Home›Law Series›Cybercrime
Cybercrime
One hundred questions and answers on the Cybercrime Code Act 2016 - hacking, interception, data and system interference, electronic fraud and forgery, identity theft, pornography and child protection offences, defamatory publication, cyber bullying, harassment and extortion, spam and cyber attack, the search and investigation powers in Part IV, the liability of ICT service providers, and international co-operation.
The Cybercrime Code Act 2016 is Papua New Guinea's principal law on computer crime. It does three things. It creates a set of offences ranging from unauthorised access to a computer through to online child grooming and cyber attack on critical infrastructure. It gives police and the courts a procedural code for searching devices, preserving and intercepting electronic evidence, and using remote forensic tools. And it places duties on ICT service providers - the telecommunications companies, internet service providers, hosting providers and website administrators listed in Schedule 1 - backed by criminal liability. The Act is expressly declared to restrict six qualified constitutional rights, and it operates in addition to, and where inconsistent in place of, the Criminal Code.
Jump to a subject
100 questions and answers, grouped by subject.
- What the Cybercrime Code Act is — 8 questions
- Attacks on data and systems — 12 questions
- Computer related offences — 10 questions
- Content related offences — 28 questions
- Cyber attack and intellectual property — 10 questions
- Search, evidence and investigation — 16 questions
- ICT service providers and co-operation — 8 questions
- Practical guidance — 8 questions
What the Cybercrime Code Act is
What the Act covers, the key definitions, how it fits with the Criminal Code, retrospectivity, the age of criminal culpability, summary trial, and the constitutional rights it limits.
What Is the Cybercrime Code Act?
An introduction to the PNG Cybercrime Code Act 2016: its structure, the offences it creates, the powers it confers, and how it relates to the Criminal Code Act.
Read the answer → No. 2What Do the Key Cybercrime Terms Mean?
Section 2 of the PNG Cybercrime Code Act 2016: the definitions of computer, data, device, electronic system, interference, interception, hacking, sensitive data, critical infrastructure and more.
Read the answer → No. 3What Is an ICT Service Provider?
Section 2 and Schedule 1 of the PNG Cybercrime Code Act 2016: the definitions of ICT service, ICT service provider, network, applications and content services, and the seven categories in Schedule 1.
Read the answer → No. 4How Does the Cybercrime Act Fit With the Criminal Code?
Section 3 of the PNG Cybercrime Code Act 2016: the application of Criminal Code provisions on procedure, jurisdiction and punishment, and the priority rule for inconsistency.
Read the answer → No. 5Can the Cybercrime Act Apply to Things Done Before It Started?
Section 4 of the PNG Cybercrime Code Act 2016: the prohibition on retrospective punishment, and its relationship with section 37 of the Constitution.
Read the answer → No. 6At What Age Can a Child Be Charged With Cybercrime?
Section 5 of the PNG Cybercrime Code Act 2016: the age of criminal culpability, the rebuttable presumption for children aged 10 to 14, and the application of the Juvenile Justice Act 2014.
Read the answer → No. 7Which Cybercrime Offences Can a District Court Hear?
Section 48 and Schedule 2 of the PNG Cybercrime Code Act 2016: the indictable offences triable summarily, and the section 421 Criminal Code procedure.
Read the answer → No. 8What Constitutional Rights Does the Cybercrime Act Limit?
Section 1 of the PNG Cybercrime Code Act 2016: the constitutional declaration, the six qualified rights limited, and the justification the Act gives.
Read the answer →Attacks on data and systems
Unauthorised access and hacking, illegal interception, data and system interference, critical infrastructure, data espionage and illegally remaining.
What Is Unauthorised Access or Hacking?
Section 6(1) of the PNG Cybercrime Code Act 2016: the elements of unauthorised access, what “hacking” means, and what “protected or non-public” requires.
Read the answer → No. 10What if Hacking Causes Damage or Loss?
Section 6(2) of the PNG Cybercrime Code Act 2016: aggravated unauthorised access, what “damage or loss” means, and how the subsection relates to the data and system interference offences.
Read the answer → No. 11What Is Illegal Interception?
Section 7(1) of the PNG Cybercrime Code Act 2016: the interception offence, the definition of interception, and the two things that may be intercepted.
Read the answer → No. 12What if Interception Targets State or Sensitive Data?
Section 7(2) of the PNG Cybercrime Code Act 2016: aggravated illegal interception, and the wide definition of sensitive data that triggers it.
Read the answer → No. 13What Is Data Interference?
Section 8 of the PNG Cybercrime Code Act 2016: the seven forms of data interference, the recklessness element, and the penalties.
Read the answer → No. 14What Is System Interference?
Section 9(1) of the PNG Cybercrime Code Act 2016: the system interference offence, the definition of “hinder”, and how it differs from data interference.
Read the answer → No. 15What Is Critical Infrastructure Under the Cybercrime Act?
Sections 2 and 9(2) of the PNG Cybercrime Code Act 2016: the definition of critical infrastructure, the aggravated system interference offence, and the daily penalty.
Read the answer → No. 16What Is Data Espionage?
Section 10(1) of the PNG Cybercrime Code Act 2016: the data espionage offence, its two conditions, and why it carries a 30-year maximum.
Read the answer → No. 17What if Data Espionage Targets State Secrets?
Section 10(2) of the PNG Cybercrime Code Act 2016: aggravated data espionage against State secrets, Military secrets or sensitive data, and how it differs from the aggravation pattern elsewhere in the Act.
Read the answer → No. 18What Is the Offence of Illegally Remaining?
Section 11 of the PNG Cybercrime Code Act 2016: the illegally remaining offence, its continuing nature, and how it complements the unauthorised access offence.
Read the answer → No. 19What Does “Without Lawful Excuse or Justification” Mean?
The mental element in the PNG Cybercrime Code Act 2016: intention, lawful excuse or justification, acting in excess of an excuse, and which offences add recklessness.
Read the answer → No. 20What Is the Difference Between a Crime and a Misdemeanour?
How offences are classified under the PNG Cybercrime Code Act 2016: crimes, misdemeanours and simple offences, the Criminal Code definitions, and which cybercrime offences fall where.
Read the answer →Computer related offences
Electronic fraud, electronic forgery, online gambling by a child, identity theft, illegal devices and the security testing defence.
What Is Electronic Fraud?
Section 12(1) of the PNG Cybercrime Code Act 2016: the electronic fraud offence, its conduct and purpose elements, and how it compares with fraud under the Criminal Code.
Read the answer → No. 22Is Conspiring to Commit Electronic Fraud an Offence?
Section 12(2) of the PNG Cybercrime Code Act 2016: the separate offence of conspiring or attempting to commit electronic fraud, and the parallel provision for electronic forgery.
Read the answer → No. 23What Is Electronic Forgery?
Section 13(1) of the PNG Cybercrime Code Act 2016: the electronic forgery offence, the “inauthentic data” purpose, and the rule that readability is irrelevant.
Read the answer → No. 24Is Attempting Electronic Forgery an Offence?
Section 13(2) of the PNG Cybercrime Code Act 2016: conspiracy and attempt to commit electronic forgery, and how the provision compares with section 12(2).
Read the answer → No. 25Can a Child Be Charged for Online Gambling?
Section 14(1) of the PNG Cybercrime Code Act 2016: the offence of electronic gambling or lottery by a child, its penalties, and the definitions drawn from the Gaming Control Act 2007.
Read the answer → No. 26What Are a Gaming Operator's Duties Online?
Section 14(2) and (3) of the PNG Cybercrime Code Act 2016: the gaming operator offence, the recklessness standard, and what age verification has to achieve.
Read the answer → No. 27What Is Identity Theft?
Section 15 of the PNG Cybercrime Code Act 2016: the identity theft offence, the five prohibited acts, and what “means of identification” covers.
Read the answer → No. 28What Are Illegal Devices?
Section 16(1) of the PNG Cybercrime Code Act 2016: the illegal devices offence, the eight prohibited dealings, and the inclusion of passwords and access codes.
Read the answer → No. 29Is There a Defence for Security Testing?
Sections 16(2) and 16(3) of the PNG Cybercrime Code Act 2016: the defence for authorised testing, system protection and law enforcement, and its limits.
Read the answer → No. 30How Do the Computer Offences Differ From Ordinary Crime?
A comparison of the Division 2 offences in the PNG Cybercrime Code Act 2016 with the general criminal law: what must be proved, what need not be, and how the two bodies of law interact.
Read the answer →Content related offences
Pornography and child protection offences, online grooming, defamatory publication, cyber bullying, cyber harassment, cyber extortion, unlawful disclosure and spam.
What Is the Pornography Offence?
Section 17(1) of the PNG Cybercrime Code Act 2016: the four limbs of the pornography offence and the wide statutory definition of pornography.
Read the answer → No. 32What Defences Apply to the Pornography Offence?
Sections 17(2) and 17(3) of the PNG Cybercrime Code Act 2016: the law enforcement and public benefit defences, and why paragraph (a) is excluded.
Read the answer → No. 33What Is the Online Child Pornography Offence?
Section 18(1) of the PNG Cybercrime Code Act 2016: the online child pornography offence, its incorporation of the Criminal Code provisions, and the penalties.
Read the answer → No. 34Is Accessing Child Pornography an Offence?
Section 18(2) of the PNG Cybercrime Code Act 2016: the offence of accessing child pornography, and why no further purpose is required.
Read the answer → No. 35What Defences Apply to Child Pornography Charges?
Sections 18(3) and 18(4) of the PNG Cybercrime Code Act 2016: the law enforcement and public benefit defences to the child pornography offences, and how they differ from the section 17 defences.
Read the answer → No. 36What Must Police Do With Stored Child Pornography?
Section 18(5) of the PNG Cybercrime Code Act 2016: the mandatory destruction duty attached to the law enforcement defence, and how it fits with the Part IV evidence powers.
Read the answer → No. 37What Is Child Online Grooming?
Section 19(1) of the PNG Cybercrime Code Act 2016: the child online grooming offence, the six ways it can be committed, and the three kinds of conduct it targets.
Read the answer → No. 38What if Grooming Involves a Child Under 16?
Section 19(2) of the PNG Cybercrime Code Act 2016: the aggravated child online grooming offence, the life sentence, and the effect of section 19 of the Criminal Code.
Read the answer → No. 39Is Profiting From Child Grooming an Offence?
Section 19(3) of the PNG Cybercrime Code Act 2016: the offence of receiving a benefit from child online grooming, and why it targets facilitators and intermediaries.
Read the answer → No. 40What Is the Animal Pornography Offence?
Section 20 of the PNG Cybercrime Code Act 2016: the animal pornography offence, its five limbs, the recklessness element, and the absence of any defence.
Read the answer → No. 41What Is Defamatory Publication Online?
Section 21(1) and (2) of the PNG Cybercrime Code Act 2016: the definitions of publication and defamatory material, and the basic online defamation offence.
Read the answer → No. 42What if Online Defamation Is Knowingly False?
Section 21(3) of the PNG Cybercrime Code Act 2016: aggravated defamatory publication where the publisher knows the material is false.
Read the answer → No. 43What Is Defamation for Extortion?
Section 21(4) of the PNG Cybercrime Code Act 2016: defamatory publication used to extort, the three forms of conduct, and its relationship with cyber extortion under section 24.
Read the answer → No. 44What Defences Apply to Online Defamation?
Sections 21(5) to (7) of the PNG Cybercrime Code Act 2016: the four defences to online defamation, and the reverse onus for good faith.
Read the answer → No. 45When Is Truth Not a Defence to Online Defamation?
Section 21(8) of the PNG Cybercrime Code Act 2016: the removal of the truth defence for sexual material, and its role against image-based abuse.
Read the answer → No. 46How Does the Public Interest Protect Online Comment?
Sections 21(9) and 21(10) of the PNG Cybercrime Code Act 2016: the incorporation of the Criminal Code public interest protection, and the extension of “public meeting” to online forums.
Read the answer → No. 47What Is Cyber Bullying?
Section 22(1) of the PNG Cybercrime Code Act 2016: the cyber bullying offence, its three modes of participation, the seven purposes, and why it protects only children.
Read the answer → No. 48What if Cyber Bullying Causes Harm?
Section 22(2) of the PNG Cybercrime Code Act 2016: aggravated cyber bullying where psychological or physical harm results, and the penalties for adult and child offenders.
Read the answer → No. 49What if Cyber Bullying Results in Death?
Section 22(3) of the PNG Cybercrime Code Act 2016: cyber bullying resulting in death, the life sentence for child and adult offenders, and the mandatory ICT prohibition.
Read the answer → No. 50What Penalties Apply to a Child Cyber Bully?
The child offender penalties in sections 22 and 23 of the PNG Cybercrime Code Act 2016, the role of the Juvenile Justice Act 2014, and the ICT prohibition as an alternative to detention.
Read the answer → No. 51What Is Cyber Harassment?
Section 23(1) of the PNG Cybercrime Code Act 2016: the cyber harassment offence, its six purposes, and how it differs from cyber bullying.
Read the answer → No. 52What if Cyber Harassment Causes Harm or Death?
Sections 23(2) and 23(3) of the PNG Cybercrime Code Act 2016: aggravated cyber harassment where harm or death results, and the comparison with the cyber bullying equivalents.
Read the answer → No. 53Is Posting Obscene or Vulgar Content an Offence?
Section 23(4) of the PNG Cybercrime Code Act 2016: the offence of posting vulgar, obscene or profane commentary online, its nine verbs, and the free expression questions it raises.
Read the answer → No. 54What Is Cyber Extortion?
Section 24(1) of the PNG Cybercrime Code Act 2016: the cyber extortion offence, how it covers ransomware, and why a threat alone is enough.
Read the answer → No. 55What Is Online Blackmail?
Sections 24(2) and 24(3) of the PNG Cybercrime Code Act 2016: online blackmail, sextortion, and the rule that the truth of the accusation does not matter.
Read the answer → No. 56What Is Unlawful Disclosure?
Section 25(1) of the PNG Cybercrime Code Act 2016: the unlawful disclosure offence, what it covers, and the public benefit defence in section 25(3).
Read the answer → No. 57What if an Insider Discloses Sensitive Data?
Section 25(2) of the PNG Cybercrime Code Act 2016: the aggravated unlawful disclosure offence for insiders with lawful access, and how it applies to employees and public servants.
Read the answer → No. 58What Is the Spam Offence?
Section 26 of the PNG Cybercrime Code Act 2016: the spam offence, its three limbs, and why ordinary bulk marketing is not caught.
Read the answer →Cyber attack and intellectual property
Cyber attack and critical infrastructure, online copyright, trade mark, patent and design infringement, unlawful advertising, ICT prohibition orders and corporate fines.
What Is a Cyber Attack?
Section 27(1) of the PNG Cybercrime Code Act 2016: the cyber attack offence, what counts as malicious software, and how it differs from data and system interference.
Read the answer → No. 60What if a Cyber Attack Targets Critical Infrastructure?
Section 27(2) of the PNG Cybercrime Code Act 2016: aggravated cyber attack on critical infrastructure, the penalties, and which systems qualify.
Read the answer → No. 61What Is Online Copyright Infringement?
Section 28 of the PNG Cybercrime Code Act 2016: online copyright infringement as a criminal offence, the “knowingly and repeatedly” requirement, and how it sits with the Copyright Act.
Read the answer → No. 62What Is Online Trade Mark Infringement?
Section 29 of the PNG Cybercrime Code Act 2016: selling counterfeit goods online, how it works with the Trade Marks Act (Chapter 385), and what the offence does and does not cover.
Read the answer → No. 63What Is Online Patent and Design Infringement?
Section 30 of the PNG Cybercrime Code Act 2016: online patent and industrial design infringement, and why this is the widest of the three intellectual property offences.
Read the answer → No. 64What Is Unlawful Advertising?
Section 31 of the PNG Cybercrime Code Act 2016: the unlawful advertising offence, its extraordinary breadth, and how it reaches promotion of any offence under any law.
Read the answer → No. 65What Is an ICT Prohibition Order?
The ICT prohibition penalty in the PNG Cybercrime Code Act 2016: which offences carry it, how long it runs, and what it means in practice.
Read the answer → No. 66What Fines Can a Company Face for Cybercrime?
The body corporate fines in the PNG Cybercrime Code Act 2016, section by section, and the daily penalty under section 9(2).
Read the answer → No. 67How Are Cybercrime Penalties Structured?
How penalties work under the PNG Cybercrime Code Act 2016: the four components, how they combine, and the full range of maximum sentences.
Read the answer → No. 68Can a Company Be Guilty of a Cybercrime?
Corporate criminal liability under the PNG Cybercrime Code Act 2016: how a company commits an offence, the identification principle, and the position of ICT service providers.
Read the answer →Search, evidence and investigation
Search warrants and search powers, assistance, production orders, expedited preservation, partial disclosure, restraining orders, interception, traffic data, remote forensic tools and electronic evidence.
When Can Police Search for Electronic Evidence?
Section 32(1) of the PNG Cybercrime Code Act 2016: the search power, the warrant requirement, and what “private place” and “data or thing” mean.
Read the answer → No. 70What Must a Cybercrime Search Warrant Contain?
Sections 32(2), 32(3) and 32(4) of the PNG Cybercrime Code Act 2016: how a search warrant is issued, when it may be executed, and what happens to seized material.
Read the answer → No. 71What Extra Search Powers Do Police Have?
Section 33 of the PNG Cybercrime Code Act 2016: the seven additional search powers, including the power to access data not held at the place searched.
Read the answer → No. 72Can Police Take My Computer Away?
Section 33(e) of the PNG Cybercrime Code Act 2016: when police may remove a computer or phone for examination, the two conditions, and how to get it back.
Read the answer → No. 73Must I Help Police Access My Devices?
Section 34 of the PNG Cybercrime Code Act 2016: the assistance power, the exclusion of suspects, and the four forms of help that can be required.
Read the answer → No. 74What Is a Production Order?
Section 35 of the PNG Cybercrime Code Act 2016: production orders for data and for subscriber information, who may apply, and what the threshold is.
Read the answer → No. 75What Is Expedited Preservation of Data?
Section 36 of the PNG Cybercrime Code Act 2016: preservation notices, the 14-day period, the single extension, and why the timing rule matters.
Read the answer → No. 76What Happens if I Ignore a Preservation Notice?
Section 36(4) of the PNG Cybercrime Code Act 2016: the offence of failing to comply with a preservation notice, the penalties, and what compliance actually requires.
Read the answer → No. 77What Is a Partial Disclosure Order?
Section 37 of the PNG Cybercrime Code Act 2016: partial disclosure orders, traffic data, and why the power stops at identifying providers and the transmission path.
Read the answer → No. 78What Is a Restraining Order Over Data?
Section 38 of the PNG Cybercrime Code Act 2016: restraining orders over data and devices, the threshold, and how the order differs from a preservation notice.
Read the answer → No. 79When Can Police Intercept Communications?
Section 39 of the PNG Cybercrime Code Act 2016: authorised interception, the sworn evidence requirement, and the difference between lawful interception and the section 7 offence.
Read the answer → No. 80What Is Collection of Traffic Data?
Section 40 of the PNG Cybercrime Code Act 2016: prospective collection of traffic data, what traffic data reveals, and how it differs from interception.
Read the answer → No. 81What Are Remote Forensic Tools?
Sections 41(1) to 41(4) of the PNG Cybercrime Code Act 2016: remote forensic tools, the last resort test, what an application must contain, and the limits on modifying a device.
Read the answer → No. 82What Safeguards Apply to Forensic Tools?
Sections 41(5) to 41(11) of the PNG Cybercrime Code Act 2016: the seven safeguards governing remote forensic tools, and what they mean in practice.
Read the answer → No. 83Is Electronic Evidence Admissible?
Section 43 of the PNG Cybercrime Code Act 2016: the admissibility of electronic evidence, what section 43(1) removes, and what still has to be proved.
Read the answer → No. 84What Is Judicial Notice of Electronic Signatures?
Section 42 of the PNG Cybercrime Code Act 2016: judicial notice of electronic seals, signatures and certificates, and what it does and does not establish.
Read the answer →ICT service providers and co-operation
When a provider is criminally liable, monitoring, court orders, confidentiality of investigations, who counts as a provider, mutual assistance and extradition.
When Is an ICT Service Provider Criminally Liable?
Sections 44(1)(a) and 44(1)(b) of the PNG Cybercrime Code Act 2016: the monitoring offence and the facilitation offence for ICT service providers.
Read the answer → No. 86Must a Provider Comply with a Court Order?
Sections 44(1)(c) and 44(1)(d) of the PNG Cybercrime Code Act 2016: obstruction of an investigation and non-compliance with a court order by an ICT service provider.
Read the answer → No. 87Can a Provider Be Liable for an Employee?
Section 44(1)(e) of the PNG Cybercrime Code Act 2016: negligent supervision of employees by an ICT service provider, and what a provider must do to answer it.
Read the answer → No. 88Can a Provider Monitor Its Users?
Section 44(1)(a) of the PNG Cybercrime Code Act 2016: the prohibition on provider monitoring, what counts as lawful excuse, and how ordinary network operations stay lawful.
Read the answer → No. 89Can a Provider Tell a Customer About an Investigation?
Section 45 of the PNG Cybercrime Code Act 2016: the non-disclosure offence for ICT service providers, its three limbs, and how it works with the rest of Part V.
Read the answer → No. 90Which Businesses Are ICT Service Providers?
Schedule 1 to the PNG Cybercrime Code Act 2016: the seven categories of ICT service provider, and who is caught by Part V.
Read the answer → No. 91How Does PNG Co-operate Internationally on Cybercrime?
Part VI of the PNG Cybercrime Code Act 2016: sections 46 and 47, mutual assistance and extradition, and the practical limits of cross-border cybercrime investigation.
Read the answer → No. 92What Rules and Regulations Can Be Made?
Sections 49 and 50 of the PNG Cybercrime Code Act 2016: the rule-making and regulation-making powers, and the gaps in the Act they could fill.
Read the answer →Practical guidance
What to do as a victim or as an accused, what businesses must do, protecting children online, what you may post about someone, and how the Act affects social media.
What Should I Do if I Am a Victim of Cybercrime?
Practical guidance for victims of cybercrime in PNG: preserving evidence, reporting, the Part IV powers police can use, and what not to do.
Read the answer → No. 94What Should I Do if I Am Accused of a Cybercrime?
Practical guidance for a person accused of a cybercrime in PNG: rights on arrest, the assistance power, lawful excuse, and how the charge will be framed.
Read the answer → No. 95What Should a Business Do About Cybercrime Risk?
Practical cybercrime compliance for PNG businesses: the corporate exposure under the Cybercrime Code Act 2016, and the measures that answer it.
Read the answer → No. 96How Are Children Protected Online in PNG?
How the PNG Cybercrime Code Act 2016 protects children online: the offences, the penalties, and what parents and schools should know.
Read the answer → No. 97What Can I Post About Someone Online in PNG?
Practical guidance on posting about people online in PNG: the four offences in the Cybercrime Code Act 2016, what defences exist, and where they do not.
Read the answer → No. 98How Do Cybercrime and Copyright Law Overlap?
How the PNG Cybercrime Code Act 2016 and the Copyright and Neighbouring Rights Act 2000 interact: section 28, the free use provisions, and which route a rights owner should take.
Read the answer → No. 99What Privacy Protections Exist in PNG Cybercrime Law?
Privacy under PNG cybercrime law: section 49 of the Constitution, the offences that protect personal data, and the safeguards in Part IV.
Read the answer → No. 100How Does the Cybercrime Act Affect Social Media Use?
How the PNG Cybercrime Code Act 2016 applies to everyday social media use: the offences that reach ordinary posts, page administrators, and what to do about it.
Read the answer →Acts are amended, and figures and time limits change. Every article names the sections it relies on so you can read them. If a decision matters to you, get advice — start with the Office of the Public Solicitor, or find a firm in the law firms directory.