A systematic literature review on cybercrime legislation

Stage 1. Planning the review

The PRISMA analysis was applied including the suggested phases³ during the data collection and data processing such as identification, screening, eligibility and included (see the detailed description in Table 2). The efficiency and effectiveness of the keyword search was investigated by the measurement of the relative number of articles which are relevant when the search was conducted by the additional keywords. If there is no increase in the relevant papers after adding the additional keywords, it is considered that the initial keyword used is valid. Once research questions and hypotheses are formulated, a topic modelling approach has been used to uncover the main topics which are then re-analyse to answer the research questions.

Stage 2. Identifying and evaluating studies

Primary study was done by using selected keywords to discover research trends of cybercrime legislation through systematic review from seven academic databases. To answer the research questions, keywords were selected by using AND and OR such as “cybercrime” OR “cyber-crime” OR “legislation” AND “combating”. The search platforms used were ACM Digital Library, Emerald, Hein Online, ProQuest, ScienceDirect, Scopus, and Westlaw Asia. The searches were conducted by using the keywords as stated above on these search backgrounds and filtered through the exclusion/inclusion criteria as stated in Table 2.

Inclusion and exclusion criteria

The empirical findings on case studies and cybercrime legislations and commentaries on the application and implementation of legislation in combating cybercrime are included in the studies. All the studies were written in English and peer-reviewed. The details of criterion for inclusion and exclusion can be seen in the table below.

The above criteria was adopted in order to select the papers to be used for this SLR analysis. To be selected in the study, the paper needs to fulfil all the criteria stated as inclusion and the paper will be excluded if it fulfils one of the excluded criteria.

Keywords combination

To identify the right set of key words and achieve the research objectives, seven electronic research databases such as ACM Digital Library, Emerald, Hein Online, ProQuest, ScienceDirect, Scopus and Westlaw Asia were searched by using the main keywords such as “cybercrime”, “cybercrime” AND “legislation”, “cybercrime” AND “legislation” AND “combating”, “cybercrime” AND “legislation” AND “cybersecurity”, and lastly “cybercrime” AND “legislation” AND “cybersecurity” AND “combating”. Searches were conducted until no new studies were identified within the scope of selected criteria

Validation of keywords search

A total of (72) studies were identified from the search of primary keywords in the databases as stated in Table 3. It was then reduced to (64) once duplicate studies were removed. By applying the inclusion/exclusion criteria, the papers were reduced to (56). All these (56) papers were analysed in detail and again the inclusion/exclusion method was applied and reduced to (46). These selected (46) papers were then reviewed in full and assessed for eligibility to be included in this SLR review. Further¹⁶ papers were excluded for focusing on irrelevant issues and too general in nature. Finally, (30) papers were selected and used in this study.

Stage 3. Extracting and synthesising data

All the selected papers then had their data extricated to evaluate the comprehensiveness of information to achieve the research objectives. The extraction process also provides the details of the studies for review and to be specific about how the paper can address the research question. It was done based on the selection process as discussed above. The data extracted are then categorised and then recorded in a worksheet.

Thematic synthesis was used as recommended by⁴ to synthesize the results. An integrated approach to the synthesis process also was used to ensure that all the research objectives were achieved. The findings are described in the following section. Table 3 explains the number of papers at each phase of the process by the keywords search changes on each of the data platforms to focus on the final selection of papers.

Findings

A substantial number of papers connected to cybercrime were identified based on the initial keyword searched. After going through the section process, only (30) papers were identified and analysed in detail. All the selected papers were read in full and relevant data were extracted and summarised in the table below. All primary studies focused on legislation relating to cybercrime in combating it.

RQ1: What is the legislation to combat cybercrime?

Through the first research question (What is the legislation to combat cybercrime?) (Table 1), it was aimed to identify the common legislation used to charge the cybercriminals. It is vital to note that this systematic literature review intends to focus on legislation used to combat cybercrime and no other type of legislation and thus the selection process focuses solely on the studies relating to cybercrime legislation. There are a number of studies regarding cybercrime in general and other aspects of it. However, studies on cybercrime legislation itself is very much limited.

There are a few international or regional instruments as stated in Table 5. The Convention on Cybercrime which is also known as Budapest Convention is the first and only binding international instrument on cybercrime and it also serves as a basic guideline for any country which is developing cybercrime related legislation to combat cybercrime.⁵ However, not all the countries are a party or signatory to these conventions and harmonise with the international instruments (Table 4). Although the Convention is under the auspices of the European Council, it is open to all the countries. The Convention focuses on Cybercrime & electronic evidence and provides a comprehensive, operational and functional solution for the investigation and prosecution of cybercrime both domestically and between Parties, with a global reach.

In addition to these international instruments, there are Model cybercrime laws which propose to implement the best practice principles of substantive offences expressed by the Convention. Model Laws are usually developed by international organisations through the inter-governmental process of negotiations and formal procedure. Apart from the Commonwealth Model Law, the rest of the Model Laws did not go through the inter-governmental process. The table below explains the Model Laws currently implemented.

These ITU-EU led Models assisted the countries in Caribbean, Pacific and Sub-Sharan Africa region in drafting and adopting the legislation relating to cybercrime.⁶ Their framework is based upon Commonwealth Model Law which is based upon the Budapest Convention. The common thing is to improve the legal framework of cybercrime legislation and create awareness on the importance of criminalising and adopting a specialised cybercrime law. In essence, these Models assist the countries in harmonising their legislation on cybercrime and attempt to redefine many aspects of cybercrime and jurisdictional matters.⁷

The United States and the European Union criminal law are on the same path relating to criminal offences in cyberspace.⁸ In fact, all countries should aim to pursue a common criminal policy in order to deter the cybercriminals effectively by coordinating in facilitating the detection of cybercrime, collecting the evidence, investigating and finally prosecuting the case successfully. Cybercrime has been on the rise due to the fact that there are loopholes in both national and international legislation that the existing legal framework cannot deter or effectively combat the rise of cybercrimes.

Based on the data retrieved from the United Nations Conference on Trade and Development,⁹ a total of 154 countries have already enacted the cybercrime legislation whereas 13 percent of countries in the world do not have any legislation relating to cybercrime and 5% of countries have draft legislation. There was no data found on the two percent of countries (Figure 3).

Figure 3. Percentage of countries with cybercrime legislation.

In the Africa region of 54 countries, 39 countries (72%) have cybercrime legislation, two countries (4%) have draft legislation, 12 countries (22%) do not have legislation and there is no data for one country (2%). (Siyanda, 2019) (Figure 4).

Figure 4. Cybercrime legislation in Africa region.

In the Americas which include 35 countries, 30 countries (86%) have cybercrime legislation, 1 country (3%) has draft legislation, and 4 countries (11%) do not have legislation (Figure 5).

Figure 5. Cybercrime legislation in Americas region.

In the Asia Pacific region with 60 countries, 46 countries (77%) have legislation, seven countries (12%) have draft legislation, and seven countries (12%) do not have legislation (Figure 6).

Figure 6. Cybercrime legislation in Asia-Pacific regio.

In Europe, out of 45 countries, 40 countries (89%) have legislation, three countries (7%) do not have legislation and no data for two countries (4%) (Figure 7).

Figure 7. Cybercrime legislation in Europe region.

Even among the least developed countries, 31 countries (66%) have legislation, four countries (9%) have draft legislation and 12 countries (26%) have no legislation. Based on these statistics, it can be concluded that the majority of the countries in the world do have legislation relating to cybercrime. However, these legislations are obviously not efficient in deterring or combating the cybercrime effectively and the number of cybercrime cases have been on the rise constantly.

Different jurisdictions have used different types of legislation in charging/prosecuting the cybercriminals.¹⁰ Some jurisdictions have specified cybercrime legislations and some had only relied on the legislation intended for traditional crimes. The table below shows an overview of the list of countries which have cybercrime legislation in English. Countries with the cybercrime bill, cybercrime draft legislation and cybercrime related legislation in non-English languages are excluded. It is essential to note that some jurisdictions used cybercrime as computer or digital crime. There are ways to improve the existing legislation relating to cybercrime and almost half of all published studies suggest harmonising national law with international law.

RQ2: How is the legislation used to combat cybercrime?

Legislation plays a major role in combating cybercrime and empowering the authority in dealing with the challenges posed by cybercrime (Table 6). Legislation involves both the national and international law relating to cybercrime. While traditional legislation focuses on physical objects, cybercrime is largely associated with data or information which are electronic in nature and thus traditional law cannot be used effectively in combating cybercrime.¹¹ Thus, national laws need specialised legislation to criminalise cybercrime.

With the exception of spam offences, most of the jurisdictions in some western and European countries have criminalised and imposed criminal penalty on cybercrime cases such as misusing of computer tools and towards racism, xenophobia and online solicitation or exploitation of children.¹² However, the penalties imposed are not strong enough in deterring the cybercriminals from committing the crimes in cyberspace that there is a constant rising of cybercrime cases around the world.¹³ Cybercrimes relating to integrity, confidentiality and accessibility of computer systems are mostly regarded as specific cyber offenses in many jurisdictions, whereas offences such as fraud, breach of privacy and identity offences are regarded as general cyber offences.¹⁴ Those countries which impose criminal penalties or criminalise cybercrime use different methodology in application such as Finland regulates cyber offences via the new chapters of penal code. The evolving nature of cybercrime cannot be controlled efficiently unless the legislation is updated enough to be used to investigate, prosecute and adjudicate the cybercrime offenders. The cooperation from the internet service providers and internet industry players also play a crucial part in order for the law enforcement officers to detect, prevent and respond to the cybercrimes. Thus it is material that effective and updated legislation in par with the rapid advancement of technology must be in place in order to combat ever rising cybercrime globally. With this view in mind, the United States House of Representative Tom Graves sponsored a bill named Active Cyber Defense Certainty (“ACDC”) Act to update the Computer Fraud and Abuse Act under which the organisations can take active measures to go beyond the boundaries of their own networks. Procedural laws should also be enhanced or amended to ensure that issues related to cybercrime such as digital evidences are to be easily collected, stored and presented at the Court without any difficulty like any other traditional crimes.¹⁵ Urgent International collaboration is needed to take every possible approach to criminalise all types of cybercrimes and to adopt specific procedural rules and investigation powers to investigate and prosecute cybercrimes specifically (Figure 8).¹⁶

Figure 8. Essential Instruments Involved in Combating Cybercrime.

In the United Kingdom, the Computer Misuse Act 1990 which has been amended several times imposes criminal sanctions for cybercrime. Also under the Serious Crime Act 2015, criminal penalties can be imposed for an unauthorised act of causing serious damage to security or to the economy of the country. Even though the purpose is to punish and deter the criminals from committing the cybercrime, it does not deter the cybercriminals effectively since there still is a constant rise in cybercrime cases.¹⁷

Thus, to use legislation as an effective tool to combat cybercrime, cybercrime legislation must cover an extensive list of offences committed in cyberspace like some jurisdictions focus only on selective cybercrimes such as child pornography and child protection as criminal offences.¹⁸ Only a limited number of jurisdictions address and impose the duty on the service providers to monitor and voluntary supply of information as well as taking down the notifications and liability of access. Eighty percent of European countries have criminalised the cybercrimes compared to the other parts of the world whereas approximately only sixty percent of these countries criminalise the cybercrimes.^19,20

RQ3: What are the other approaches taken to combat cybercrime?

In addition to the enhancement of existing legislation, there is also a necessity to focus on the development of methodological manuals on the investigation of cyber related crimes in law enforcement. A substantial number of primary studies suggest that public awareness, technical approaches and ethical online education are as important as having efficient legislation in combating cybercrime. There is also a need for the international community to come together as one united nation to voice and be united in combating this cybercrime.

Even with the best possible legal framework, to address the technical vulnerabilities, private sectors must also contribute in fighting the rise of cybercrime by addressing technological vulnerabilities in the system and collaborating in operating the system with other jurisdictions. With the rapid development of technology, it is imperative to prevent and combat cybercrime by both public and private sectors. The role played by the criminal justice system is also important and thus have to ensure that justice officers are well equipped with the latest technology development. Thus, it is important to have cybercrime strategies in order to meet the challenges of law enforcement and prosecution. Raising public awareness of cybercrime, cooperation of private-public partnerships, criminal law enforcement and justice capacity are the areas that should be addressed as the cybercrime strategies. The importance of raising public awareness of cybercrime was highlighted in the United Nations Guidelines for Prevention of Crime. Most jurisdictions are aware of the importance of raising public awareness of cybercrime and engage in awareness campaigns.^21,22