The offences in the Cybercrime Code Act 2016 are broadly drawn and heavily punished. Several carry 25 years; one carries 30; three carry life.
1. Your rights
A person arrested or detained must be informed promptly of the reasons, must be informed of the right to remain silent, and is entitled to communicate with a lawyer and to have a lawyer present.
Section 37 of the Constitution guarantees the protection of the law, including the presumption of innocence and the right not to be compelled to give evidence against oneself.
Cybercrime cases turn on precise facts: which account, whose device, what authorisation existed, what was accessed and when.
An account given from memory, without records, is frequently wrong in detail — and inaccuracies are then used to suggest concealment. There is nothing to be gained from explaining a system to an investigator before you have checked what your own records show.
2. Devices and passwords
Section 34 allows police, on production of a warrant, to require assistance in accessing a system — but only from “a person who is not a suspect of an offence”.
A suspect cannot be required under section 34 to unlock a device, supply a password, or decrypt data.
Section 33(a) and (b) allow an officer executing a warrant to direct an occupant of the place to operate a device, without any exclusion for suspects.
The better view is that the express exclusion in section 34, read with sections 37 and 42 of the Constitution, means a direction under section 33 cannot be used to compel a suspect to do what section 34 says cannot be required. The point has not been decided.
If you are, or may be, a suspect: say so, say that you wish to speak to a lawyer, and do not volunteer passwords. Do not obstruct the search itself — that raises separate difficulties.
3. Lawful excuse is usually the real issue
“Without lawful excuse or justification, or in excess of a lawful excuse or justification.”
Most cybercrime allegations involve conduct that would be entirely lawful with permission — accessing a system, copying data, testing security, sending messages, publishing material.
So the first question in any defence is: what authority did you have, and where is it recorded?
- An employment contract or position description;
- A written engagement or scope of work — critical in security testing;
- An email or message granting access;
- Terms of service or a system policy;
- A statutory power or court order.
Note the second half: “in excess of”. Authority to do one thing is not authority to do more. Where the allegation is that you went beyond your permission, the precise boundary of that permission is the case.
4. Preserve your own evidence
- Do not delete anything. Deletion after you know of an investigation is capable of engaging section 8, and for a provider section 44(1)(c).
- Collect the authorisations identified above, with dates.
- Preserve logs that show what you actually did — they frequently establish the limits of the conduct.
- Note who else had access to the accounts and devices concerned. Shared credentials are a recurring feature of these cases.
5. Understanding the charge
| Question | Why it matters |
|---|---|
| Which section and subsection? | Elements and penalties differ sharply between subsections |
| Intention, or recklessness? | Some offences — s 24, s 27 — require intention only |
| Is a result element alleged? | s 6(2), s 22(2), s 23(2) depend on consequences |
| Is it in Schedule 2? | Determines whether a District Court may deal with it summarily |
| Were you a child at the time? | Section 5 and the Juvenile Justice Act 2014 apply |
6. Challenging how the evidence was obtained
Much of the evidence will have been obtained under Part IV. Its validity is open to challenge: whether the warrant was properly issued on information on oath, whether it was executed by day, whether removal of a device met the section 33(e) conditions, whether a forensic tools order satisfied the last resort test and contained the four particulars.
Section 43 prevents an objection based simply on the evidence being electronic. It does not prevent objections based on authenticity, continuity or the manner in which the material was obtained.
Section 57 of the Constitution allows application to the National Court for enforcement of guaranteed rights where a power has been exceeded.
Sources
- Cybercrime Code Act 2016 — ss 5, 6, 8, 22–27, 32–34, 41, 43, 44, 48; Schedule 2
- Constitution — ss 37, 42, 44, 49, 57; Juvenile Justice Act 2014
Before relying on anything here, read the current text of the Cybercrime Code Act 2016 and check for later amendments. If a decision matters to you, get advice — start with the Office of the Public Solicitor, or find a firm in the law firms directory.