I was recently asked, for the umpteenth time, a question about jurisdiction on the Internet. For a long time I have been meaning to write something longer about this, and now I have! The reality is that the rules of jurisdiction do not change when the Internet is involved. The confusion arises because people associate jurisdiction primarily with territory when in fact Jurisdiction is a flexible concept that can apply quite broadly.

If you are starting an Internet-based business or are doing something online that may have legal implications (such as handling personal data), consult a qualified legal practitioner. This is always my advice. Many lawyers will give you free consultations, and it is better to be safe than sorry. If your startup doesn’t have the capital for a lawyer, raise more capital.

With that out of the way, let’s begin this overview of jurisdiction and the Internet!

Prescriptive jurisdiction and enforcement jurisdiction

States can make laws regulating matters within their territory, outside their territory, within the territory of another state, and on aircraft, vessels and space objects. They can also pass laws that apply to their nationals regardless of where their nationals are. This is called ‘prescriptive’ or ‘legislative’ jurisdiction.

However, a state can only enforce these laws within its own territory. With extremely rare exceptions, this means that for a state to enforce a law against a person, that person must be within their borders. This doesn’t mean that the crime must occur within their borders, but that the person must be physically within the territory of a state for them to be prosecuted. States have ‘exclusive enforcement jurisdiction’ within their territory: states are not permitted to enforce their laws in the territory of another state.

The fact that a state has the power to make laws on any matter it likes creates an obvious issue: two or more sets of laws can apply. If you go on holiday the laws of the country you visit apply, but the laws of your own country might also apply. This is called concurrent, conflicting or overlapping jurisdiction. For example, under Australia’s Criminal Code Australians can be charged with child sex offences committed overseas: Criminal Code Act 1995 (Cth) sch 1 div 272.

Always keep this in mind: a state can make laws that apply anywhere in the world, but it can only enforce those laws in its own territory. This means that whatever you do on the Internet, a state cannot enforce its laws unless you are within its territory. They can do this through extradition (see below), but this is not always easy and will usually only be used for serious crimes.

As an interesting point to note, a person may be brought within the territory of a state even in breach of international law — if someone is abducted from one country and taken to another for prosecution, this is not a matter for national courts: see, eg, United States v Álvarez-Machaín, 504 US 655 (1992); Attorney-General v Eichmann, District Court of Jerusalem, Criminal Case 40/61, 11 December 1961.

Civil jurisdiction and criminal jurisdiction

There is a difference between civil and criminal law when it comes to asserting jurisdiction. The reason for this is that criminal offences tend to be more serious, and it is rare for a person to be tried in absentia (while not present at the trial). Civil jurisdiction is often accepted wherever the initiating documents are filed. The connection to a state is frequently minimal.

Civil jurisdiction includes things like defamation, copyright infringement and breaches of contract where someone is suing you for damages or an injunction. Criminal jurisdiction is where the state itself is prosecuting you. It includes things like fraud and hacking, and the penalties are imprisonment or fines (which, unlike damages, are paid to the state).

Bear in mind, however, that enforcement of civil judgments can be done through criminal sanctions. This may make the principles for claiming criminal jurisdiction relevant if you fail to comply with a judgment made against you. Default judgments, where the court finds in favour of the plaintiff because the defendant has not filed a defence, are fairly common. You may inadvertently find yourself at the receiving end of criminal proceedings for failure to comply with a judgment.

Bases for criminal jurisdiction

There are five principles under which a state may claim criminal jurisdiction over a matter: the territoriality principle, the nationality principle, the protective principle, the passive personality principle, and the principle of universal jurisdiction. All are reasonably straightforward, and it should be easy to see how each relates to the Internet. Bear in mind that extradition is considered at the bottom of this article; we’re only looking at how criminal jurisdiction can be claimed here. It is also important to remember that these principles can overlap: two or more states can claim jurisdiction in the same matter based on any of the principles.

Territoriality principle

Under the territoriality principle, a state can claim jurisdiction over individuals, corporations and events within their territory. This is the primary way of establishing jurisdiction. The SS Lotus Case (The Case of the SS ‘Lotus’ (France v Turkey) [1927] PCIJ (ser A) No 10) indicates that there are two types of territoriality. Objective territoriality is based on where a perpetrator acts, while subjective territoriality is based on where the effects of the act are felt.

For example, the Colorado River crosses the US-Mexico border. If industrial waste is dumped into the river in the United States, the US could claim territorial jurisdiction — the dumping took place in the US. But if this causes damage on the Mexican side, Mexico could claim territorial jurisdiction.

In relation to the Internet, this means that you can be within the jurisdiction of the country where you act and where your act has effect. Suppose someone in Germany gains unauthorised access to a computer in South Africa. They have acted in Germany, but the effect of the act is felt in South Africa. Germany and South Africa could both claim jurisdiction under the territoriality principle.

Nationality principle

Although the nationality principle isn’t used very often, it is permitted under international law. Under this principle, a state may claim jurisdiction over its own nationals who have perpetrated a crime. Generally the nationality of an individual will be the same as that in their passport(s). Nationality of a corporation is prima facie (accepted as correct until proved otherwise) based on the state where it is incorporated. Consequently, your state of nationality (or the state where your company is incorporated) can claim jurisdiction over you, both online and offline.

Passive personality principle

The passive personality principle is the inverse of the nationality principle. A state may claim a right to exercise jurisdiction over its own nationals who are the victims of crime. This is becoming increasingly important where crimes have transnational effect. The primary reason for claiming jurisdiction under this principle is where another state fails to prosecute a crime.

In the Álvarez-Machaín Case, the US prosecuted crimes against its own nationals, despite those crimes taking place in Mexico. The US also claimed jurisdiction in the Achilles Lauro hijacking where an American national was killed by Palestine Liberation Front terrorists aboard an Italian ship.

Although one of the weaker principles for claiming jurisdiction, it is becoming more important. It has obvious implications for the Internet. If your actions constitute a criminal offence against a national of another state, that state might claim jurisdiction over you. For example, someone who commits fraud via the Internet may be subjected to a claim of jurisdiction by the state of nationality of their victims.

Protective principle

The protective principle is even more rarely used than the nationality principle, but there have been some high-profile cases. A state may claim jurisdiction over acts that threaten their national interests or the very existence of the state itself. In Joyce v Director of Public Prosecutions [1946] AC 347 the appellant was a British broadcaster who moved to Germany to propagandise on behalf of the Nazi regime. Joyce lost his British nationality, but after the Second World War he was brought before the British courts under the protective principle because his propagandising threatened the existence of the United Kingdom.

A controversial (and probably mistaken) use of the protective principle was seen in the high-profile Eichmann Case. Adolf Eichmann was brought before an Israeli court to face charges relating to his significant role in the Holocaust. Israel claimed jurisdiction on the basis that Eichmann’s acts of genocide threatened the state of Israel, even though Israel did not exist as a state until after the Holocaust ended. The court held — unsurprisingly — that Israel being a Jewish state was sufficient.

It would be very rare for the protective principle to be used in relation to the Internet. This would only apply in extreme cases where the national interest in severely threatened. Think WarGames and you’re probably in the right area of seriousness.

Universal jurisdiction

This principle is not fully accepted and is therefore an unsound basis for claiming jurisdiction. The principle of universal jurisdiction holds that a country can claim jurisdiction on the basis of the nature of the alleged act (that is, the type of crime) and that the alleged perpetrator is within their jurisdiction. This is reserved for the most serious crimes, such as genocide, crimes against humanity, and war crimes. It does not require a state to have grounds for territoriality or nationality — the act does not need to be committed by a national of the state or within the state’s territory, it can be committed anywhere by anyone.

The act must still be a crime under the laws of the prosecuting state. For example, if a Rwandan living in Australia is suspected of committing genocide in Rwanda, they could be prosecuted under Australia’s domestic genocide laws if Australia asserted universal jurisdiction. The power of this principle is evidently strong, but is diplomatically sensitive because it could lead to the prosecution of visiting officials.

It is helpful to know about universal jurisdiction, but it is hard to see how this would be claimed in relation to the Internet. It would be far more likely, practical and uncontroversial for a state to use one of the other principles.


So, a state has claimed jurisdiction under one of the above principles. How do they actually enforce the law if the person is outside their territory? The usual process is extradition. A state may request that another state delivers to them a person for prosecution; this is extradition. Usually a notice is issued via Interpol that a person is to be located and detained. An application for extradition is then made when a state has detained the person.

Extradition is subject to the general body of international law, as well as any bilateral arrangements between the two countries involved. There are some general rules that are followed in regard to extradition. Firstly, the crime must be a crime in both the requesting and requested states (called ‘double criminality’). Secondly, there is generally no extradition for purely political offences. Thirdly, requesting states can only prosecute a person for crimes alleged in the extradition request. Lastly, states may refuse extradition where the death penalty is a possible outcome: an assurance that the death penalty will not be imposed might be sought instead.

What happens when multiple states request extradition for the same person? The state who has detained the person must decide which state has the best claim. Normally a territorial claim will be appropriate, but this does not necessarily prioritise that state’s claim. Issues of public policy and international obligations may be considered. Once the legal issues are resolved and no jurisdiction is deemed solely appropriate, it may require diplomatic negotiation. In the case of General Pinochet, many countries requested extradition, but they agreed that Spain should prosecute and so this issue was resolved easily.


The Internet does not affect the rules of jurisdiction, but it can make it difficult to know which jurisdiction applies. Generally speaking you will be bound by the jurisdiction of the state where you physically are, the jurisdiction of the state where your acts are felt, the jurisdiction of your state of nationality, and the jurisdiction of the state of any ‘victims’ of your acts. You should always avoid committing acts that would be seen as an attack on the national interests of a particular state, just in case that state decides to assert jurisdiction. But a state can only enforce its laws against you if you come within their territorial control, and for that an extradition request might need to be made.