Log in

Australian Cyber Law Map

You are here: Cyber Law » Australian Cyber Law Map » Computer-Based Crime

Computer-Based Crime

11 June 2025 - 10:42 | Version 23 |

Overview

  • Computer-based crimes in Australia are prosecuted under both Commonwealth and state laws. The primary federal offences are contained in the Criminal Code Act 1995 (Cth) Schedule 1 (or the Commonwealth Criminal Code), targeting conduct that harms or interferes with computer data and electronic systems. While states and territories are generally responsible for cyber-stalking and harassment laws (including the non-consensual sharing of intimate images), the Commonwealth has recently expanded its role by criminalising the specific online harm of "doxxing".
  • The threat environment for cybercrime related to cloud computing is constantly evolving due to the connectedness of infrastructure, applications and services. Unique threats apply to cloud computing services and architecture due to the sharing or outsourcing of resources, systems, applications and data security. Other threats include loss of control over resources; misuse of cloud computing resources; changes in delivery and receiving models; insecure interface or application programming interface (‘API‘); malicious insiders; data scavenging; data loss or leakage; service/account hijacking; risk profiling; and identity theft.

Criminal Code Act 1995 (Cth)

The primary Commonwealth legislation criminalising computer-based offences is the Criminal Code Act 1995 (Cth) Schedule 1 (or the Commonwealth Criminal Code). The key provisions are found in Part 10.7 (Computer Offences) and Division 474 of Part 10.6 (Telecommunications Offences).

This Part was inserted by the Cybercrime Act 2001 (Cth) to modernise Australian law and align it with international standards such as the Council of Europe Convention on Cybercrime. The offences are drafted to be technology-neutral, focusing on the intent and outcome of the conduct rather than the specific technology used. The key offences are:
  • Unauthorised access to, or modification of, restricted data (s 478.1(1)): This offence applies to the unauthorised access or modification of data held in a computer where that data is protected by an access control system (e.g., a password or encryption). The person must intend to cause the access/modification and know it is unauthorised. The maximum penalty is 2 years imprisonment.
  • Unauthorised impairment of electronic communication (s 477.3): This offence targets conduct that impairs electronic communications to or from a computer, such as initiating a denial-of-service (DoS) attack. A person commits the offence if they cause the unauthorised impairment and know that the impairment is unauthorised. The maximum penalty is 10 years imprisonment.
  • Unauthorised modification of data to cause impairment (s 477.2): This offence targets the unauthorised modification of data held in a computer where the person is reckless as to whether the modification will impair the reliability, security, or operation of the data. This includes acts like deleting or altering data, or introducing malware. The maximum penalty is 10 years imprisonment.
  • Possession or control of data with intent to commit a computer offence (s 478.4): It is an offence to possess or control data with the intention that it will be used by any person to commit an offence against one of the other provisions in Part 10.7. The maximum penalty is 3 years imprisonment.
  • Unauthorised access, modification or impairment with intent to commit a serious offence (s 477.1): This is the most serious offence in this Part. It criminalises using a computer to cause any of the above harms (unauthorised access, modification, or impairment) with the specific intent to commit or facilitate a separate "serious offence" (one that is punishable by 5 or more years imprisonment). The penalty is equivalent to the penalty for the serious offence the person intended to commit.

Doxxing Offences

  • Doxxing is a phenomenon where an individual’s personal information, such as names, addresses, contact details, and other identifiers, is maliciously exposed online. This can lead to harassment, stalking, reputational damage, and even physical harm to the victim. The doxxing offences exist alongside a number of existing criminal offences which might already apply in some doxxing scenarios, such as using a carriage service to menace, harass or cause offence under section 474.17 of the Commonwealth Criminal Code.
  • To address this specific harm, the Privacy and Other Legislation Amendment Act 2024 (Cth) introduced two new offences into the Commonwealth Criminal Code, which commenced on 11 December 2024.
The Primary Doxxing Offence (s 474.17C)
  • Elements: A person commits an offence under section 474.17C(1) if they:
    • Use a carriage service (e.g., the internet, a social media platform);
    • To make available, publish, or otherwise distribute information; and
    • The information is the "personal data" of one or more individuals; and
    • Engage in this conduct in a way that reasonable persons would regard as being, in all the circumstances, menacing or harassing.
  • Fault Element: The fault element for this offence is recklessness, as defined in section 5.6 of the Commonwealth Criminal Code.
  • Definition of "Personal Data": For this offence, "personal data" is broadly defined in section 474.17C(2) to include information that enables an individual to be identified, contacted, or located. This includes their name, photograph, phone number, email address, online accounts, or the address of their home, work, or place of worship.
  • Penalty: The maximum penalty is 6 years imprisonment.
The Aggravated Doxxing Offence (s 474.17D)
  • Elements: An aggravated offence is committed under section 474.17D(1) if a person commits the primary doxxing offence, and does so because of their belief about the target's membership in a group distinguished by race, religion, sex, sexual orientation, gender identity, intersex status, disability, or national/ethnic origin.
  • It is sufficient if the accused believes that the individual possesses the protected attribute; the attribute does not need to be an actual characteristic of the victim.
  • Penalty: This offence carries a higher maximum penalty of 7 years imprisonment.

Defences

The legislation does not create specific defences for these new offences. Therefore, the general defences available under the Commonwealth Criminal Code would apply, such as duress or necessity, although their application would be highly fact-dependent. There is no "public interest" defence for conduct that meets this criminal standard.

Hacking

The common term "hacking" is primarily addressed in federal law by the offence of ‘unauthorised access to, or modification of, restricted data’ under section 478.1(1) of the Commonwealth Criminal Code.

The three key elements of this offence are:
  1. A person causes unauthorised access to, or modification of, restricted data; and
  2. The person intends to cause the access or modification; and
  3. The person knows that the access or modification is unauthorised.
"Restricted data" is defined as data held in a computer that is protected by an access control system, such as a password or encryption. The maximum penalty for this offence is 2 years imprisonment.

Denial-of-Service Attacks

Denial-of-Service (DoS) attacks are primarily addressed by the offence of 'unauthorised impairment of electronic communication' under section 477.3(1) of the Commonwealth Criminal Code.

The two key elements of this offence are:
  1. A person causes any unauthorised impairment of electronic communication to or from a computer; and
  2. The person knows that the impairment is unauthorised.
The maximum penalty for this offence is 10 years imprisonment. A related offence under section 477.2 of the Commonwealth Criminal Code criminalises the 'unauthorised modification of data causing impairment', which applies where a person modifies data in a way they know is unauthorised and is reckless as to whether it will impair data reliability or security.

Phishing

"Phishing" refers to a method of online fraud where an offender seeks to obtain personal information—such as credit card details, bank information, or passwords—by pretending to be a trustworthy entity in an electronic communication. Phishing itself is not a specific offence, but is the fraudulent method used to commit other crimes. The relevant offences depend on the nature of the conduct and the victim.
  • Commonwealth Fraud Offences: Where the victim is a Commonwealth entity, phishing may be prosecuted under the general fraud provisions of the Commonwealth Criminal Code. Key offences include:
    • Obtaining a financial advantage by deception (s 134.2): This carries a maximum penalty of 10 years imprisonment.
    • General dishonesty offences (s 135.1): This includes dishonestly obtaining a gain or causing a loss. The maximum penalty is 10 years imprisonment.
  • State and Territory Offences: Where the victim is not a Commonwealth entity (e.g., an individual or a company), similar fraud offences under state and territory criminal law will apply.
  • Computer Offences: Phishing is often a precursor to committing offences under Part 10.7 of the Commonwealth Criminal Code. For example, using credentials obtained through phishing to log into an online account could constitute 'unauthorised access to restricted data' (s 478.1).

Infecting IT systems with Malware

The act of infecting an IT system with malicious software (malware), such as a virus or ransomware, is primarily addressed by the offence of 'unauthorised modification of data to cause impairment' under section 477.2 of the Commonwealth Criminal Code.

The key elements of this offence are:
  1. A person causes any unauthorised modification of data held in a computer; and
  2. The person knows the modification is unauthorised; and
  3. The person is reckless as to whether the modification impairs or will impair the reliability, security, or operation of any data held in the computer.
This offence carries a maximum penalty of 10 years imprisonment.

A related but less severe offence is found in section 478.2 of the Commonwealth Criminal Code, which criminalises the unauthorised impairment of data held on a computer disk, credit card, or other data storage device, carrying a maximum penalty of 2 years imprisonment.

Possession of Hacking Tools

The possession or control of data with the intent to commit a computer crime is an offence under section 478.4(1) of the Commonwealth Criminal Code. This provision is designed to criminalise the possession of hacking tools and other data intended for malicious use.

The two key elements of the offence are:
  1. A person has possession or control of data; and
  2. The person intends that the data be used by themselves or another person to commit, or facilitate the commission of, an offence against Division 477 (Serious computer offences) or Division 478 (Other computer offences).
The maximum penalty for this offence is 3 years imprisonment.

Identity Theft and Identity Fraud

Identity crime, which includes identity theft and identity fraud, is primarily addressed at the Commonwealth level by Division 372 of the Commonwealth Criminal Code. These offences criminalise the dealing in and possession of identification information for the purpose of committing other crimes.

The key offences under Division 372 include:
  • Dealing in identification information (s 372.1): It is an offence for a person to deal in identification information with the intention that the information be used to commit, or facilitate the commission of, an indictable offence.
    • "Deals in" is defined broadly to include making, supplying, using, or possessing the information.
    • "Identification information" means information relating to a person (living or dead, real or fictitious) that can be used to identify them.
  • The maximum penalty is 5 years imprisonment.
  • Possession of identification information (s 372.2): It is an offence for a person to possess identification information with the intention that it be used to commit, or facilitate the commission of, an indictable offence. The maximum penalty is 3 years imprisonment.
  • Possessing equipment to make identification information (s 372.3): It is an offence to possess equipment that is used for making identification documents or other things containing identification information, with the intention that the equipment will be used to commit an identity crime offence. The maximum penalty is 3 years imprisonment.
Where this conduct involves the use of a carriage service (like the internet), other offences may apply, such as those related to fraud or using a carriage service to menace or harass. For example, using "deep fake" technology to create false identification documents could be prosecuted under these provisions, and if used to obtain a financial advantage by deception, could also be an offence under section 134.2 of the Commonwealth Criminal Code.

Electronic Theft

Electronic theft is a broad term that covers various criminal activities, from an employee misappropriating a client list to more complex schemes involving the theft of financial data. This conduct is primarily prosecuted under the fraud and personal financial information offences in the Commonwealth Criminal Code.

The key offences include:
  • Dishonestly obtaining or dealing in personal financial information (ss 480.4 and 480.5): These are the primary "theft" offences for financial data.
    • It is an offence to dishonestly obtain or deal in another person's personal financial information without their consent (s 480.4). The maximum penalty is 5 years imprisonment.
    • It is also an offence to possess or control a thing (e.g., a file or a device) with the intention of dishonestly obtaining or dealing in personal financial information (s 480.5). The maximum penalty is 3 years imprisonment.
  • Unauthorised access to restricted data (s 478.1): This offence is often the method used to commit electronic theft. It criminalises the act of intentionally and without authorisation accessing data that is protected by an access control system (e.g., a password).
Conduct such as a breach of confidence by an employee or criminal copyright infringement may also be relevant, but these are typically addressed through civil proceedings or other specific legislative schemes rather than the general computer crime provisions.

Telecommunications Services Offences

Part 10.6 of the Commonwealth Criminal Code contains a range of offences related to the misuse of telecommunication services.
  • Dishonest Use of a Carriage Service (s 474.14): It is an offence to dishonestly obtain a gain or cause a loss by using a carriage service. The maximum penalty is 5 years imprisonment.
  • Improper Use of a Carriage Service (s 474.17): It is a general offence to use a carriage service in a way that a reasonable person would regard as menacing, harassing, or offensive. The maximum penalty is 5 years imprisonment. This section provides the foundation for more specific offences, including:
    • Threats (s 474.15): Using a carriage service to make a threat to kill or cause serious harm to a person.
    • Hoax Threats (s 474.16): Using a carriage service for a hoax threat, such as a bomb threat.
    • Non-consensual Sharing of Private Sexual Material (s 474.17A): The aggravated offence for using a carriage service to menace, harass or cause offence by transmitting or publishing private sexual material without consent.
  • Interference with Telecommunications (Division 474, Subdivision B): This subdivision contains specific offences related to interfering with facilities, including:
    • Wrongfully delivering communications (s 474.11).
    • Interfering with a facility (s 474.12).
    • Modifying a telecommunications device identifier (s 474.13).
  • Subscription-specific Secure Data Offences (Division 474, Subdivision D): This subdivision criminalises the act of copying, possessing, or supplying data used to secure access to telecommunications services (e.g., SIM card data) with the intent to commit a crime.
  • Serious Offence using a Telecommunications Network (s 474.6): It is an offence to use a telecommunications network with the intention of committing a serious offence (one punishable by 5 or more years imprisonment). The maximum penalty is imprisonment for half the maximum term for the serious offence intended.
  • Note: While not a criminal offence, the Telecommunications (Interception and Access) Act 1979 (Cth) also contains obligations for telecommunications service providers to provide reasonable assistance to law enforcement and security agencies, which may include decryption and technical assistance.

Financial Information Offences

Part 10.8 of the Commonwealth Criminal Code contains specific offences for the dishonest use of personal financial information. The key offences are:
  • Dishonestly obtaining or dealing in personal financial information (s 480.4):
    • Elements: A person commits an offence if they (1) dishonestly obtain or deal in personal financial information belonging to another person, and (2) do so without the other person's consent.
    • Penalty: The maximum penalty is 5 years imprisonment.
  • Possessing or controlling a thing with intent to obtain or deal in personal financial information (s 480.5):
    • Elements: A person commits an offence if they (1) possess or control a thing (e.g., a file, a device), and (2) intend for that thing to be used to dishonestly obtain or deal in personal financial information.
    • Penalty: The maximum penalty is 3 years imprisonment.

Serious Computer Offences

Division 477 of the Commonwealth Criminal Code contains the most serious computer-related offences under Commonwealth law. The key offences are:
  • Unauthorised access, modification or impairment with intent to commit a serious offence (s 477.1): This offence targets the use of a computer to commit or facilitate another major crime.
    • Elements: A person commits this offence if they cause any unauthorised access, modification, or impairment to data or electronic communications, with the intent to commit a separate "serious offence" (defined as an offence carrying a penalty of 5 or more years imprisonment).
    • Penalty: The maximum penalty is the same as the maximum penalty for the serious offence that was intended.
  • Unauthorised modification of data to cause impairment (s 477.2):
    • Elements: A person commits this offence if they cause any unauthorised modification of data and are reckless as to whether that modification will impair the reliability, security, or operation of data. This covers conduct like deploying viruses or ransomware.
    • Penalty: The maximum penalty is 10 years imprisonment.
  • Unauthorised impairment of electronic communication (s 477.3):
    • Elements: A person commits this offence if they cause the unauthorised impairment of electronic communications to or from a computer and know that the impairment is unauthorised. This is the primary offence used to prosecute denial-of-service (DoS) attacks.
    • Penalty: The maximum penalty is 10 years imprisonment.

Human Trafficking Offences

  • Divisions 270 and 271 of the Commonwealth Criminal Code criminalise slavery, slavery-like conditions, and human trafficking offences, such as servitude, forced labour, and the deceptive recruitment of people for labour or services.
  • While not exclusively computer-based offences, online services and other technologies are frequently used to facilitate these crimes. This can include using online platforms for recruitment, organising transport and accommodation for victims, and advertising services involving exploited individuals. Therefore, the general computer and telecommunications offences may also apply to the conduct used to enable these serious crimes.

Offences Relating to Child Abuse Material

  • The use of a carriage service to access or distribute child abuse material is criminalised under Division 474, Subdivision D of the Commonwealth Criminal Code.
  • The primary offence is under section 474.22. A person commits an offence if they use a carriage service to access, transmit, make available, publish, or distribute material, and that material is child abuse material.
  • Elements: The offence has several physical elements, each with a corresponding fault element:
  1. The person uses a carriage service (the fault element is intention).
  2. The use of the service involves accessing, transmitting, making available, publishing, or distributing material (the fault element is intention).
  3. The material is child abuse material (the fault element is recklessness, meaning the person was aware of a substantial risk that the material was child abuse material and it was unjustifiable to take that risk).
  • Penalty: The maximum penalty for this offence is 15 years imprisonment.
  • Sections 474.23 and 474.24 of the Commonwealth Criminal Code provide for similar offences related to possessing, controlling, producing, or supplying child abuse material obtained or accessed using a carriage service.

Offences Relating to Harassment and Use of Private Sexual Material

The misuse of a carriage service to harass someone or to distribute private sexual material without consent is addressed by specific offences at both the Commonwealth and state or territory level.
Commonwealth

Division 474 of the Commonwealth Criminal Code contains the key federal offences:
  • Using a carriage service to menace, harass or cause offence (s 474.17): This is the primary offence covering a wide range of online harassment. It makes it illegal to use a carriage service (like the internet or a phone service) in a way that a reasonable person would regard as being menacing, harassing, or offensive.
  • Aggravated Offence for Private Sexual Material (s 474.17A): This section creates a more serious, aggravated offence for the conduct described in s 474.17 where it involves "private sexual material". A person who transmits, makes available, publishes, or distributes private sexual material without consent, in a way that is menacing, harassing or offensive, is guilty of this offence. The maximum penalty is 6 years imprisonment.
States and Territories

Other laws

Online Safety

The Online Safety Act 2021 (Cth), which commenced on 23 January 2022, provides a regulatory framework for online safety. The Act establishes the powers of the eSafety Commissioner, who can issue take-down notices for various types of harmful online content, including cyber-abuse, non-consensual sharing of intimate images, and abhorrent violent material. The Act sets out expectations for online service providers to ensure the safety of their users and establishes industry code and standard development processes. See OnlineSafety for further details.

Cyber-stalking and Harassment (State & Territory Law)

  • While the Commonwealth has jurisdiction over offences using a carriage service, general laws against stalking and harassment are primarily handled by the states and territories. For example, section 13 of the Crime (Domestic and Personal Violence) Act 2007 (NSW) makes it an offence to stalk or intimidate another person with the intention of causing them to fear physical or mental harm. "Intimidation" is defined to include cyberbullying.
  • Recent reports and cases show these laws are continuously being applied to new and emerging forms of technology-facilitated abuse, such as the use of tracking devices, spyware, and other networked devices to monitor or control victims. Foundational case law indicating that offenders tend to stalk their victim through electronic means includes:

Regulatory and Policy Framework

Australia's response to computer-based crime is guided by several key national plans and frameworks that set out strategic priorities for government and law enforcement.
  • National Plan to Combat Cybercrime 2022: This is the foundational national plan, formalising a framework focused on three key pillars: (1) Prevent and Protect; (2) Investigate, Disrupt and Prosecute; and (3) Recover. It complements broader strategies and aims to create a nationally coordinated approach to combating cybercrime in Australia.
  • 2023-2030AustralianCyberSecurityStrategy: While this is a broad cyber security strategy, its objectives directly impact the response to computer-based crime. Its focus on disrupting cybercrime operations and strengthening law enforcement capabilities provides the current strategic direction for the agencies responsible for enforcing criminal laws.
  • International Cyber and Critical Technology Engagement Strategy: This strategy, administered by the Department of Foreign Affairs and Trade (DFAT), sets out Australia's vision for a safe and secure cyberspace and guides international engagement on cybercrime issues. Australia's accession to the Council of Europe Convention on Cybercrime is a key part of this international cooperation, helping Australian agencies work effectively with overseas counterparts.
  • Cyber Incident Management Arrangements (CIMA) for Australian Governments: This sets out the coordination arrangements and principles for Australian governments' cooperation in response to national cyber incidents, ensuring a cohesive technical and operational response. The ACSC also publishes a Cyber Incident Response Plan to provide practical guidance for organisations.

Relevant Organisations

Inquiries & Consultations

  • 2023-2030 Australian Cyber Security Strategy - Legislative Reforms Consultation: This was the foundation consultation process for the major cyber legislative package. The public discussion paper, released in 2023, sought feedback on a range of proposals, including the creation of new laws to combat doxxing and a mandatory ransomware reporting scheme, which have direct relevance to the criminal law landscape (see 2023-2030AustralianCyberSecurityStrategy).
  • Review of the Privacy and Other Legislation Amendment Bill 2024: The Senate Legal and Constitutional Affairs Legislation Committee conducted a public inquiry into the Bill that introduced the new doxxing offences into the Criminal Code. The committee's final report, which considered submissions from various stakeholders, was published in November 2024 before the Bill was passed.
  • Review of the Cyber Security Legislative Package 2024: The Parliamentary Joint Committee on Intelligence and Security (PJCIS) reviewed the package of three bills, including the Cyber Security Act 2024. Although this Act did not create new criminal offences, its establishment of mandatory reporting regimes and a Cyber Incident Review Board is directly relevant to the national response to computer-based crime.

Industry Materials

This site is powered by FoswikiCopyright © by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding AustLII Communities? Send feedback
This website is using cookies. More info. That's Fine