Jurisdictional Issue of Cyberterrorism Law in Malaysia


Territorial jurisdiction is perhaps the most common form of jurisdiction invoked. There are two basic types of jurisdiction based on the territorial principle:  subjective and objective.


a. Subjective

Subjective territorial jurisdiction, also sometimes referred to as ordinary territorial jurisdiction. Thus, the Malaysia authority has jurisdiction over any crime taking place within the territorial limits of the Malaysia.  While this concept sounds simple enough, it becomes somewhat more complex when one inquires into exactly what constitutes the “crime” and the “territorial limits” of the Malaysia. For example in section 2 of the Penal Code (Act 574) stated that every person shall be liable to punishment under this Code and not otherwise for every act or omission contrary to the provisions thereof, of which he shall be guilty within Malaysia.
       
(1)  The criminal act 

In order for the crime to have been committed within the territory of a state, the crime must either have been initiated in the state or “nearly all the events relevant to a particular case must have occurred within the territorial confines of a State.” Thus, even if a crime occurred in several states, as long as it met the above condition, subjective territorial jurisdiction would still be present.

As regards the application of this doctrine to cyberspace, two leading commentators Yochai Benkler and Larry Lessig wrote, every State has the sovereign right to regulate the transborder transfers of computer-stored data originating from or addressed to its territory.  This is but an application of a more general principle. It seems dubious that data merely addressed to a state’s territory, without also being sent to that address would implicate any jurisdictional issue, but the concept of “informational sovereignty” seems otherwise a reasonable extension of the ordinary territorial jurisdictional theory. The commentators went on, however, to state:  “Hence it appears that, under customary law, extraterritorial enforcement of State regulations is not possible; moreover, the exercise (or non-exercise) of regulatory powers may meet with retaliation measures from other States.”

This seems to take far too narrow a view of the state of customary international law on the bases for the exercise of extraterritorial jurisdiction.  As noted above, international law recognizes at least five bases for exercising extraterritorial jurisdiction in addition to the ordinary and subjective territorial theories, specifically, consensual, universal, objective territorial, nationality, and protective.

(2) Territorial limit

A state’s territory, for the purposes of subjective territorial jurisdiction, is deemed to extend to all of its land mass, its territorial waters, and its contiguous zone, as well as to any vessels, aircraft, or spacecraft registered in the state’s name.

b. Objective

Jurisdiction based on the objective territorial principle can be slightly more complicated.  Jurisdiction under this principle is generally premised on the presence of at least two of the following three factors:  act, intent, and effects, though isolated sources seem to support jurisdiction when just one factor is present. It allows a country to extend its jurisdiction beyond its territorial limits or in other words extra-territorial jurisdiction. Section 4 of the Penal Code (Act 574) provides that offences regarding to terrorism shall apply to:
( a)    by any citizen or any permanent residence on the high seas on board any ship or on any aircraft whether or not such ship or aircraft is registered in Malaysia;
( b)   by any citizen or any permanent resident in any place without and the limits of Malaysia;
( c)    by any person against a citizen of Malaysia;
( d)   by any person against property belonging to the Government of Malaysia or the Government  of any State in Malaysia located outside Malaysia, including diplomatic or consular premises of Malaysia;
( e)    by any person to compel the Government of Malaysia or the Government of any State in Malaysia to do or refrain from doing any act;
( f)    by any stateless person who has his habitual residence in Malaysia;
( g)   by any person against or on board a fixed platform while it is located on the continental shelf of Malaysia;
( h)   by any person who after the commission of the offence is present in Malaysia.

 (1) The Act

This factor looks to where physically the acts constituting the actus reus, or the criminal act, took place.  Thus, if an information terrorist caused an electrical outage along the Thailand seaboard by launching malicious code from a computer within Malaysia to the key systems which controlled those power providers, his act would be deemed to be within the subject state and he would have satisfied this factor.  It should also be noted that an act is deemed to be within the Malaysia if it takes place anywhere within the territorial limits of any of the 13 states, any Malaysia territory, or aboard any ship, plane or spacecraft registered in Malaysia.


(2)  The Intent

This factor supports jurisdiction when it can be established that the intent of the accused was to have the criminal effects felt in the subject state’s jurisdiction.  This will most commonly require reliance on circumstantial evidence.  Where a cyber terrorist plants computer viruses or logic bombs on computers within the Malaysia, it would seem likely a court would find the intent was that the effects be felt in the Malaysia. This intent, however, need not be manifested by a specific intent that the effects be felt in the subject state.  Even mere criminal negligence is sufficient as long as the effects in the subject state were reasonably foreseeable.

 (3)  The Effects 

This last factor supports jurisdiction when the actual criminal effects are felt within the subject state’s jurisdiction.  It would usually go hand in hand with the intent factor, though it will not when the effect is thwarted or misdirected.  Thus, it is conceivable that a cyber criminal operating out of country A and intending to bring down computers in country B may use a virus over which he has less control than he realizes.  When he sends the virus over the Internet from country A to country B, he not only infects nodes in country B, but also inadvertently infects nodes in country C and effects are felt there.  Such a scenario would clearly support jurisdiction in country B, but only support jurisdiction in country C under the effects factor—not the act or intent factors—and as such would fail to support jurisdiction overall for failure to carry two of the three factors.

In conclusion, we do believe that the application of objective territorial principle is a better alternative to regulate offences related to cyber terrorism.


Back to Issues

No comments:

Post a Comment