The Business Law Playbook Series — Criminal Law, Cyber Crime & Corporate Liability
Summary: Playbook 3 examines criminal law in the business context, covering the classification of crimes, the elements of criminal liability, white-collar offenses, criminal procedure and constitutional protections, cyber crime and computer fraud, and corporate criminal liability — including the doctrines of vicarious liability, deferred prosecution agreements, and non-prosecution agreements.
Chapter 6 — Criminal Law and Cyber Crime
6.1 Classification of Crimes
Crimes are classified based on their severity, the nature of the offense, and the applicable penalties. Understanding these classifications is essential for businesses to assess potential liability and regulatory exposure.
Felonies, Misdemeanors, and Infractions — Felonies are the most serious crimes, punishable by imprisonment for more than one year or death. Misdemeanors are less serious offenses, punishable by imprisonment for one year or less and fines. Infractions are minor violations, typically punishable only by fines, with no jail time.
Criminal vs. Civil Law — Criminal law involves government prosecution of individuals or entities for violations of criminal statutes. The government must prove guilt beyond a reasonable doubt. Civil law involves private disputes between parties, with remedies including monetary damages, and proof is by a preponderance of the evidence.
Crimes Against Persons — These include homicide (murder and manslaughter), assault, battery, kidnapping, and false imprisonment. In the business context, crimes against persons may arise in workplace violence or executive protection situations.
Crimes Against Property — These include larceny (theft), embezzlement (theft by a person with lawful possession), robbery (theft by force or threat), and burglary (unlawful entry with intent to commit a crime). These offenses are common in white-collar and employee misconduct cases.
Crimes Against the Government — These include treason, espionage, and certain regulatory offenses. In business, crimes against the government often involve tax evasion, bribery of public officials, and violations of export control laws.
Inchoate Crimes — These are incomplete crimes that involve steps toward committing another offense. They include attempt (taking a substantial step toward committing a crime), solicitation (asking another to commit a crime), and conspiracy (agreeing with another to commit a crime).
6.2 The Elements of a Crime
For an act to constitute a crime, the prosecution must prove certain elements beyond a reasonable doubt. Understanding these elements is critical for businesses defending against criminal charges.
Actus Reus (The Criminal Act) — The physical act or omission that constitutes the crime. The act must be voluntary and prohibited by law. Omissions can constitute actus reus only when there is a legal duty to act, such as a contractual obligation or statutory requirement.
Mens Rea (The Criminal Intent) — The mental state or intent of the defendant at the time of the act. Under the Model Penal Code, mens rea levels include purposely (conscious objective), knowingly (awareness of the result), recklessly (conscious disregard of a substantial risk), and negligently (failure to perceive a substantial risk).
Concurrence — The requirement that the actus reus and mens rea occur simultaneously. The defendant must have the required mental state at the time of the criminal act.
Causation — The requirement that the defendant's act caused the harm. Actual cause (but-for cause) and proximate cause (foreseeability) must both be established.
The Attendant Circumstances — Additional facts that must be proven for the crime to have occurred, such as the victim's age, the value of stolen property, or the defendant's status as a public official.
6.3 Criminal Liability
Criminal liability requires the prosecution to prove both the prohibited act and the required mental state. Various defenses may negate liability.
Omissions and Failures to Act — A person may be criminally liable for failing to act when there is a legal duty, such as a statutory obligation, contractual duty, or special relationship creating a duty to act.
The Four Levels of Mens Rea — Under the Model Penal Code, the levels of mens rea are purposely, knowingly, recklessly, and negligently. The required level depends on the specific offense definition.
The Model Penal Code Approach to Mens Rea — The MPC provides a uniform framework for defining mental states, adopted by many states. It requires that each element of an offense be accompanied by one of the defined mental states unless strict liability is specified.
Strict Liability Offenses — Some offenses do not require mens rea. The prosecution need only prove the actus reus. Strict liability is common in regulatory offenses (e.g., environmental violations, food safety violations) where the public interest is significant.
The Defense of Mistake — Mistake of fact may be a defense if it negates the required mens rea. Mistake of law is generally not a defense, except in limited circumstances where the law is reasonably relied upon.
The Defense of Insanity — The defendant must show that, due to a mental disease or defect, they lacked substantial capacity to understand the wrongfulness of their conduct or to conform their conduct to the requirements of law.
The Defense of Duress and Necessity — Duress is a defense when the defendant was coerced to commit a crime by threat of imminent death or serious bodily harm. Necessity is a defense when the defendant acted to prevent a greater harm.
The Defense of Entrapment — A defense when government agents induced the defendant to commit a crime they would not have otherwise committed.
The Defense of Self-Defense and Defense of Others — A person may use reasonable force to defend themselves or others from imminent harm. Deadly force is permitted only when facing deadly force.
6.4 White-Collar Crime and Business Offenses
White-collar crime refers to non-violent, financially motivated offenses committed by individuals or organizations in business and professional contexts. The term was first defined by Edwin Sutherland and has since become a central focus of corporate criminal law.
The Nature of White-Collar Crime — White-collar crime involves deceit, concealment, or violation of trust for financial gain. It does not involve physical violence but can cause significant economic and social harm. Corporate financial crime has been referred to as a "complex subject on many levels" where "efforts at strict definitional exactitude rapidly become self-defeating."
Fraud — Fraud involves intentional misrepresentation of material fact to induce another to act to their detriment. Types include securities fraud (misrepresenting financial information to investors), wire fraud (using electronic communications to perpetrate fraud), mail fraud (using the postal system), and bank fraud (defrauding a financial institution).
Bribery and Kickbacks — Bribery involves offering, giving, receiving, or soliciting something of value to influence official action. Kickbacks are a form of bribery where a person returns a portion of payments to the payor in exchange for business.
Embezzlement and Theft by Employee — Embezzlement is the fraudulent taking of property by a person with lawful possession, such as an employee or fiduciary. It differs from larceny because the property was lawfully obtained initially.
Insider Trading — The buying or selling of securities based on material, non-public information. It violates the duty of confidentiality owed to shareholders and the corporation. Insider trading is prohibited under securities laws and can result in criminal prosecution.
Money Laundering — The process of concealing the origins of illegally obtained money, typically by passing it through complex transactions and businesses. Money laundering is a global concern, with international cooperation required to combat it effectively.
Tax Evasion and Tax Fraud — The deliberate underpayment of taxes through fraudulent means, such as underreporting income, claiming false deductions, or hiding assets. Tax evasion is a criminal offense separate from civil tax deficiencies.
Environmental Crimes — Criminal violations of environmental laws, including illegal dumping, discharge of pollutants, and violation of permit conditions. Environmental crimes can result in significant fines and imprisonment.
The Racketeer Influenced and Corrupt Organizations Act (RICO) — RICO is a federal law designed to combat organized crime by making it illegal to participate in or acquire an enterprise through a pattern of racketeering activity. RICO has been used against corporations and business organizations for white-collar offenses. Expanding the RICO Act to include cybercrimes has been proposed to increase prosecutorial power.
6.5 Criminal Procedure and Constitutional Protections
The Constitution provides numerous protections for individuals accused of crimes, including businesses and their executives.
The Fourth Amendment and the Exclusionary Rule — The Fourth Amendment protects against unreasonable searches and seizures. Evidence obtained in violation of the Fourth Amendment is generally excluded from trial under the exclusionary rule. Businesses have some Fourth Amendment protections, though they are less robust than for individuals.
The Fifth Amendment and Self-Incrimination — The Fifth Amendment protects against compelled self-incrimination. Individuals may refuse to answer questions that would incriminate them. Corporations receive limited Fifth Amendment protection, as the privilege against self-incrimination does not apply to corporate entities.
The Sixth Amendment — The Sixth Amendment guarantees the right to counsel (including effective assistance of counsel), the right to a speedy and public trial, the right to an impartial jury, the right to confront witnesses, and the right to compulsory process for obtaining witnesses.
The Eighth Amendment — The Eighth Amendment prohibits cruel and unusual punishment and excessive bail. In the corporate context, excessive fines may be challenged under the Eighth Amendment, particularly in regulatory enforcement actions.
The Exclusionary Rule and the Fruit of the Poisonous Tree Doctrine — Under the fruit of the poisonous tree doctrine, evidence derived from illegal searches or seizures is also excluded from trial. This doctrine prevents the government from benefiting from its own constitutional violations.
The Miranda Warnings and Interrogation — The Fifth Amendment requires that law enforcement inform suspects of their rights (Miranda warnings) before custodial interrogation. Failure to provide warnings results in the exclusion of statements obtained.
6.6 Cyber Crime and Computer Fraud
Cyber crime is a growing threat to businesses, involving unauthorized access, data breaches, ransomware, and other computer-related offenses. Global ransomware attacks were expected to account for about $20 billion in losses, and the true cost of cybercrime worldwide is estimated to reach $10.5 trillion annually.
The Computer Fraud and Abuse Act (CFAA) — The CFAA is the primary federal statute criminalizing unauthorized access to computers and networks. It prohibits accessing a protected computer without authorization or exceeding authorized access. The CFAA imposes felony liability on whoever "knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer."
Hacking and Unauthorized Access — Unauthorized access involves gaining entry to a computer system without permission. The CFAA applies to external hacking and internal misuse. The "code-based theory" of the CFAA imposes liability on someone who illegally obtained a password or circumvented a technological barrier, while a user who violates use restrictions but does not circumvent barriers may not be liable under the CFAA. Critics argue the CFAA's broad interpretation may be unconstitutional on vagueness grounds.
Identity Theft and Phishing — Identity theft involves stealing personal information to commit fraud. Phishing uses fraudulent communications to obtain sensitive information. These offenses are prosecuted under various federal and state statutes.
Ransomware and Malware — Ransomware is malicious software that encrypts data and demands payment for decryption. The scale and scope of cyberattacks have increased dramatically in recent years, spurred by growing reliance on technology, increased connectivity, and the rise of virtual currency exchanges. Ransomware attacks are predicted to result in $265 billion in losses by 2031.
Data Breach and Theft of Personal Information — Data breaches involve unauthorized access to personal information, resulting in theft, exposure, or misuse of data. Recent case examples include a former university student who orchestrated a multi-year cyberattack campaign, facing 20 criminal charges for unauthorized access, data exfiltration, and threats to sell stolen student information on the dark web.
Cyber Terrorism and National Security — Cyber terrorism involves politically motivated cyberattacks that threaten national security. State-sponsored cyber operations and cyber terrorism are growing concerns, with governments seeking to develop legal frameworks for attribution and response.
The Extraterritorial Reach of Cyber Crime Laws — U.S. courts have applied the CFAA and other cybercrime statutes to conduct occurring abroad, raising jurisdictional questions. The global nature of cybercrime requires international cooperation and harmonization of laws.
6.7 Corporate Criminal Liability
Corporations, as juridical persons, can be held criminally liable for offenses committed by their employees and agents. The common law provides that corporations are qualified to breach certain offenses under the criminal law because of their legal identity.
The Doctrine of Respondeat Superior (Corporate Liability for Employee Actions) — Under respondeat superior, an employer is liable for the acts of employees committed within the scope of employment. This doctrine applies to criminal as well as civil liability, making corporations responsible for employee misconduct.
The Vicarious Liability of the Corporation — Vicarious liability holds corporations liable for employee actions regardless of whether the corporation knew or authorized the conduct. Early common law recognized that corporations could be vicariously criminally liable for public nuisances created by employees, with railroads being highly exposed.
The Responsible Corporate Officer Doctrine — This doctrine allows prosecution of corporate officers for regulatory offenses even if they lacked actual knowledge of the violation, based on their position of authority and responsibility.
The Compliance Program as a Defense — An effective compliance program can serve as a mitigating factor or defense in corporate criminal cases. Compliance programs demonstrate that the corporation has taken steps to prevent misconduct and cooperate with authorities.
Deferred Prosecution Agreements (DPAs) — DPAs allow corporations to avoid criminal prosecution by agreeing to pay fines, implement compliance reforms, and cooperate with investigations. The agreement is filed with the court, and a waiver of the Speedy Trial Act is required. It is unresolved whether the court can oversee the deferred prosecution agreement pursuant to the Speedy Trial Act waiver. DPA proliferation has been significant since the Enron-era reforms.
Non-Prosecution Agreements (NPAs) — NPAs are similar to DPAs but do not involve filing criminal charges. Under an NPA, the government agrees not to prosecute if the corporation complies with specified conditions, such as paying penalties and implementing reforms. Monitors report exclusively to the DOJ, as the agreement is not part of a court proceeding.
Corporate Sentencing Guidelines — The U.S. Sentencing Guidelines provide a framework for sentencing organizations convicted of crimes. The guidelines consider the nature of the offense, the corporation's history, and the effectiveness of compliance programs.
The Sarbanes-Oxley Act and Corporate Criminal Liability — The Sarbanes-Oxley Act of 2002 enhanced criminal penalties for corporate fraud, imposed new certification requirements on executives, and encouraged the use of DPAs. The Enron scandal and the prosecution of Arthur Andersen LLP demonstrated the devastating consequences of corporate criminal convictions, leading to widespread adoption of DPAs.
Contemporary Economic Crime: Introduction - Taylor & Francis
Deferred Prosecution Agreements and Non-Prosecution Agreements - Corporate Crime Reporter
Corporate Criminal Liability: History and Development - Giurisprudenza Penale
The Changing Role of Criminal Law in Controlling Corporate Behavior - Penn State University
FAQ
What is the Computer Fraud and Abuse Act (CFAA) and how does it apply to businesses?
The CFAA is the primary federal statute criminalizing unauthorized access to computers and networks. It prohibits accessing a protected computer without authorization or exceeding authorized access. The CFAA imposes felony liability on whoever "knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer." Businesses must be careful about employee access and use restrictions, as a broad interpretation of the CFAA could impose liability on employees who misuse lawfully accessed data.
What is the difference between a Deferred Prosecution Agreement (DPA) and a Non-Prosecution Agreement (NPA)?
A DPA involves publicly filed criminal charges and an agreement filed with the court deferring prosecution, requiring a waiver of the Speedy Trial Act. The court's oversight role is unresolved. An NPA is not part of a court proceeding and does not involve filing charges; monitors under an NPA report exclusively to the DOJ. Both agreements require corporations to pay fines, implement compliance reforms, and cooperate with investigations. Prosecutors often view monitors as a necessary cost of rehabilitation.
How can a corporation be held criminally liable for employee conduct?
Corporations can be held criminally liable under the doctrine of respondeat superior for employee acts committed within the scope of employment. The identification principle in common law jurisdictions requires proof of a specific state of mind by the company's "directing mind and will," which can be easier to prove for smaller companies but more challenging for large, dispersed entities. Some jurisdictions, like Australia, use more contemporary models where companies can be found liable if there is a culture of non-compliance or misconduct endorsed by senior management. The UK has introduced "failure to prevent" offenses for bribery and tax evasion.
What are the most common types of white-collar crime in business?
Common white-collar offenses include fraud (securities fraud, wire fraud, mail fraud, bank fraud), bribery and kickbacks, embezzlement, insider trading, money laundering, tax evasion, and environmental crimes. RICO has also been used against corporations for patterns of racketeering activity. These offenses can result in significant fines, imprisonment, and reputational damage.
References
Contemporary Economic Crime: Introduction - Taylor & Francis
Contemporary Economic Crime: Issues and Challenges - Sack Fachmedien
Deferred Prosecution Agreements and Non-Prosecution Agreements - Corporate Crime Reporter
Corporate Criminal Liability: History and Development - Giurisprudenza Penale
The Changing Role of Criminal Law in Controlling Corporate Behavior - Penn State University
Hacking from the Inside-Out: CFAA and Employee Liability - NYU Moot Court Board
Prosecuting Cybercrimes: CFAA and RICO - Southern California Law Review
Former University Student Arrested for Cyber Attacks - Cyber Press
Cyber Privateers: Government-Authorized Cyber Operations - BakerHostetler
Comments
Post a Comment