A Comprehensive Study on Cyber Legislation in G20 Countries

Abstract

Cyberlaw, often known as Internet law, is a branch of the judicial framework concerned with the legality of internet information technology. It governs the digital transmission of information, shopping-portal applications, and information security. It is associated with justice informatics and electronic components like systems, software, and hardware. This article covers various topics, including the existence and appropriateness of the open Internet, free expression, and online privacy. The standards contribute to a significant decrease in the number of people engaging in asymmetric warfare and also help to restrict their participation by safeguarding illegal access to information, free speech connected to Internet usage, personal space, information exchange, e-email domains, intangible assets, machinery, and web services, which include data storage devices. As internet traffic increases, so does the number of legal challenges worldwide. Because internet laws differ nationwide, reprisal can range from bedframes to jail, and police agencies can be hard to implement. Cyberlaw protects persons who utilize the Internet or operate an online company. Internet users need to grasp their country’s local community and cyber legislation to identify whether behaviors are allowed or prohibited on the network. They can also keep us from engaging in illegal activities.

1 Introduction

A computer is a configurable machine that normally stores and processes information according to the user’s instructions. In most cases, the user provides these instructions. The proliferation of the Internet and other virtual worlds has made it simpler and more convenient than ever before to transmit data and information across a variety of networks. The internet is used for a broad variety of applications, including as a platform for commerce and financial transactions. Most people who use the internet have some prior computer experience, whether for personal or professional reasons. As a direct result of this, administrators are growing more concerned about vulnerabilities that have not been fixed. Because of this, a new phenomenon known as “Cyber Crimes” has surfaced. As a result, computer crimes, also known as cybercrimes, are defined as offenses perpetrated with the assistance of a computer system or network and often occur in cyberspace, most notably on the Internet. In their most basic definition, cyberattacks are conducted via the use of the communications or technical infrastructure of the internet. A cybercriminal may exploit a device to access private information belonging to a user, sensitive information belonging to the firm, or secret government papers, or they may do so to delete the information. The illegal sale of private information or data via the internet is an example of cybercrime. Criminals that participate in such actions are sometimes referred to as “hackers,” which is a term that describes this sort of offender. As a consequence of this, cybercrime is also often referred to as e-crime, computer-related crime, high-tech crime, online fraud, and new-age crime [45].

Cybercrime has become such a problem today that it is wreaking havoc on people, corporations, and even the government. Many different legal requirements have previously been enacted to address internet-related crimes. The term “Cyber Law” has been disseminated throughout the whole globe ever to encompass that part of the legal system that deals with matters about cyberspace and law, such as concerns with online privacy and safety, among other topics. To put this another way, cyber law might be described as the laws and regulations that regulate cyberspace cyberattacks, digital and electronic signatures, data security and privacy, and other concerns that are addressed by cyber law [45].

2 Literature Review

2.1 Argentina

The E-Signature Law, the Digital Argentina Law, the Telecommunication Law, and the Personal Data Protection Legislation are some of the laws that make up Argentina’s cybersecurity system. Other laws include the Digital Argentina Law and the Telecommunication Law, the Broadband Service Law, and the Cyber-warfare Law. It is vital to note that both civilian and military institutions in Argentina are involved in the cybersecurity field. The Defense Ministry, as well as the National Cyber Security Directorate are the two agencies competing in this field. In addition, a National Cyber Security Working Group has been created (ICIC Cert). However, the cyber security sector has no publicly published national standards or certification systems. The argument suggests that Latin American nations that have higher levels of democracy may have less stringent cybersecurity regulations [39] (Table 1).

Table 1. Categorization of laws in Argentina

2.2 Australia

The computer crime Amendment Act Bill 2011 (the Bill) was adopted by the Australian Parliament. The Bill alters the Telecommunication (Unauthorized access and Accessibility) Act 1979 (the TIA Legislation), the Criminal Act 1995 (the Crimes Act), the Joint Assistance in Criminal Affairs Ordinance (the MA Act), as well as the Telecommunication Act 1997 (the Communications Act) to guarantee compliance with the European commission Convention on Cyber-crime [3]. The Convention urges governments to work together to stop cybercrime by making it a requirement that countries ban four types of online crimes.

• Anomaly Criminal eavesdropping, information leakage, system interference, and device abuse are all examples of offences that jeopardize the availability, integrity, and confidentiality of computer information and services other offences include interception of data without authorization.

• Examples of offences that include the use of computers include forgery and fraud.

• Offences containing material, such as child pornography and.

• Violating copyrights and committing comparable rights violations (Table 2).

Table 2. Categorization of laws in Australia

2.3 Brazil

On the ground, Brazilian law enforcement and military agencies are substantially investing in cyber-security. Despite this, there appears to be a mismatch between the sorts of threats that threaten Brazilian cyberspace and the style of security organization’s reactions. Even though organized crime is one of the most serious dangers to Brazil’s internet, the country’s resources are disproportionately focused on military solutions better suited to the (very uncommon) situation of conventional conflict. Expanding day-to-day law enforcement skills to identify and respond to organized criminal organizations receives less attention. Brazil is adopting an imbalanced approach to cybersecurity due to a lack of a united government perspective on the problem and a lack of trustworthy data. Instead, a tiny group of powerful businesses and individuals are influencing the discussion in ways that will have a major impact on Brazil’s cyber-security architecture in the future. The Unit for Combating Cybercrime (URCC) of the Federal Police is the primary law enforcement body in charge of preventing and responding to cybercrime. This responsibility falls under the umbrella of the Unit for Combating Cybercrime (URCC) [41, 48] (Table 3).

2.4 Canada

The federal government of Canada, based in the Parliament building in Ottawa, is responsible for making national laws, which are subsequently implemented across the country’s 13 jurisdictions (ten provinces and three territories). The federal government of Canada, which the Criminal Code governs, is responsible for establishing (or repealing) new criminal laws. The provincial and territorial administrations are permitted to draught their laws, but these laws may only be enacted within their national borders. Provincial and territorial governments do not have the authority to enact new criminal laws. Still, they do have the authority to penalize those who violate provincial and territorial laws, such as by fining them or sending them to prisons [26].

Table 3. Categorization of laws in Brazil

Table 4. Categorization of laws in Canada

In the latter half of 2014, the Protecting Canadians from Internet Crime Act was passed into law to keep the Canadian Criminal Code and the Canada Evidence Act up to date. Police chiefs from throughout Canada have come out in support of the measure, stating that it will assist in the fight against online bullying and non-consensual sexting involving children and that it’s time t stop those who harass, threaten, and fear them. The Safeguarding Canadians from Online Crime Act did add new Crimes Act infractions for disbursing and transferring a sexual image of a person without their permission and for recording, storing, and spreading child pornography. It also went after cyber espionage and telecommunications signal theft, just like its predecessor, Bill C-30 [26, 43] (Table 4).

2.5 China

Cyber security was first considered at such a high level in President Hu Jintao’s 2012 Work Report to the 18th CCP Congress. A strategy for China’s cyber defense has not been made public. Despite this, it has implemented a variety of different data security procedures. The Chinese approach can be implemented above cyber security and incorporates the common aim of data security. Information security, defined by China, is “based on prior information systems and cybersecurity from unauthorized access, use, evaporation, damage, alteration, and ruination in store their integrity, secrecy, and availability.” At the national level, a strategy paper would need to be released by President Xi Jinping or perhaps the Communist Party’s Federal Congress. In contrast, policy papers are produced at the government level. To achieve this goal, the important announcements made by President Xi have been used as a roadmap to direct the construction of policies implemented at the ministry level. The advancement of the country’s information security industry is governed by the 12th Five-Year Transformation Programme of the Information Governance Sector (2011–15), which was publicly released by the Ministry of Industry Technology. This plan establishes goals and targets for the industry and regulates its growth. On the other hand, the report is much more of an industrialization program than a comprehensive plan for protecting sensitive information [38] (Table 5).

Table 5. Categorization of laws in China

2.6 France

As France continues to expand its cyber capabilities, the ANSSI is increasing its ability to combat cyber threats. Furthermore, the cyber-security policy has emphasized crucial domains of action to achieve the strategic goals of the country, exhibiting a thorough awareness of the issues that have been raised. In addition, the Cyber Defensive Alliance outlines several steps that will increase France’s capacity to react to cyber-attacks. To the goals of the national cyber strategy, these activities have been intended to be implemented with the finances that are now available. As a part of the agreement, financial assistance for academic institutions and small and medium-sized businesses will be provided to foster research and innovation in the business sphere. First and foremost, it’s important that France can protect its most important resources and national goals, even though technology is changing quickly and there are many different ways to attack online [38, 47].

Table 6. Categorization of laws in France

Because of its substantial economic, technical, and intellectual skills in the sphere of cyberspace, France is a leading actor on the global stage. The current institutionalization process, in addition to supporting regulations and the Information Security Pact, has sped up the formation of French cyberspace security and cyber defense capabilities. This is the case even though political participation in the sector began at a very late stage [38, 47] (Table 6).

2.7 Germany

Cybersecurity. Among the laws addressed are data security and e-privacy rules, forms of intellectual property Laws, client confidentiality Laws, data security requirements, and legitimate constraints. Several German laws govern cyber security. It is widely acknowledged that German Security Act is the most significant legal foundation for cybersecurity [47].

Additionally, there are several essential unwritten IT security principles in Germany. The minimum Baseline for Information Technology Security (BSI), Basic Guidelines for Cybersecurity Evaluation-2012, established as ISO/IEC 15408, and the objective for control of information and associated technology (COBIT) are all contained in this document [47] (Table 7).

Table 7. Categorization of laws in Germany

2.8 India

The Legislation of 2000, which was modeled after the General Assembly Model The International Law produced the Law on Electronic Transactions Commission Maastricht Treaty (UNCITRAL), is India’s major computer crime and e-commerce statute. Originally, the Act was divided into 94 parts including 13 sections and a total of four schedules. The Act is applicable across the whole of India., as well as actions or breaches done by anybody, regardless of nationality, beyond India’s borders. The Act grants electronic records legal power and greatly simplifies the remote filing of documents with government agencies [27].

The Information Technology Act of 2000 has four main objectives:

• To guarantee legal recognition of digital records.

• To enable the official status of digital signatures. Traditional signatures are vulnerable to fabrication and alteration, making them unfit for use in online transactions and contracts. Digital signatures provide the unique and powerful protection those online transactions demand.

• To give electronic administration legal status. The phrase e-governance refers to a technology-driven government that uses technology to offer services, information, and education more efficiently.

• To impose penalties for cybercrime. The Indian Penal Code of 1860 was insufficient to address the rising threat of cybercrime. These offences were both unique and high-tech, necessitating a new category under the Information Technology Act of 2000 [27] (Table 8).

Table 8. Categorization of laws in India

2.9 Indonesia

When it comes to ensuring the safety of its computer networks, Indonesia already has a framework and policy in place, both of which are carried out by various government agencies as well as by the general population. The Cabinet of Communication and Information Technology is responsible for cyber security policy (MCI). Three government entities in Indonesia are involved in the field of cyber security. These organizations include the Information Security Coordinating Team and the Director of Indonesia Security Operations Team on Internet Connections and Information Security (ID-SIRTII) [50].

In April 2010, the Internet Security Interoperability Team was created to co-ordinate computer security, with a focus on technology and information competency and practices. The Director of Information Security is important for policy creation and implementation, education, surveillance, evaluation, and reporting in the area of data security governance. Depending on the Ministry of Communications and Informatics Regulatory Oversight No. 8 of 2012, the government established ID-SIRTII to oversee the security of internet infrastructure [50] (Table 9).

Table 9. Categorization of laws in Indonesia

2.10 Italy

The introduction of the internet in the middle of the 1990s led to an increase in the Italian police’s understanding of cybercrime, which in turn caused them to grow concerned about issues related to cyber security. A unit for telecommunications was founded in 1996, and two years later, in 1998, the Postal and Communications Police Service came into being. A task force was established by the Financial and Border Police (Guardia di Finanza) in the year 2001 [40].

In 2010, the House National Council on Intelligence and Security Service of the Italian government issued the first formal public assessment of Italy’s national cyber security problems. The Italian government commissioned this study. The concept of asymmetric cyber threats was put up in the paper, which also described cyberspace as the “new battlefield” of the 21st century and the “scenario of geopolitical conflict.” The report focused on four primary concerns: Cybercrime, cyberterrorism, cyberespionage, and cyber-warfare are all examples of cybercrime. According to the study’s findings, Cyber security is a strategic problem and a threat to public safety [38]. One of Italy’s strengths in terms of its cyber security policy is the presence of police systems specifically designed to fight cybercrime. The enforcement of copyright laws, child pornography on the internet, computer hacking, malware, and fraudulent E-commerce transactions, are the primary areas of concentration for the activities of the Postal and Communications Police Service. Fraud committed through digital means is the primary target of the Guardia di Finanza task force. The Carabinieri has both a cybercrime special investigative branch and a piece of information and communications technology security section [38] (Table 10).

Table 10. Categorization of laws in Italy

2.11 Japan

Japan ranked fourth among the countries of the Asia Pacific territory relative to the number of people who use the internet in January 2021, with over 117 million them. Security concerns have emerged as one of Japan’s most pressing internal challenges as a direct result of the growing significance of digitalization to the country’s economy and the people’s day-to-day lives. In 1973, the Tokyo District Court was the venue for the hearing of Japan’s first case involving a criminal offense employing a computer. This wasn’t a criminal case; rather, it was a civil dispute between two parties. However, the theft of data was the primary worry in this instance. Nikkei Shimbun, which is a well-known news organization in Japan, and McGraw-Hill at the time established Nikkei McGraw-Hill. The plaintiff was awarded 2,039,420 Japanese Yen in damages, and the defendant was ordered by the Tokyo District Court to pay a portion of the plaintiff’s expenditures and damages [38].

It is now criminal in Japan under the Cybersecurity Act to access the system without authorization. This Law aims to avoid computer-related crimes committed via telecommunication links and to maintain telecommunications network order, as realized through physical access features, by restricting acts of unauthorized computer access and specifying penalties for that acts, as well as additional Encourage regional public safety commissioners to implement preventative steps to reduce the likelihood of similar incidents happening in the future and hence making contributions to the better and healthier development of the nation. This Act was passed to accomplish these goals [38] (Table 11).

Table 11. Categorization of laws in Japan

.

2.12 South Korea

The incidence of cyber-attacks has risen, and the society of the Republic of Korea is now susceptible to the threats posed by the Democratic People’s Republic of Korea. This is because computer networks and information systems play such a significant role in the day-to-day lives of people. Legislation and national strategies that are up to par are required to respond effectively to internal and external cyber-attacks. As part of the Republic of Korea’s ongoing efforts to protect the nation, several laws and regulations have been enacted as a direct result of these efforts [42] (Table 12).

Table 12. Categorization of laws in South Korea

In 2002, the Republic of Korea’s government passed the Critical Information Infrastructure Protection Act, emphasizing the need of protection as a matter of national security. Critical data infrastructure must be protected from cyberattacks. This law has been in effect ever since. To defend CII from cyberattacks, the Act mandated the creation of a national agency and imposed rules on CII designation, vulnerability assessment and protection measures, cyber incident response, and punishments [42].

In addition, to enhance the nation’s overall cyber security, Korean policy-makers and legislators have recently held several hearings, and they have also passed the Cyber Security Industry Enhancement Act. This Act gives Central and local administrations in Korea, as well as municipalities, the ability that devise and carry out policies that promote cyber security, as well as prepare measures to allocate budgets to support those policies [42].

Members of the National Assembly proposed a measure that would solely focus on protecting personal information. The proposal was approved on March 29, 2011, and the Act has been in effect since September 30, 2011. The Act addresses the obligations that must be fulfilled by managers of personal information and relevant ministers of the government [42].

2.13 Mexico

The Mexican Working Group on Combating Cybercrime (CERT-MX) and the Electronic Digital Signature act were both made. Also, Cybersecurity Standards were made, but you don’t have to use any of the official certification methods.

Table 13. Categorization of laws in Mexico

This could be because the government doesn’t want to “over-regulate” the cybersecurity business. The National Information Security Strategy of Mexico was made by a committee on special information security. This plan was put in place by Mexico (CESI). In official papers in Mexico, the word “cybersecurity” appears sparingly, although the term “information security” appears often. The police force in Mexico is in charge of the cybersecurity of the country. Mexico’s role in international cooperation is limited to its commitment to the United Nations and the Organization of American States’ fight against cyber-terrorism and cyber-crime [39] (Table 13).

2.14 Russia

Most of Russia’s laws about data protection and privacy were passed in 2005 and 2006, so this area of the country’s legal code is growing quickly. The Russian Federal Data Protection Law (No. 152-FZ), which went into effect on July 27, 2006, serves as the cornerstone of Russian privacy laws, and data controllers are obligated to adopt “all essential organizational and technological measures needed for securing personal data from unauthorized or accidental access.” The Federal Service for the Supervision of Communication, Information and Technology, and Mainstream Media makes sure that everyone is following the rules [42].

Individuals are generally expected to provide their consent before their data is processed; however, this regulation does not apply in cases where the customer is a signatory to an agreement that requires the processing of their personal Federal Service on Telecommunications, which is responsible for data protection and privacy, has declared in the past that appropriate protection only exists among foreign jurisdictions where the Agreement for the Protection of Individuals Regarding Automatic Processing of Private Information has been signed and ratified. However, three key exclusions enable private data to be sent to nations with a lower level of personal data protection or with no obligation at all. On September 1, 2015, a new clause referred to as “Article 18(5)” comes into force, imposing further restrictions on the transmission of data [38].

In Russia, direct marketing, data processing, and management of all data are subject to stringent regulations. Personal data must be adequately protected by applicable laws and the Federal Security Service is currently in the process of formulating required data protection regulations. The regulations mandate the use of encryption to protect any personally identifiable information that is sent outside of Russia, and it is expected that only Russian encrypted software and hardware would be used [49] (Table 14).

Table 14. Categorization of laws in Russia

2.15 Saudi Arabia

The number of instances of cybercrime has been steadily increasing all over the world. As a direct consequence of this, ensuring cyber security is essential. It is critical to have adequate technological procedures for cyber-security in place. Nevertheless, the establishment of a legislative structure that allows for cyber-security is also a crucial component. Every nation’s governing body should enact basic criminal legislation to combat cybercrime to boost the level of trust and confidence that users have in cyberspace [37].

The Saudi Arabian Anti-Cyber Crime Law was finally approved in March 2007. (ACC). According to the ACCL, unauthorized access is defined as any person’s deliberate computer access, internet sites, data management, and computer networks that are not permitted by the owner of such resources. This legislation provides both a definition of what it means to commit a crime online as well as the accompanying punishments for doing so. The Saudi ACCL has all of the essential qualities critical to safeguarding the network’s integrity Despite this, there are still several areas in which the Saudi ACCL has room for improvement to become more successful [37] (Table 15).

Table 15. Categorization of Laws in Saudi Arabia

2.16 South Africa

Particular cybercrime law has been enacted in South Africa, and it goes under the name of the Electronic Communications and Transaction Act [17], By Chapter 13 of this Act, the following behaviours are considered unlawful: The first clause of Section 86(1) makes it illegal to intercept or access information without authorization.

• Unauthorized willful interference with information that results in the information’s change, ineffectiveness, or destruction is a violation of Section 86(2) of the Computer Fraud and Abuse Act.

• (Articles 86(3) and 86(4)): Avoiding security safeguards by any means, such.

• as advertising, spreading, or owning a gadget designed to do just that.

• An attack that results in a whole or partial denial of service is considered to violate Section 86(5).

• (Section 87): Theft, fraud, and counterfeiting that include the use of computers.

• Attempting any of the conduct listed above, as well as helping and abetting in any of the activities listed above, is a violation of Section 88 of the Criminal Code [17] (Table 16).

Table 16. Categorization of laws in South Africa

2.17 Turkey

In October 2010, the Information and Communication Technologies Authority advised providers of telecommunications services to conform with the standards established by ISO 27001. In July 2014, the regulatory body established a new, stricter criterion for determining compliance with ISO 27001. (ICTA, 2014). The Telecommunications and Computer Security in the Communications Sector Act specifies the requirements for security countermeasures and information system attributes, as well as the external and internal audit mechanisms that must be implemented by operators [46].

The Banking Regulation and Supervision Agency have been responsible for the creation of several pieces of financial legislation. In January 2008, the BSRA published a legal announcement about the management of bank information security. The announcement includes a variety of measures, including Management of information security risks, management responsibility, internal audit, outsourcing regulations, function separation, and other issues (BRSA, 2007), (BRSA, 2010) [46]. Just one more piece of law lays forth the standards for independent external auditors to follow while conducting assessments of banks’ information systems (Table 17).

Table 17. Categorization of laws in Turkey

In February 2014, the Electronic Communications Law went through a round of revisions to reflect decisions taken by the cabinet in October 2012. (Turkish Cabinet, 2014) As a direct effect of these many adjustments:

• ECL was tasked with putting together the Cyber Resilience Council from the ground up. The leader of the Cyber Defense Commission is the Minister of Transport, Maritime Affairs, and the Cyber Security Interim president. For example, one task that fell under the council’s purview was to provide final approval to a list of important infrastructure.

• An explanation of the Transportation Ministry, Communications Ministry and Maritime Affairs’ cyber security responsibilities were provided. Identifying vital infrastructures, as well as their owners and the locations of such infrastructures, was one of the ministry’s objectives.

2.18 United Kingdom

In the year 2000, the Electronic Communications Act was passed into law by the legislature of the United Kingdom. Encryption, encrypted communication services, and electronic signatures are some of the growing trends that were targeted by the act, which was passed to help with the monitoring and supervision of new trends in the eCommerce industry [8].

To ensure the legitimacy of electronic signatures and to regulate cryptographic services within the United Kingdom, a law was required to be developed and passed into law. The Electronic Communications Act of the United Kingdom is broken up into three distinct sections, each of which provides regulations and protections about a different facet of the subject matter that is detailed further below.

The First Section: Cryptographic Service Providers. E-commerce and the convenience of data storage are covered in Part 2. (Which is inclusive of eSignatures). The third section will include supplementary and other items (Table 18).

Table 18. Categorization of laws in United Kingdom

Laws such as the United Kingdom Electronic Communications Act (2000) and the Electronic Signatures Ordinance of 2002 encourage and support robust e-Commerce activity for businesses while also improving the security and legitimacy of these forms of digital payments for customers [8].

2.19 United State of America

The United States of America was the world’s first nation to pass legislation specifically addressing data privacy, which was known as “The Privacy Act of 1974.” Information from a monitoring system can’t be released without the explicit agreement of the individual in question, according to the Privacy Act. Unless the disclosure falls under one of twelve statutes about the subject material of the record. The relevance of revising laws governing cyber security is closely tied to digital change, cybercrime, and the investigation of cyber forensics. An integrated digital cyber legal system is required for a movement toward tech-centric smart cities and cyber-confident citizenship. Without such a system, the process of establishing the digital transformation and environment may become more disjointed. “Technology removes the need for, and indeed the ability to focus on specific, localized activity.” This results in a new 2 The network is a type of social organization that is arranged in a physical domain. “Physical constraints, proximity, patterns, and scale are all important characteristics of verifiable wrongdoing. “Communication technologies liberate us from the constraints of the empirical world; we can communicate with anyone, from anywhere, in real-time.“ Technology removes the need for, and It is not required that the victim and the perpetrator be located near one another. “Because cybercrime is an unbounded crime, the victim and the perpetrator can be in different cities” [32]. “Cybercrime is a crime with no physical boundaries.” (Table 19).

Table 19. Categorization of laws in United State

2.20 European Union

The Network and Information Security Agenda in 2001, the very first e-Privacy Guideline in 2002, the setup of ENISA in 2004, the Critical Information Infrastructure Information exchange in 2009, the Digital Ideology for Europe in 2010, and the EU Cybersecurity Strategy in 2013. All of these steps were taken by the European Commission. However, to what extent did it exert its influence? We have raised awareness between many elected figures, industry Chief executives, and the Computer Emergency Responders team in each of our 28 member countries. The majority of member states have already developed comprehensive national cybersecurity strategies. However, there is no comprehensive European Union policy document for network and data security. This system would need to include full event reporting (similar to what is done in the telecoms sector), as well as trustworthy communication about risks and attacks. Under NIS policy, which is designed to address these issues and is now the subject of negotiations between the European Council and the Parliament, which is currently under construction. The fact that cyber-security is widely regarded as a component of national security, and consequently comes within the purview of national sovereignty, continues to be a barrier to progress. As a consequence of this, there is still a significant distance to go before Europe will have cyberspace that is both open and safe (Table 20).

Table 20. Categorization of laws in European Union

3 Conclusions

In this paper, We have analyzed the various laws of the G20 countries. We have identified their associated pros and cons and briefly summarized them. The article also presents a comparative study between them and suggests how the individual G20 country makes its decision by applying associated laws for a particular issue.