The Cybercrime Code Act 2016 builds every penalty from the same four components, combined in different ways.
The four components
| Component | Range | Notes |
|---|---|---|
| Imprisonment | 12 months to life | Detention for a child offender, subject to the Juvenile Justice Act 2014 |
| Fine | K5,000 to K100,000 | Not available for every offence |
| ICT prohibition | Term imposed plus two years | Alternative to, or in addition to, custody |
| Corporate fine | K50,000 to K1,000,000 | Stated separately — see corporate fines |
Three ways of combining them
The commonest form, used throughout Divisions 1 to 3: “a fine not exceeding K25,000.00 or imprisonment for a term not exceeding 15 years, or both”.
The court may fine, imprison, or do both.
Used in sections 22 and 23, in section 14, and throughout Division 4. The penalty is set out as numbered options ending with “all or any of Subparagraphs (i), (ii) or (iii)”.
This is the form that introduces the ICT prohibition as a standalone option.
Used only in section 22(3) and section 23(3), where death results. Imprisonment for life and an ICT prohibition — not alternatives.
The range of maximum sentences
| Maximum | Offences |
|---|---|
| 12 months | s 26 spam |
| 5 years | s 6(1) hacking |
| 7 years | s 11 illegally remaining; s 22(1); s 23(1) |
| 10 years | s 8; s 9(1); s 15; s 23(2); s 23(4); s 31 |
| 15 years | s 6(2); s 7(1); s 16; s 17; s 20; s 25(1); s 27(1); ss 28–30 |
| 25 years | s 7(2); s 9(2); s 12; s 13; s 14; s 18; s 19(1); s 21; s 22(2); s 24; s 25(2); s 27(2) |
| 30 years | s 10 data espionage — both subsections |
| Life | s 19(2); s 22(3); s 23(3) |
Thirty years under section 10, for both the basic offence and the state secrets form — higher than electronic fraud, child pornography or attack on critical infrastructure.
That ordering reflects a legislative judgment about the seriousness of the theft of protected data.
These are maxima, not tariffs
Section 3(1)(c) applies the provisions of the Criminal Code Act (Chapter 262) on punishments, including sections 18 and 19, to this Act.
Section 19 of the Criminal Code gives the sentencing court a broad discretion. Where a maximum is prescribed, the court may impose less; it may impose a fine in addition to or instead of imprisonment; it may suspend a sentence in whole or part on recognisance; and it may make other orders in lieu.
That is why the life sentences in sections 22(3) and 23(3) are expressed to be “subject to Section 19” — they are maxima, not mandatory sentences. Established sentencing principle in Papua New Guinea reserves the maximum for the worst category of case.
Child offenders
Three provisions state a separate scale: section 14(1), section 22 and section 23 — detention rather than imprisonment, at roughly half the adult term, and in most cases with no fine. All are “subject to the Juvenile Justice Act 2014”, which section 5(3) in any event applies to every offence in the Act committed by a child. See penalties for a child offender.
Which court
Twelve offences are listed in Schedule 2 and may be dealt with summarily by a District Court constituted by a Principal Magistrate under section 48, following the procedure in section 421 of the Criminal Code. Everything else goes on indictment to the National Court.
Sources
- Cybercrime Code Act 2016 — ss 3, 5, 6–31, 48; Schedule 2
- Criminal Code Act (Chapter 262) — ss 18, 19, 421
- Juvenile Justice Act 2014
Before relying on anything here, read the current text of the Cybercrime Code Act 2016 and check for later amendments. If a decision matters to you, get advice — start with the Office of the Public Solicitor, or find a firm in the law firms directory.