Introduction
In today's world, it is hard to imagine life without the internet. We use it for everything from talking to family and friends to banking and shopping. While this digital revolution has brought many benefits, it has also created new opportunities for crime and new threats to our security. Criminals and even hostile states can now act from anywhere in the world, targeting individuals, businesses, and the country itself. This creates a significant challenge for the law, which must find ways to prevent these crimes and protect the public without undermining our fundamental freedoms.
This essay will explore some of these emerging security threats in the digital age. It will focus on the legal responses developed in the United Kingdom, particularly the laws designed to tackle cybercrime and to allow for state surveillance. The essay will consider how effective these laws are in preventing crime and pursuing a peaceful society. It will argue that while the UK has created a powerful legal framework, these laws are in a constant race against technological change and create a difficult but necessary debate about the right balance between national security and personal privacy.
The Nature of Digital Security Threats
The threats posed by the digital age are varied and constantly evolving. They range from individual acts of fraud to coordinated attacks on a national scale. For the purpose of this essay, two key areas will be considered: cybercrime and the online dissemination of terrorist material.
Cybercrime can be broadly categorised into two types: cyber-dependent crimes, which can only be committed using a computer, and cyber-enabled crimes, where technology is used to facilitate traditional offences like fraud or theft.¹ A primary example of a cyber-dependent crime is hacking, where an individual gains unauthorised access to a computer system. This is often a precursor to other crimes such as data theft or causing damage to a system. The scale of this problem is significant; the Office for National Statistics reported an estimated 2 million computer misuse offences in the year ending December 2023.² This demonstrates that digital crime is not a niche issue but a widespread threat affecting millions.
A second major threat is the use of the internet by terrorist organisations. These groups use social media and encrypted messaging apps to spread propaganda, radicalise and recruit new members, and plan attacks.³ This creates a difficult problem for law enforcement, as they must monitor vast amounts of online content to identify and intercept these threats, which are often hidden in private, encrypted communications.
Legal Response 1: Tackling Cybercrime
The UK’s primary piece of legislation for tackling cybercrime is the Computer Misuse Act 1990 (CMA). This Act was created before the public had widespread access to the internet, but its core principles still form the basis of how such crimes are prosecuted today. The Act created three main offences:
- Unauthorised access to computer material (s 1). This is the basic hacking offence.
- Unauthorised access with intent to commit or facilitate commission of further offences (s 2). This covers situations where someone hacks a system to steal data or commit fraud.
- Unauthorised acts with intent to impair, or with recklessness as to impairing, operation of a computer (s 3). This offence covers the creation and distribution of viruses or carrying out denial-of-service (DoS) attacks.
The CMA 1990 has been amended several times to try and keep it relevant. For example, the Serious Crime Act 2015 introduced a new offence of causing serious damage, such as to national security or human welfare, with a maximum sentence of life imprisonment.⁴ However, the Act has been criticised for being outdated. The Law Commission has noted that the law can be unclear and may not be keeping pace with technological developments, such as the growth of cloud computing and the use of anonymising software by criminals.⁵ The international nature of cybercrime also poses a significant challenge. An attacker could be based anywhere in the world, making investigation and prosecution under UK law extremely difficult, though international agreements like the Budapest Convention on Cybercrime aim to foster cooperation between nations.⁶
Legal Response 2: Surveillance and the Pursuit of Peace
To prevent serious crimes like terrorism and large-scale cyber-attacks, the state argues it needs powers to monitor communications. In the UK, these powers are now primarily governed by the Investigatory Powers Act 2016 (IPA), often referred to by critics as the ‘Snoopers’ Charter’. This Act authorises the security services and police to carry out a range of surveillance activities, including intercepting communications (reading emails or listening to calls) and acquiring communications data (the ‘who, when, and where’ of a communication, such as a list of visited websites).⁷
The government’s justification for these powers is that they are essential for preventing crime and protecting national security in an age where criminals and terrorists use sophisticated encryption to hide their activities. However, the IPA 2016 is one of the most controversial pieces of legislation in recent UK history. It has faced significant legal challenges from civil liberties groups, who argue that its powers are excessive and violate fundamental human rights, particularly the right to a private and family life under Article 8 of the European Convention on Human Rights (ECHR).
In the case of Big Brother Watch and Others v United Kingdom, the European Court of Human Rights found that the UK’s previous surveillance regime, a precursor to the IPA 2016, had breached Article 8 because it lacked sufficient safeguards to prevent abuse of these powerful capabilities.⁸ The court was concerned that the bulk interception of data did not have enough independent oversight. While the IPA 2016 introduced a ‘double-lock’ system requiring warrants to be approved by both the Secretary of State and a senior judge, critics argue it still permits surveillance on a scale that is too broad and interferes with the privacy of many innocent people.⁹
Evaluation: A Difficult Balance
The legal responses to digital threats show a clear tension between the desire for security (the "pursuit of peace") and the protection of individual rights. On one hand, laws like the CMA 1990 and the IPA 2016 provide the authorities with tools to investigate and prosecute new forms of crime. The National Crime Agency regularly reports on operations that have led to the arrest of cybercriminals, suggesting these laws do have a practical crime prevention effect.¹⁰
On the other hand, there are valid concerns about the effectiveness and proportionality of these measures. The law on computer misuse, despite updates, is still largely based on a 1990s understanding of technology. Furthermore, the sweeping surveillance powers granted by the IPA 2016 raise fundamental questions. Even if these powers are used to prevent terror attacks, the collection of vast amounts of data on ordinary citizens could be seen as a step towards a society where privacy is no longer a given. There is a risk that such powers can create a 'chilling effect', where people become afraid to express dissenting views online for fear of being monitored.¹¹ This does not seem compatible with the idea of a peaceful, free, and democratic society. The pursuit of peace through security measures must be carefully balanced so that it does not destroy the very freedoms it is supposed to protect.
Conclusion
The digital age has brought forth complex security threats that did not exist a generation ago, from hacking and online fraud to the rapid spread of terrorist ideology. The United Kingdom has responded by enacting specific legislation like the Computer Misuse Act 1990 and granting extensive surveillance powers through the Investigatory Powers Act 2016. These laws attempt to provide law enforcement with the means to prevent crime and maintain national security.
However, this essay has shown that these legal responses are not without their problems. They struggle to keep pace with the rapid evolution of technology and the borderless nature of the internet. More fundamentally, they force society to confront a difficult trade-off between security and liberty. While the goal of preventing crime and pursuing peace is one that everyone shares, the methods used must be proportionate and subject to robust oversight. The ongoing legal challenges and public debate surrounding these laws show that finding the right balance is a continuous process, and one that is essential to defining the kind of society we wish to live in in the digital era.
—
Footnotes
¹ Crown Prosecution Service, ‘Cybercrime’ <https://www.cps.gov.uk/legal-guidance/cybercrime> accessed 15 May 2024. ² Office for National Statistics, ‘Crime in England and Wales: year ending December 2023’ (25 April 2024) <https://www.ons.gov.uk/peoplepopulationandcommunity/crimeandjustice/bulletins/crimeinenglandandwales/yearendingdecember2023> accessed 15 May 2024. ³ Commission for Countering Extremism, ‘Challenging Hateful Extremism’ (2019) 11. ⁴ Serious Crime Act 2015, s 43. ⁵ Law Commission, ‘Reforming the Computer Misuse Act 1990’ (Consultation Paper 254, 2022). ⁶ Council of Europe, Convention on Cybercrime CETS No 185 (Budapest, 23 November 2001). ⁷ Investigatory Powers Act 2016. ⁸ Big Brother Watch and Others v The United Kingdom (2021) 73 EHRR 13. ⁹ Lilian Edwards, ‘The Investigatory Powers Act 2016: a surveillance state of the art?’ (2017) 28(2) King’s Law Journal 194. ¹⁰ National Crime Agency, ‘National Cyber Crime Unit Annual Report 2022/23’ (NCA, 2023). ¹¹ Ian Brown, ‘The Investigatory Powers Bill: A Post-mortem’ (2017) 8(1) International Data Privacy Law 1.
Bibliography
Cases
Big Brother Watch and Others v The United Kingdom (2021) 73 EHRR 13
Legislation
Computer Misuse Act 1990 Investigatory Powers Act 2016 Serious Crime Act 2015
International Instruments
Council of Europe, Convention on Cybercrime CETS No 185 (Budapest, 23 November 2001)
Books and Articles
Brown I, ‘The Investigatory Powers Bill: A Post-mortem’ (2017) 8(1) International Data Privacy Law 1 Edwards L, ‘The Investigatory Powers Act 2016: a surveillance state of the art?’ (2017) 28(2) King’s Law Journal 194
Reports and Official Publications
Commission for Countering Extremism, ‘Challenging Hateful Extremism’ (2019) Crown Prosecution Service, ‘Cybercrime’ <https://www.cps.gov.uk/legal-guidance/cybercrime> accessed 15 May 2024 Law Commission, ‘Reforming the Computer Misuse Act 1990’ (Consultation Paper 254, 2022) National Crime Agency, ‘National Cyber Crime Unit Annual Report 2022/23’ (NCA, 2023) Office for National Statistics, ‘Crime in England and Wales: year ending December 2023’ (25 April 2024) <https://www.ons.gov.uk/peoplepopulationandcommunity/crimeandjustice/bulletins/crimeinenglandandwales/yearendingdecember2023> accessed 15 May 2024
