Source: http://cyb3rcrim3.blogspot.com/2007/02/
Timestamp: 2019-04-20 18:56:10+00:00

Document:
In law, jurisdiction is a court’s ability to act in a case, i.e., to hear evidence and enter a judgment. In criminal law it’s a court’s power to adjudicate the charges brought against someone.
People often wonder if jurisdiction is a problem in cybercrime cases because the conduct involved in committing a cybercrime can cross sovereign borders. That is, as we all know, cybercrime can be committed state-to-state in the United States, say, or across two or more different countries.
This is significant because jurisdiction has historically been based on someone’s physical presence in a particular sovereign entity (nation-state or, in a federal system like the U.S. in a constituent state of a nation-state). The idea goes way, way back in history.
At English common law, jurisdiction to prosecute was based on having custody of the alleged offender; it really didn’t matter how the officials got hold of that person as long as they had him. This historical principle still runs through much of our law of jurisdiction, so jurisdiction in civil and criminal cases is often predicated on one’s “presence” in the jurisdiction that seeks to prosecute.
What we have done, though, is to dramatically expand what “presence” is. It can be physical presence or it can be an attenuated version of physical presence: the notion that by engaging in conduct outside a state or nation-state one had a particular, foreseeable “effect” within that sovereign entity.
This attenuated, expanded notion of “presence” emerged in civil law as a byproduct of the expansion of interstate commerce across state (and national) boundaries last century; it has since migrated into criminal law. So what you see in modern criminal law are statutes that give the courts of a sovereign the ability to prosecute someone whose conduct resulted in the infliction of “harm” inside the state, even though the perpetrator was never actually “in” that state. Here’s an example, from Arkansas: “A person may be convicted under a law of this state of an offense committed by his or her . . . conduct . . . if. . . [e]ither the conduct or a result that is an element of the offense occurs within this state”. Arkansas Code § 5-1-104(a)(1).
Christopher Joe Powell . . . . a resident of Georgia, met Vanneise Collins, a resident of Drew County, Arkansas, on an internet website for singles. Over the course of several months, the two engaged in lengthy e-mail and telephone communications, striking up a romance. The romance culminated in three face-to-face meetings in Georgia, and ultimately, a marriage proposal. Throughout the course of their romance, [Powell] made certain representations about himself that proved to be wholly fabricated, such as his being unmarried, being in the army, and being deployed in Iraq during portions of the time he and Collins were in contact. Collins made concrete marriage plans, such as putting a deposit down on a wedding dress and mailing out wedding invitations. All the while, Collins sent [Powell] money when he asked, via Western Union, for a variety of reasons, including new golf clubs, property taxes on inherited property, medical bills, a new military dress uniform, and to `grease palms’ while being separated from his unit in Iraq. [Powell] obtained about $15,000 from Collins. When she began to doubt him, she verified that there was no record of him being in the military and eventually went to the police.
Powell v. State, 2007 WL 104103 (Arkansas Court of Appeals, January 17, 2007).
Powell was charged with, and convicted of, theft and computer fraud.
The theft charge was based on a statute that defines “theft” as using “deception” to obtain the property of another person. Arkansas Code § 5-36-103.
The computer fraud charge was based on a statute that defines “computer fraud” as using a computer or computer network to “devise” or execute a “scheme or artifice to defraud, i.e., to obtain “money, property, or a service with a false or fraudulent intent, representation, or promise. Arkansas Code § 5-41-103.
In his appeal, Powell didn’t focus on the similarity of the charges but on the issue of jurisdictoin: Powell claimed " the trial court erred in asserting jurisdiction over this matter, contending that all elements of the offenses charged occurred outside the territorial jurisdiction of Arkansas.” Powell v. State, 2007 WL 104103 (Arkansas Court of Appeals, January 17, 2007). The Court of Appeals noted it was “undisputed that appellant never entered the State of Arkansas until such time as he was arrested and transported to Arkansas to answer the criminal charges of theft and computer fraud in Drew County.” Powell v. State, supra.
Appellant claims that . . . these crimes are defined by the conscious act of the wrongdoer. Cousins v. State, 202 Ark. 500, 151 S.W.2d 658 (1941), provides that if a crime covers only the conscious act of the wrongdoer, regardless of its consequences, the crime takes place and is punishable only where he acts. Therefore, appellant argues that the conduct of obtaining the property of another by deception and accessing a computer system or network, occurred in Georgia.
He argues that he only sent an e-mail from Georgia through the network to Arkansas, which the complainant then accessed in Arkansas. The scheme was devised in Georgia, and the money was obtained in Georgia. . . . He claims that because the legislature defines these offenses as the purpose of the wrongdoer, all elements of the crimes occurred in Georgia, outside the territorial jurisdiction of Arkansas.
The State alleges that Ark.Code Ann. § 5-1-104(a)(1) controls because the State can show that the conduct or result that is an element of the offense occurred within Arkansas. We agree. Appellant sent e-mail correspondence to Collins and contacted her by telephone while she was in Arkansas. During the course of those communications, appellant actively deceived Collins into sending him money. Moreover, appellant caused Collins to access her computer by virtue of his e-mail correspondence, for the purpose of obtaining money with a false or fraudulent intent, representation, or promise. The deception and promises were his extensive fabrications. We hold, therefore, that substantial evidence existed to support the trial court's finding that it had jurisdiction in the instant case.
The approach the Arkansas court took in this case is common in other US cases, both state and federal, and is the predominant approach in cybercrime cases internationally. Any other result would let someone commit cybercrimes with complete impunity, as long as they targeted people in another country.
I don’t know about you, but for a while, a couple of weeks ago, I was being bombarded with emails telling me I’d won the UK National Lottery . . . which was pretty astonishing, given that I hadn’t played.
The emails were, of course, a scam . . . scam spam. The initial email says you’ve won a million or three British pounds in the lottery, and all that needs to be done now is to arrange for transfer of the funds to you, the lucky winner. I didn’t follow up on any of the emails, of course, but from what I’ve seen online the ultimate goal is to get you to send personal and bank account information to the scammers, who will presumably then use that to clean out any accounts you happen to have.
Seems pretty obvious, doesn’t it? They all – all of the 419 and other spam scams – seem pretty obvious to those of us who congratulate ourselves on being too clever to be taken in, but they must be working on some subset of the population or they wouldn’t keep cropping up in new and more or less creative guises.
And that brings me to my point. According to Wikipedia, Barnum’s Law is “You’ll never go broke underestimating the intelligence of the American public.” I’d modify that a bit for our online environment, so that it emphasizes complacency instead of intelligence (or the lack thereof).
Why would anyone do that? Why would anyone send money out into the ether to an unknown someone in an unknown someplace and not expect to be scammed?
It goes back to my comment about complacency. The picture accompanying this post is, obviously, the interior of a prison. The point is crime control: For roughly a century and a half, we have been relying exclusively on cadres of professional law enforcement officers to keep crime under control in our societies.
We do not, indeed, cannot, eliminate crime; our goal therefore is simply to keep it within manageable levels so citizens can go about their daily, legitimate activities with relatively little risk of being victimized. We control crime by having dedicated professionals who apprehend criminals (most of whom are notably inept when it comes to evading identification and capture), who are charged, tried, convicted and sentenced to serve time in places like the prison in the picture. The premise is that this controls crime by (i) deterring and incapacitating the particular criminal for the time he/she is locked up and (ii) deters others from emulating his/her criminal activity by making an example of this person. It’s not a perfect strategy, but it has worked satisfactorily in the real-world since it became the dominant model well over a century ago.
The problem for the online environment is that the dominance of this law enforcement crime control model in the real-world means that the average individual takes absolutely no responsibility for crime control. That is the police’s job, not mine – if my house is robbed because (hypothetically) I was foolish enough to leave my front door unlocked when I went to work, I can still call the police and they will still make a good-faith effort (maybe not their best effort, but an effort) to find the thief. The point is that my lack of responsibility, my failure to take even minimal precautions to protect my property, is irrelevant. In the civil law of torts, we have a doctrine called assumption of the risk, which can negate liability; so, basically, if I go bungee jumping knowing I have a fractured vertebrae, and wind up a paraplegic, I can’t recover from the bungee jumping people because I assumed the risk of my injury.
We don’t have that principle in criminal law, because a crime is an offense against the state, not against the victim. That being the case, the victim’s stupidity or irresponsibility is irrelevant – the state still needs to go after the criminal for the reason I noted above: to deter/incapacitate him/her and to deter others from following his/her example.
The result of all that, I submit, is a level of complacency. Most of us give little, if any, thought to the threat of being victimized by a criminal as we go about our daily lives. We may have alarm systems in our houses and cars and offices, but that, again, is a type of delegation – I don’t have to think about security, I delegate it to the professionals who will take care of it for me.
There isn’t anyone to whom we can delegate the responsibility for protecting us when we are online. Unless and until there is (which I’m not sure I want to see – I tend to like the idea that cyberspace is a raucous place with varied experiences, good and bad), we will have to take care of ourselves online. And that brings me back to the title of this post: healthy paranoia.
My sense is that people sixty, eighty, a hundred years ago were much less complacent and much more likely to be skeptical of strangers and their strange offers . . . and that the same was true for much of human history. Now, part of that would have bee a function of pure provincialism – the stranger coming to a small town/village would have been met with suspicion by people who seldom encountered anyone they had not known for years. But I also think much of it, particularly in more urbanized societies, was due to sad experience with face-to-face fraudsters. “The Big Con” by David Maurer, a book that was originally published in 1940 and was reprinted recently, describes the various types of scams real-world con artists used on civilians in the first several decades of the twentieth-century. Many of the scams had their roots in scams that went back centuries.
The success of those scams throughout history tells us there have always been, and no doubt will always be, people who fall for what is clearly too-good-to-be-true. I suspect, though, that the combination of the online environment and our pretty much surrendering responsibility for protecting ourselves from crime has led us, as a population, to be more susceptible to con artists than people were in the past.
If you don’t believe me, consider the story I described above: The person sent $3,000 to someone he knew nothing about in a country (Romania) known for harboring cybercrime . . . and expected a local police officer to get the money back and bring the perpetrator to justice. None of that computes, none of that works, none of that makes any sense at all . . . except, maybe the last part. This person, I would argue, did not exercise health paranoia in assessing the too-good-to-be-true offer from Romania because he assumed (i) that it was legitimate and (ii) that if it was not, law enforcement would take care of it.
It wasn’t, they can’t . . . and somehow people have to realize that.

References: § 5
 v. 
 § 5
 § 5
 v. 
 v. 
 v. 
 § 5