What are the laws around hacking in Canada?

July 11, 2024

What are the laws around hacking in Canada?

Computer hacking involves compromising digital devices and networks through unauthorized access to an account or a system. The goal is usually to corrupt systems, gather user information, steal data or disrupt regular online activities.

Hackers are becoming increasingly sophisticated, using stealthy attack methods to go unnoticed by cybersecurity software and IT teams. As a result, cybercrime has become a global multibillion-dollar industry.

Those charged with any cybercrime need to retain competent legal counsel as the penalties upon conviction can include incarceration and/or an order to make financial restitution.

Charges hackers may face

While the term “hacker” is not mentioned in the Criminal Code, various sections address the crime.

• The charge of unauthorized use of a computer may be laid if someone illegally intercepts computer messages or uses a computer system to commit an offence. The maximum penalty is 10 years in prison.
• Mischief in relation to data involves destroying or altering computer data to make it useless or ineffective. This charge can also be laid if someone interrupts or interferes with the lawful use of computer data. If the computer mischief endangers someone’s life, the maximum penalty is life imprisonment. If the value of the mischief exceeds $5,000 the maximum penalty is a prison term of 10 years. For computer mischiefs valued at less than $5,000, the maximum penalty is a two-year jail sentence.
• The charge of interception may be laid if someone knowingly intercepts a private communication by means of any electromagnetic, acoustic, mechanical or other device. The maximum penalty is five years in prison. It should be noted that this charge does not apply to a person who works for a communication service and “if the interception is necessary for the purpose of providing the service.”
• The charge of fraud is commonly laid with computer hacking. A news report notes that fraud and online scams remain the most common forms of cybercrime in Canada, with residents reporting “more than 70,000 instances of fraud [in 2022], linked to more than $530 million allegedly stolen from companies and individuals.” If the value of the fraud exceeds $5,000 the maximum penalty is a 14-year prison term. A two-year maximum penalty can be imposed for frauds under $5,000.

Defences available to those charged

I always ask my clients for a detailed explanation of what led to them being charged with a crime. After examining the police evidence, I can suggest the best possible defence against the charge.

Challenge the evidence: Electronic evidence in cybercrime cases can be complex and difficult to interpret and I may be able to show the court that it has not been firmly established who is responsible.

A lack of intent: To win a conviction the Crown prosecutor must be able to show that the accused intended to commit an illegal act. Perhaps the online activities of the accused were not meant to be malicious.

Civil rights were violated: Everyone is guaranteed a degree of privacy and freedom of expression under the Canadian Charter of Rights and Freedoms. When police are investigating cybercrimes, they must follow the rules, such as obtaining proper search warrants for their work. If not, I can challenge the constitutionality of the charges and seek to have them dismissed.

Accept a plea bargain: In some instances, it may be beneficial to negotiate a plea bargain with the prosecution, such as pleading guilty to a lesser charge in exchange for a reduced sentence.

Seek alternative sentences: For minor cybercrimes, alternative penalties such as community service, probation, or electronic monitoring may be available. A criminal defence lawyer can explore these options and work to secure a more lenient sentence.

Cybercrime in Canada

There have been more than 150,000 reports of fraud in Canada with at least $600 million stolen since January 2021, according to the National Cyber Crime Assessment 2023-2024 published by the Canadian Anti-Fraud Centre.

Highlights of the report include:

• Ransomware is the most disruptive form of cybercrime facing Canadians, with a growing and sophisticated ecosystem continuing to adapt to maximize profits. Since 2020, the frequency of ransomware attacks worldwide has increased, and payment demands against large organizations have grown.
• Even if victims choose to pay the ransom, there are no guarantees their data will be recovered. One survey of Canadian businesses found that only 42 per cent of organizations who paid the ransom had their data completely restored.
• Cybercriminals in other countries target critical Canadian infrastructure to collect information in case of future hostilities and as a form of power projection. The state-sponsored cyber programs of China, Russia, Iran and North Korea pose the greatest strategic cyber threats to Canada.
• Cybercriminals are attempting to influence Canadians, degrading trust in online spaces and making fake content easier to manufacture and harder to detect.

Ottawa man pleads guilty to cyber crimes

A news report called an Ottawa resident “Canada’s most prolific cybercriminal” after he pleaded guilty to cyber attacks targeting the computers of more than 1,000 people, businesses and organizations – including three police departments.

The man used anonymous email addresses and connections to remote servers to mask his identity in exhaustive phishing schemes, the story states, adding the emails were sent under the false pretext of securing employment and the attached fake résume contained malware.

“Once one of the victims opened up the attachment, the embedded malware allowed [him] access and full control over the target computer,” the report states, allowing him to “collect banking logins and send email transfers from the victims’ accounts without their knowledge.”

Investigators identified 1,113 victims – including three police departments across Canada – who collectively paid him approximately $49,000 in Bitcoin.

The man pleaded guilty to fraud, unauthorized use of a computer and mischief in relation to computer data, the report stated.

It added the man is expected to make full restitution and is “allowed only to use a computer if it’s for honest work” while out on bail awaiting sentencing.

Contact me for a consultation

Cybercrimes keep growing and taking new directions, as does the case law in this area. If you are facing this charge, contact me for a free consultation to discuss the options available to you.

---