeast-asia-2021-2022\/<\/a>); Smitha Krishna Prasad & Sharngan Aravindakshan (2021) ‘Playing catch up \u2013 privacy regimes in South Asia\u2019, The International Journal of Human Rights<\/em>, 25:1, 79-116, p. 105 (accessible at: https:\/\/www.tandfonline.com\/doi\/full\/10.1080\/13642987.2020.1773442<\/a>).[\/footnote]<\/p>\n\n\n\n

The rise of sophisticated surveillance technologies and the use of biometric technologies without proper safeguards are just some of the many threats to the right to privacy across Asia.  There have, however, been some encouraging judgments in recent years pointing to the willingness of the judiciary in certain states to protect the right to privacy.<\/p>\n\n\n\n

\n

The Supreme Court of India on \u2018Pegasus\u2019 spyware<\/strong><\/h4>\n\n\n\n

In Manohar Lal Sharma v. Union of India<\/em>[footnote]Writ Petition (Crl.) No. 314 of 2021 (India) (2021) (accessible at: https:\/\/main.sci.gov.in\/pdf\/LU\/27102021_082008.pdf<\/a>)[\/footnote] the Supreme Court of India considered the alleged involvement of the Indian government in the unauthorised use of Pegasus spyware software to engage in mass surveillance. The petitioners in Manohar<\/em> (a mix of public interest litigants and those claiming to be victims) alleged that the government\u2019s unauthorised use of Pegasus was a violation not only of rights to privacy but also of freedom of expression due to a \u2018chilling\u2019 effect.[footnote]Id<\/em>. at para 21.[\/footnote] <\/p>\n\n\n\n

The Pegasus software, developed by the Israeli NSO group, infiltrates digital devices and can access and remotely transmit \u201cemails, texts, phone calls, as well as the camera and sound recording capabilities of the device\u201d and can also access its stored data.  In 2018, the research laboratory The Citizen Lab discovered that individuals from over 45 countries were suspected to have been targeted by Pegasus. Reports from further investigative efforts alleged that some 50,000 individuals were under surveillance using this spyware.  The reports suggested that \u201cnearly 300 of these numbers belonged to Indians, many of whom are senior journalists, doctors, political persons, and even some Court staff\u201d.[footnote]Id<\/em>. at paras. 2-3.[\/footnote]<\/p>\n\n\n\n

In response to media revelations, the government of India has offered cagey explanations, with the country\u2019s IT Minister denying illegal use of Pegasus, while not denying actual use of the spyware.[footnote]The Register, \u2018India IT minister denies illegal use of NSO Pegasus spyware\u2019 (2021) (accessible at: https:\/\/www.theregister.com\/2021\/07\/20\/ashwini_vaishnaw_bnso_pegasus_denial\/<\/a>).[\/footnote] This purposeful ambiguity was reflected in the context of the Manohar<\/em> litigation, with the government filing an affidavit containing a blanket denial of the petitioners\u2019 allegations without addressing them in any specificity.[footnote]Writ Petition (Crl.) No. 314 of 2021 (India) (2021) at para 12 (accessible at: https:\/\/main.sci.gov.in\/pdf\/LU\/27102021_082008.pdf<\/a>)[\/footnote] When afforded opportunities to file a further affidavit, the Solicitor General declined, citing national security concerns as the reason for not revealing further information.[footnote]Id<\/em>. at paras. 13-17.[\/footnote]<\/p>\n\n\n\n

The Supreme Court of India reaffirmed its previous holding in Puttaswam<\/em>y[footnote]K.S. Puttaswamy v. Union of India<\/em>, Writ Petition (Civil) No. 494 of 2012 (2018) (accessible at: https:\/\/indiankanoon.org\/doc\/127517806\/<\/a>).[\/footnote] that privacy was \u2018sacrosanct[footnote]Writ Petition (Crl.) No. 314 of 2021 (India) (2021) at para 32 (accessible at: https:\/\/main.sci.gov.in\/pdf\/LU\/27102021_082008.pdf<\/a>) and noted that, between the petitioners and the respondent, there was a \u201cbroad consensus that unauthorised surveillance\/accessing of stored data from the phones and other devices of citizens for reasons other than nation\u2019s security would be illegal, objectionable and a matter of concern.\u201d[footnote]Id<\/em>. at para. 52[\/footnote] The Court also noted that the threat of surveillance impacts how a citizen \u201cdecides to exercise his or her rights\u201d, and may result in self-censorship, a matter of particular gravity for journalists.[footnote]Id<\/em>. at para. 39.[\/footnote] The Court further noted the case\u2019s significance for the protection of journalistic sources.[footnote]Id<\/em>. at paras. 40-41[\/footnote]<\/p>\n\n\n\n

The Court found that, in view of the vagueness of the government\u2019s affidavit, the petitioners had made out a prima facie<\/em> case for examining their allegations and was quite critical of the government for providing inadequate disclosure in a matter pertaining to fundamental rights.[footnote]Id<\/em>. at paras 46 and 51.[\/footnote] The Court rejected the government\u2019s national security rationale for nor revealing any detailed information, noting: \u201cNational security cannot be the bugbear that the judiciary shies away from, by virtue of its mere mentioning.\u201d[footnote]Id<\/em>. at para 49.[\/footnote] Ultimately, the Court declined to order the government to file a further affidavit, considering it had already been granted ample opportunity to do so, and instead ordered the constitution of an Expert Committee headed by a former Supreme Court justice for the purpose of conducting a fact-finding inquiry.[footnote]Id<\/em>. at paras 54-55.[\/footnote] <\/p>\n<\/div><\/div>\n\n\n\n

Courts have found cybercrimes legislation to be overbroad where authorities are granted wide-ranging powers to collect or take down certain categories of data without sufficient safeguards. For example, in 2014, the Supreme Court of the Philippines considered the constitutionality of several sections of the 2012 Cybercrime Prevention Act in Disini et al. v. The Secretary of Justice et al.<\/em>[footnote]G.R. No. 203335 (2014) (accessible at: https:\/\/lawphil.net\/judjuris\/juri2014\/feb2014\/gr_203335_2014.html<\/a>).[\/footnote] The Court upheld many provisions but found several to be unconstitutional because of their overbreadth.  For example, section 19 of the Act, which authorised the Department of Justice to restrict or block access to data that was \u201cprima facie found to be in violation of the provisions of this Act\u201d was deemed to be inconsistent with constitutional guarantees of freedom of expression and freedom from unreasonable searches and seizures. The Court reasoned that \u201cfor an executive officer to seize content alleged to be unprotected without any judicial warrant, it is not enough for him to be of the opinion that such content violates some law, for to do so would make him judge, jury, and executioner all rolled into one\u201d.<\/p>\n\n\n\n

Another of the provisions of the Act deemed unconstitutional was section 12, which authorised law enforcement authorities to \u201ccollect or record by technical or electronic means traffic data in real-time associated with specified communications transmitted by means of a computer system\u201d with \u2018traffic data\u2019 being defined as \u201cthe communication\u2019s origin, destination, route, time, date, size, duration, or type of underlying service, but not content, nor identities\u201d. The section also required service providers to \u201ccooperate and assist law enforcement authorities in the collection or recording\u201d of the traffic data. In finding the provision to be overbroad, the Court reasoned as follows:<\/p>\n\n\n\n

Due cause is also not descriptive of the purpose for which data collection will be used. Will the law enforcement agencies use the traffic data to identify the perpetrator of a cyber attack? Or will it be used to build up a case against an identified suspect? Can the data be used to prevent cybercrimes from happening?<\/p>

The authority that Section 12 gives law enforcement agencies is too sweeping and lacks restraint. While it says that traffic data collection should not disclose identities or content data, such restraint is but an illusion. Admittedly, nothing can prevent law enforcement agencies holding these data in their hands from looking into the identity of their sender or receiver and what the data contains. This will unnecessarily expose the citizenry to leaked information or, worse, to extortion from certain bad elements in these agencies.<\/p>

Section 12, of course, limits the collection of traffic data to those “associated with specified communications.” But this supposed limitation is no limitation at all since, evidently, it is the law enforcement agencies that would specify the target communications. The power is virtually limitless, enabling law enforcement authorities to engage in [a] “fishing expedition,” choosing whatever specified communication they want. This evidently threatens the right of individuals to privacy.<\/p><\/blockquote>\n\n\n\n

The recognition at the national level of a right to privacy and its extension to the digital realm follows the rapid growth in adoption of data protection legislation around the world since the entry into force of the European Union\u2019s General Data Protection Regulations (GDPR<\/a>) in 2018.  The GDPR has set a new standard for the protection of personal data online and has served as a template for numerous other countries\u2019 legislation.  The California Consumer Privacy Act (CCPA) likewise has sweeping rules regarding consumers\u2019 rights to know what personal information is being collected from them, to request deletion of their data, and to opt out of data collection.[footnote]Forbes, \u2018California Begins Enforcing Broad Data Privacy Law \u2013 Here\u2019s What You Should Know\u2019 (2020) (accessible at: https:\/\/www.forbes.com\/sites\/siladityaray\/2020\/07\/01\/california-begins-enforcing-broad-data-privacy-law—heres-what-you-should-know\/?sh=1279e683de5c<\/a>).[\/footnote] Because of its application to the technology sector of Silicon Valley, the CCPA has also been lauded for advancing the state of data protection globally.[footnote]The Guardian, \u2018California’s groundbreaking privacy law takes effect in January. What does it do?\u2019 (2019) (accessible at: https:\/\/www.theguardian.com\/us-news\/2019\/dec\/30\/california-consumer-privacy-act-what-does-it-do<\/a>).[\/footnote]<\/p>\n\n\n\n

Criminalisation of Online Speech<\/em><\/strong><\/h2>\n\n\n\n

Cybercrimes legislation often seeks to deal with a wide range of illegal or harmful content that is posted online.  This may include incitement to terrorism, hate speech, sexually explicit content such as child pornography, and content which breaches intellectual property rights.[footnote]Article 19, \u2018Freedom of Expression and ICTs\u2019 (2018) (accessible at: https:\/\/www.article19.org\/wp-content\/uploads\/2018\/02\/FoE-and-ICTs.pdf<\/a>).[\/footnote] <\/p>\n\n\n\n

This is often the area in which such legislation conflicts most severely with the right to freedom of expression and the right to information.  Any restrictions on these rights must meet the requirements listed under Article 19(3) of the ICCPR: namely that restrictions be provided by law and necessary for one of the exhaustive list of legitimate purposes (to respect the rights or reputations of others or protect national security or of public order, or of public health or morals). In 2011, the UN Special Rapporteur on Freedom of Expression listed the following examples of kinds of expression the restriction of which would fall under these legitimate purposes: (a) child pornography; (b) direct and public incitement to commit genocide; (c) hate speech; (d) defamation; and (e) incitement to discrimination, hostility or violence.[footnote]United Nationals Special Rapporteur on the Right to Freedom of Opinion and Expression, Frank La Rue, (2011) para 25 (accessible at: https:\/\/www2.ohchr.org\/english\/bodies\/hrcouncil\/docs\/17session\/A.HRC.17.27_en.pdf<\/a>).[\/footnote]<\/p>\n\n\n\n

Even legislation that does criminalise these forms of expression needs to be precise, have adequate and effective safeguards against abuse or misuse in order to meet the requirements of legality and necessity. For example, in the case of restrictions on child pornography, the Special Rapporteur noted that the safeguards should include oversight and review by an independent and impartial tribunal or regulatory body.[footnote]Id.<\/em> at para. 71.[\/footnote] In 2018, the Special Rapporteur stated: \u201cBroadly worded restrictive laws on \u201cextremism\u201d, blasphemy, defamation, \u201coffensive\u201d speech, \u201cfalse news\u201d and \u201cpropaganda\u201d often serve as pretexts for demanding that companies suppress legitimate discourse.\u201d[footnote]United Nations Special Rapporteur on the Right to Freedom of Opinion and Expression, (2018) para 13 (accessible at: https:\/\/freedex.org\/wp-content\/blogs.dir\/2015\/files\/2018\/05\/G1809672.pdf<\/a>.)[\/footnote]<\/p>\n\n\n\n

Criminalisation of online speech can occur through the application of cybercrime legislation or through the application of non-internet-specific criminal provisions.  A 2017 report by the Association for Progressive Communications comparing India, Malaysia, Myanmar, Pakistan and Thailand\u2019s laws found:<\/p>\n\n\n\n

All these states either have laws that target cyberspace specifically (along with legal provisions that affect online speech), or they are moving towards such a law. All of these states also utilise offline laws to criminalise and punish online speech. Most of them also utilise multiple legal provisions to target and criminalise a single instance of online speech. They also prescribe harsher punishments for online \u201coffences\u201d than for offline speech.[footnote]Association for Progressive Communications, \u2018Unshackling expression: A study on laws criminalising expression online in Asia\u2019 (2017) at p. 25 (accessible at: https:\/\/www.giswatch.org\/sites\/default\/files\/giswspecial2017_web.pdf<\/a>).[\/footnote]<\/p>

Association for Progressive Communications, \u2018Unshackling expression: A study on laws criminalising expression online in Asia<\/a>\u2019 (2017) at p. 25<\/p><\/blockquote>\n\n\n\n

For more on the criminalisation of online speech, see Module 3<\/a> of Media Defence\u2019s Advanced Modules on Digital Rights and Freedom of Expression Online.<\/p>\n\n\n\n

Cyberstalking and Online Harassment<\/em><\/strong><\/h2>\n\n\n\n

Online harassment is becoming increasingly prevalent with the spread of social media, which can provide especially fertile ground for it.  Cyberstalking is undue harassment and intimidation through electronic communications, such as text messages, phone calls or social media posts, and it can severely restrict the enjoyment by the victims of their rights online, particularly if they come from vulnerable and marginalised groups, including women and members of sexual minorities.  Research has shown that online harassment is often focused on personal or physical characteristics, with political views, gender, physical appearance and race being among the most common.[footnote] Pew Research Center, \u2018Online harassment 2017, (2017), (accessible at: https:\/\/www.pewresearch.org\/internet\/2017\/07\/11\/online-harassment-2017\/).<\/a>[\/footnote] Furthermore, women encounter sexualised forms of online harassment at much higher rates than men.[footnote]Id<\/em>.[\/footnote]<\/p>\n\n\n\n

\n

A worrying new trend: non-consensual dissemination of intimate images<\/strong><\/h4>\n\n\n\n

A particular form of online harassment that has emerged as a concerning new trend is the non-consensual public sharing online of private and sexually explicit images, mostly of women, often by former partners in retaliation for a break-up or other falling out, or for the purposes of extortion, blackmail or humiliation.  However, the cybercrimes legislation in only a few countries specifically provides for offences related to non-consensual dissemination of intimate images (NCII), often leaving victims with insufficient recourse against perpetrators due to gaps in legal protection.[footnote]For example, India\u2019s legislative regime on NCII has been criticised as being underdeveloped. See for example, Vaishnavi Sharma, \u2018Understanding Non-Consensual Dissemination of Intimate Images Laws in India with Focus on Intermediary Liability\u2019 14 NUJS L. Rev. 4 (2021) (accessible at: http:\/\/nujslawreview.org\/wp-content\/uploads\/2022\/03\/14.4-Sharma-1.pdf<\/a>).[\/footnote] The Philippines[footnote]Anti-Photo and Video Voyeurism Act of 2009, <\/em>Republic Act No. 9995 at section 4 (accessible at: https:\/\/www.lawphil.net\/statutes\/repacts\/ra2010\/ra_9995_2010.html<\/a>).[\/footnote] and Singapore[footnote]Penal Code of 1871 (as of 15 June 2022) at section 377BC(1)(a) (accessible at: https:\/\/sso.agc.gov.sg\/Act\/PC1871?ProvIds=pr377BC-#pr377BC-<\/a>)  Prior to the introduction of this offence, certain NCII cases were prosecuted under the now repealed section 509 of the Penal Code which criminalised certain acts against the \u2018modesty\u2019 of women. See for example, Ang Zhu Ci Joshua v. Public Prosecutor<\/em>, [2016] SGHC 143 (2016) (accessible at: https:\/\/www.elitigation.sg\/gdviewer\/s\/2016_SGHC_143<\/a>).[\/footnote] are examples of exceptions to this, with both states\u2019 having specifically criminalised NCII.<\/p>\n\n\n\n

The importance of a name<\/strong><\/h5>\n\n\n\n

The non-consensual dissemination of intimate images is often referred to as \u2018revenge porn\u2019.  However, activists and researchers have universally rejected the term as being misleading.[footnote]GenderIT, \u2018”Revenge Porn”: 5 important reasons why we should not call it by that name\u2019 (2019) (accessible at: https:\/\/www.genderit.org\/articles\/5-important-reasons-why-we-should-not-call-it-revenge-porn<\/a>).[\/footnote] Firstly, the word \u2018revenge\u2019 implies that the victim has committed a harm worth seeking revenge for. Secondly, \u2018porn\u2019 conflates the practice with the consensual production of content for mass consumption, which NCII decidedly is not.  Thirdly, the term \u201crepackages an age-old harm as a new-fangled digital problem,\u201d belying the long history that exists of images of women being distributed non-consensually across a range of mediums.[footnote]Id<\/em>.[\/footnote] Lastly, the term oversimplifies the offence by ignoring a range of aggressors and motivations and invoking a moralist reaction against the victim.[footnote]Association for Progressive Communications, \u2018Online gender-based violence: A submission from the Association for Progressive Communications to the United Nations Special Rapporteur on violence against women, its causes and consequences\u2019 (2017) at p.21 (accessible at: https:\/\/www.apc.org\/sites\/default\/files\/APCSubmission_UNSR_VAW_GBV_0_0.pdf<\/a>)).[\/footnote]<\/p>\n<\/div><\/div>\n\n\n\n

Ongoing harassment and attacks on members of the media have also become a particularly worrying trend.<\/p>\n\n\n\n

Cyberbullying<\/em><\/strong><\/h2>\n\n\n\n

It is also worth noting that the crime of cyberbullying, which is the sending of intimidating or threatening messages, often via social media, and which is prevalent among children and young adults.  According to the United Nations Children\u2019s Fund (UNICEF<\/a>):<\/p>\n\n\n\n

\u201c[Cyberbullying] can take place on social media, messaging platforms, gaming platforms and mobile phones.  It is repeated behaviour, aimed at scaring, angering or shaming those who are targeted.  Examples include:<\/p>

– spreading lies about or posting embarrassing photos of someone on social media;<\/p>

– sending hurtful messages or threats via messaging platforms;<\/p>

– impersonating someone and sending mean messages to others on their behalf.<\/p>

Face-to-face bullying and cyberbullying can often happen alongside each other.  But cyberbullying leaves a digital footprint \u2014 a record that can prove useful and provide evidence to help stop the abuse.\u201d<\/p><\/blockquote>\n\n\n\n

The scale of the problem is significant and growing.  A study by UNICEF and the UN Special Representative of the Secretary-General (SRSG) on Violence against Children<\/a> found that one in three young people in 30 countries reported being a victim of online bullying.[footnote]UNICEF, \u2018UNICEF poll: More than a third of young people in 30 countries report being a victim of online bullying\u2019 (2019) (accessible at: https:\/\/www.unicef.org\/press-releases\/unicef-poll-more-third-young-people-30-countries-report-being-victim-online-bullying<\/a>).[\/footnote]<\/p>\n\n\n\n

\n

Cyberbullying Legislation in the Philippines<\/strong><\/h4>\n\n\n\n

The Philippines has sought to address cyberbullying among children through the Anti-Bullying Act of 2013.[footnote]The Republic Act No. 10627 (accessible at: https:\/\/lawphil.net\/statutes\/repacts\/ra2013\/ra_10627_2013.html<\/a>).[\/footnote] The law requires that primary and elementary schools adopt an anti-bullying policy and creates annual reporting requirements for schools and school boards. Under section 2(d), \u2018bullying\u2019 is defined as including: \u201cCyber-bullying or any bullying done through the use of technology or any electronic means.\u201d This is an innovative approach which may be contrasted with the normally overbroad approach taken in some countries of trying to criminalise cyberbullying.<\/p>\n<\/div><\/div>\n\n\n\n

Other Violations<\/em><\/strong><\/h2>\n\n\n\n

The Budapest Convention on Cybercrime<\/a> defines the following types of cybercrimes:<\/p>\n\n\n\n