Section 43: Territorial scope of computer misuse offence
136.Article 12 of Directive provides as follows:
“Jurisdiction
1.Member States shall establish their jurisdiction with regard to the offences referred to in Articles 3 to 8 where the offence has been committed:
(a)in whole or in part within their territory; or
(b)by one of their nationals, at least in cases where the act is an offence where it was committed.
2.When establishing jurisdiction in accordance with point (a) of paragraph 1, a Member State shall ensure that it has jurisdiction where:
(a)the offender commits the offence when physically present on its territory, whether or not the offence is against an information system on its territory; or
(b)the offence is against an information system on its territory, whether or not the offender commits the offence when physically present on its territory.......””
137.Sections 4 and 5 of the 1990 Act already provide for limited extra-territorial jurisdiction in relation to the offences in sections 1 and 3 of that Act. Under those provisions, it is possible to prosecute a person in this country for an act committed abroad which would constitute an offence under section 1 or 3 provided that there was a “significant link” to the appropriate jurisdiction in the UK. Subsection (2) amends section 4 of the 1990 Act to apply such extra-territorial jurisdiction to the offence in new section 3ZA inserted by section 41; subsection (5) amends section 5 of the 1990 Act to define what constitutes a “significant link” in the context of the new offence. A significant link is established if the accused was in the UK at the time of the offence, or if the affected computer or the intended affected computer was in the UK. Accordingly, it would, for example, be possible under the current law to prosecute a French national resident in England and Wales who hacked into a computer system in France or a UK national who hacked into a computer system in the UK whilst temporarily resident in France (but who subsequently returned to the UK). Subsection (3) inserts new subsection (4A) into section 4 of the 1990 Act, the effect of which is to apply extra-territorial jurisdiction to the offence under section 3A of the 1990 Act. Subsection (4) amends section 5 of the 1990 Act to extend the current extra-territorial jurisdiction in order to fully comply with Article 12; the effect of new section 5(1A) and (1B) is to permit prosecutions of a UK national for all offences under the 1990 Act even where the conduct concerned has no other significant link to the UK, provided also that the offence was an offence in the country where it took place.
138.Subsections (6) and (7) amend section 13 of the 1990 Act. Subsection (6) sets out the criteria for when a sheriff court in Scotland will have jurisdiction to try an offence under sections 3ZA and 3A of the 1990 Act. A sheriff court will have jurisdiction if a person who commits an offence under section 3ZA is in the sheriffdom at the time they carry out any of the unauthorised act, or if the computer in relation to which the offence was carried out was located in the sheriffdom at the time of the offence. A sheriff court will have jurisdiction if a person who commits an offence under section 3A is in the sheriffdom at the time they carry out any of the acts set out in section 13(2B)(a). If a person was not in the sheriffdom, new section 13(2B)(b) provides the sheriff court will have jurisdiction to try the offence if the computer in relation to which the offence was carried out was located in the sheriffdom at the time of the offence. Subsection (7) provides that where a person commits an offence under section 1, 3, 3ZA or 3A of the 1990 Act outwith Scotland, he or she may be tried in any sheriff court district in which the person is apprehended or in custody, or in such sheriff court district as the Lord Advocate may direct, as if the offence had been committed there.
