The Role of Criminal Law in Regulating Cybercrime and IT Security

Abstract

It is all too common to call for an intervention by means of criminal law whenever a severe wrong occurs—such as when private personal data of politicians are leaked, when malicious websites use a special JavaScript applet to mine Bitcoin on visitors’ computers (cryptojacking), or when a social bot spreads “fake news”. In this article, I provide an overview over core concepts, models, and limitations of a regulation of IT security through criminal law. On the basis of the German and European Union legal orders, I discuss generic regulatory aspects of substantive criminal law (1) and provide an overview on the criminal law provisions on cybercrime (2). On this basis, I analyse the role criminal law already has in regulating IT security in the EU and in Germany, and how this role may expand in the future (3).