Introduction of cryptocurrency and hacking offences to Parliament

The Crimes Legislation Amendment (Ransomware Action Plan) Bill 2022 (Bill) seeks to amend the Criminal Code Act 1995 (Criminal Code), the Crimes Act 1914 and the Proceeds of Crime Act 2002 to bring historical legislation into the modern state of play as it relates to threats of ransomware.  The new powers under this Bill complement existing search and seizure powers, which we have previously considered here.

Geographical considerations

Importantly, at the outset, the Bill does away with geographical constraints upon offending.  Whilst it may have been the case that to be charged with a cyber type of offence the offending would need to have occurred within Australia, the Bill introduces an ‘impact-focused’ method of determining jurisdiction.  That is, instead of focusing on the location at which the offending occurs, the Bill is concerned of the location upon which the offending impacts.

Where the conduct constituting the alleged offence occurs wholly outside Australia and it constitutes an offence relating to unauthorised:

• access to data;
• modification of data;
• impairment of electronic communication of data to or from a computer; or
• impairment of the reliability, security or operation of any data; and

the data is under the control of an Australian person or corporation and is reasonably capable of being accessed within Australia, an offender will not escape liability for the offence based on the geographical externality to Australia.^[1]

Cryptocurrency seizures

Schedule 3 of the Bill inserts various sections into the Crimes Act 1914.  Arguably, most interestingly amongst them is section 1, which inserts section 3C(1) to define a digital asset and its seizure as follows:

“digital asset means:

• a digital representation of value or rights (including rights to property), the ownership of which is evidenced cryptographically and that is held and transferred electronically by:
• a type of distributed ledger technology; or
• another distributed cryptographically verifiable data structure; or
• a right or thing prescribed by the regulations;

but does not include any right or thing that, under the regulations, is taken to be a digital asset for the purposes of this Part.

seize, for a digital asset, has a meaning affected by subsection 3FA(3).”

 The legislative definition does not outright state ‘cryptocurrencies’, but it is perfectly clear for all who read that it is indeed such currency which is being referred to.  Indeed, a cryptocurrency is a digital representation of value with ownership cryptographically evidenced and is tradeable on distributed ledge technology.

Therefore, it is prudent to consider the circumstances in which this Bill would allow the government to seize cryptocurrencies.

If a warrant is in force in relation to either a premises or a person, an executing officer may seize a digital asset if:

• in the course of exercising the warrant, the officer finds one or more things that suggest the existence of the digital asset; and
• the officer suspects the digital asset to be:
  • evidential material in relation to an offence to which the warrant relates; or
  • evidential material in relation to another offence that is an indictable offence; or
  • evidential material or tainted property; and
• the officer reasonably suspects that seizing the digital asset is necessary to prevent its concealment, loss or destruction, or its use in committing an offence.^[2]

It is clear that there needs to be a sufficient connection between the digital asset and an offence before an officer is authorised to seize the digital asset.  Where an officer is authorised to do so by transferring the digital asset from an existing digital wallet to a digital wallet controlled by the Australian Federal Police.^[3]  Notably, the Explanatory Memorandum to the Bill indicates that an officer is not confined merely to the above method of seizing digital assets.^[4]  It appears Parliament intends to provide very broad powers to officers, in certain circumstances, to seize digital assets.

Hacking offences

The Bill establishes an offence of data extortion with penalty of imprisonment of ten (10) years.  Where a person without authorisation accesses, modifies or impairs data held in a computer and then, via a carriage service, makes a threat to the owner of the data compelling them to do or omit to do an act.^[5]

The Bill also established an offence of dealing with data.  Where a person obtains, accesses, modifies or releases data by use of a carriage service and was not authorised to access or modify said data, they will have committed an offence and be liable for five (5) years imprisonment.^[6]

The most severe penalty for offending introduced by the Bill is in relation to aggravated computer offences, whereby an offender may be liable to twenty-five (25) years imprisonment.  Where an offender commits an underlying offence, such as unauthorised access or modification, but that act is targeted directly or indirectly towards ‘critical infrastructure’, it will be considered aggravating offending.^[7]  Critical infrastructure is expansively defined under section 9 of the Security of Critical Infrastructure Act 2018.

Takeaways

The Bill provides a novel power for law enforcement to seize digital assets such as cryptocurrencies and provides further protection against cyber crimes via the introduction of more severe penalties and the removal of geographical constraints, which may otherwise have created difficulty in prosecuting international offenders.

Links and further references

Legislation

Crimes Act 1914

Crimes Legislation Amendment (Ransomware Action Plan) Bill 2022

Criminal Code Act 1995

Explanatory Memorandum to Crimes Legislation Amendment (Ransomware Action Plan) Bill 2022

Proceeds of Crime Act 2002

Security of Critical Infrastructure Act 2018

Further information about cryptocurrency seizure and hacking offences

If you need advice on cryptocurrency seizure and hacking offences, contact us for a confidential and obligation-free discussion:

Disclaimer

This article contains general commentary only.  You should not rely on the commentary as legal advice.  Specific legal advice should be obtained to ascertain how the law applies to your particular circumstances.

[1] Bill section 1 introducing section 476/3 to the Code.

[2] Bill Schedule 3 section 7 inserting section 3FA(1) and (2) into the Crimes Act 1914; Bill Schedule 3 s 11 inserting section 288A(1) in the Proceeds of Crime Act 2002.

[3] Bill Schedule 3 section 7 inserting section 3FA(3) into the Crimes Act 1914; Bill Schedule 3 s 11 inserting section 288A(2) in the Proceeds of Crime Act 2002.

[4] Explanatory memorandum at [144].

[5] Bill Schedule 1 section 2 inserting section 477.4 into the Criminal Code.

[6] Bill Schedule 1 section 2 inserting section 478.5 into the Criminal Code.

[7] Bill Schedule 1 section 12 inserting sections 479.1 and 479.2 into the Criminal Code.

---

Related insights about cryptocurrency seizure and hacking offences