Cybercrime offences in the Criminal Code

On Thursday, March 19, 2026, five weeks after Grace Whitford lost her savings, an 84-year-old Port Ardent man named Harold Mercer received a call from someone claiming to be his grandson. Mercer's bank had been warned about grandparent scams by Detective Ellen Park's unit, and when he asked to withdraw 12,000 dollars in cash, the teller quietly called the police. Mercer was told by the caller that a courier would come to his door at four o'clock to collect the bail money. At 4:05 a young man in a grey car parked outside Mercer's house, walked to the door and was arrested by two plainclothes officers waiting inside. His name was Jordan Pike, he was 22, and he had a phone in his hand with an open conversation on a messaging app.

Park joins Desjardins as a guest for the whole course. She tells the class that the moment Pike was arrested, she had to answer a question that sounds simple: arrested for what? Choosing the right offence matters for the arrest itself, for the grounds in any warrant application, for what evidence must be gathered, and for the eventual charge. This lesson surveys the offences that apply to cybercrime and shows how they fit the facts of Grace's and Mercer's cases.

The approach of the law

Canada has no single cybercrime statute. Most cybercrime is prosecuted under general Criminal Code offences such as fraud, extortion, criminal harassment and identity fraud, which apply whatever the means used. A small group of offences was added specifically for computers, beginning in 1985 with unauthorized use of a computer and mischief in relation to data. Later amendments added offences for online luring of children, the non-consensual distribution of intimate images, and devices used to commit computer offences. Canada is also a party to the Council of Europe's Budapest Convention on Cybercrime, which commits it to have certain offences and investigative powers in its law and to cooperate with other countries. The result is that an officer rarely needs a special cybercrime charge. Most of the time the question is which ordinary offence the facts prove.

Offences against computers and data

Section 342.1 of the Criminal Code makes it an offence to fraudulently and without colour of right obtain a computer service, intercept a function of a computer system, or use a computer system with intent to commit one of those offences or mischief to data. It also covers using or trafficking in computer passwords that would let someone do those things. It is the closest Canadian law has to a hacking offence, and it carries up to ten years when prosecuted by indictment. Section 342.2 makes it an offence to make, possess, sell or distribute a device, including a program, designed or adapted primarily to commit those offences, knowing its purpose.

Section 430(1.1) creates the offence of mischief in relation to computer data: wilfully destroying or altering data, making data meaningless, useless or ineffective, obstructing or interfering with the lawful use of data, or denying access to data to a person entitled to it. Encrypting a business's files and demanding money is mischief to data as well as extortion. Flooding a website with traffic so customers cannot use it can be mischief to data.

Fraud and identity offences

Fraud under section 380 is committed by anyone who, by deceit, falsehood or other fraudulent means, defrauds the public or any person of property, money or valuable security or any service. The Supreme Court described the elements in R. v. Théroux (1993): a dishonest act and a deprivation, or a risk of deprivation, caused by it, with knowledge of the act and that it could cause the deprivation. Fraud over 5,000 dollars carries up to fourteen years. Section 380.1 directs sentencing judges to treat certain features as aggravating, including the magnitude and complexity of the fraud, the number of victims and the impact on them, considering their personal circumstances such as age and health. Identity theft under section 402.2 is obtaining or possessing another person's identity information in circumstances giving rise to a reasonable inference that it will be used for fraud or another offence. Identity fraud under section 403 is fraudulently impersonating another person to gain an advantage or cause a disadvantage. Possessing property obtained by crime, section 354, and laundering proceeds of crime, section 462.31, often apply to the people who receive and move the money.

Park explains how she thought about Pike. He had not made the calls to Grace or Mercer, and there was no evidence yet that he knew Grace's case existed. But he had come to Mercer's door to collect money he had reason to know was obtained by a lie. The arrest was for attempted fraud over 5,000 dollars, as a party to the offence. A person who aids or abets an offence is a party to it under section 21 of the Criminal Code, and Pike's role, collecting the cash, was an essential part of the scheme. Later evidence from Pike's phone would decide whether more could be charged.

Extortion, threats and harassment

Extortion under section 346 is committed by anyone who, without reasonable justification or excuse and with intent to obtain anything, by threats, accusations, menaces or violence induces or attempts to induce any person to do anything or cause anything to be done. It covers ransomware demands, threats to release stolen data, and sextortion, the threat to share sexual images unless the victim pays or sends more. Criminal harassment, section 264, covers repeated communication or watching that causes a person reasonably to fear for their safety, and applies fully to online conduct. Uttering threats, section 264.1, covers threats of death, bodily harm or damage sent by any means. Section 372 makes it an offence to send false information with intent to injure or alarm, or repeated harassing communications.

Intimate images and the exploitation of children

Section 162.1, added in 2015, makes it an offence to knowingly publish, distribute, transmit, sell, make available or advertise an intimate image of a person knowing that the person did not consent, or being reckless as to whether they consented. An intimate image is a visual recording of a person who is nude, exposing their genital or anal region or breasts, or engaged in explicit sexual activity, made in circumstances that gave rise to a reasonable expectation of privacy, where the person retains that expectation. Amendments that received royal assent on June 18, 2026 extended the offence to sexually explicit deepfakes, made threats to distribute such images more clearly an offence, and raised the maximum penalty. Offences involving the sexual exploitation of children online include making, distributing, possessing and accessing child sexual abuse material under section 163.1, and luring a child by telecommunication under section 172.1. Lesson 5 covers how these cases are handled.

Proving the elements online

Each offence has elements that must be proved beyond a reasonable doubt, and online offences present particular problems of proof. The first is identity: showing that the accused, not someone else using the same account or device, did the act. Account records, device possession, passwords, location data and patterns of use are pieced together to answer it. The second is intent or knowledge. Pike might say he thought he was picking up a legitimate package for a delivery job. His messages, what he was paid, and what he was told would decide whether that was believable. The third is jurisdiction: showing that the offence has a real and substantial link to Canada, which is usually easy when the victim is local, even if the offender was abroad.

Desjardins tells the class that the most common mistake in cybercrime charging is not choosing the wrong section but failing to collect the evidence the right section needs. An officer who seizes a phone but does not record who had it, where, and whether it was unlocked, makes the identity element harder. An officer who takes the victim's account of the call but not the time and the number shown makes the link to call records harder. Every later lesson connects back to the elements.

# Checking whether a draft file covers each element of the charge
elements = {
    "deceit or other fraudulent means": ["victim statement", "call recording or script"],
    "deprivation or risk of it": ["bank records", "victim statement"],
    "the accused did the act": ["arrest observations", "phone in hand", "messages"],
    "knowledge": ["messages", "payment to the accused"],
}
collected = {"victim statement", "bank records", "arrest observations", "phone in hand"}
for element, sources in elements.items():
    have = [s for s in sources if s in collected]
    missing = [s for s in sources if s not in collected]
    status = "covered" if have else "GAP"
    print(f"{element:35} {status:8} have={have} missing={missing}")

deceit or other fraudulent means    covered  have=['victim statement'] missing=['call recording or script']
deprivation or risk of it           covered  have=['bank records', 'victim statement'] missing=[]
the accused did the act             covered  have=['arrest observations', 'phone in hand'] missing=['messages']
knowledge                           GAP      have=[] missing=['messages', 'payment to the accused']

The check shows the gap Park saw in the first hours after the arrest. Deceit, deprivation and the act were covered by Mercer's statement, the bank's records and the officers' observations. Knowledge was not covered at all, because the messages on Pike's phone had not yet been lawfully examined. That gap shaped what came next: the phone had to be preserved untouched and a warrant obtained to search it, which lessons 8 to 10 follow.

Attempts, conspiracy and organized crime

Many cybercrime schemes are interrupted before they succeed, and many involve several people who never meet. The Criminal Code makes attempts an offence under section 24 when a person, with intent to commit an offence, does or omits anything beyond mere preparation; conspiracy under section 465 is an agreement between two or more people to commit an offence; and the criminal organization provisions in sections 467.11 to 467.13 apply where three or more people have as a main purpose the commission of serious offences for material benefit. Pike's arrival at Mercer's door to collect the money was well beyond preparation.

Desjardins notes that conspiracy and organized crime charges are usually laid by specialists after long investigations, because they require proof of the agreement and of each person's role. A patrol officer's contribution is to record what is seen and said carefully, so that a small local arrest can later become part of a larger case. The messages on Pike's phone, preserved properly, were what made that possible.