Cybercrime, intellectual property and export controls in Canada and abroad

Sub-domain 1.4 asks you to understand legal, regulatory and compliance issues in a holistic context. In practice that means knowing the main categories of law that affect security work, recognizing which questions need a lawyer, and understanding that an organization operating across borders may face several legal systems at once. This lesson covers cybercrime and data breaches, intellectual property and licensing, and import and export controls. Lesson 5 covers privacy and transborder data flows, and Lesson 6 covers contracts, compliance and investigations.

Categories of law

Security professionals meet three broad categories of law. Criminal law deals with offences against society, prosecuted by the state, with penalties that can include imprisonment; the standard of proof is beyond a reasonable doubt. Civil law deals with disputes between private parties, such as breach of contract or negligence, and remedies are usually money damages or orders; the standard is the balance of probabilities, sometimes called the preponderance of the evidence. Administrative or regulatory law is made and enforced by government agencies under authority from legislation, such as privacy regulators, securities commissions and financial supervisors; it can bring fines, orders and licence conditions.

Legal systems also differ. Canada, apart from Quebec's private law, and the United States use common law, in which court decisions create binding precedent alongside legislation. Quebec and most of continental Europe use civil law systems based on comprehensive codes. Some countries use religious or customary law, or mixtures. When an organization operates internationally, contracts usually specify which jurisdiction's law governs and where disputes will be heard.

Cybercrime

Most countries criminalize unauthorized access to computers, interference with data, and misuse of devices or passwords. Attacks often cross borders, which makes investigation and prosecution hard: the attacker, the victim, the servers and the stolen data may all be in different countries. International cooperation relies on mutual legal assistance treaties and on the Council of Europe Convention on Cybercrime (the Budapest Convention, 2001), which harmonizes offences and procedures among its parties, including Canada and the United States. A United Nations Convention against Cybercrime was adopted by the General Assembly in December 2024 and opened for signature in 2025; it will take effect only after enough states ratify it, and many security and human rights groups have criticized its broad scope.

In Canada, the main cybercrime provisions are in the Criminal Code. Section 342.1 makes unauthorized use of a computer an offence, including obtaining computer services fraudulently, intercepting functions of a computer and using a computer to commit other offences. Section 342.2 covers possessing or distributing devices designed primarily for those offences. Section 430(1.1) creates the offence of mischief in relation to computer data, which covers destroying, altering or interfering with data. Section 184 criminalizes interception of private communications, and identity theft and identity fraud are covered in sections 402.2 and 403. Incidents can be reported to local police and to the Canadian Anti-Fraud Centre, and the Canadian Centre for Cyber Security accepts incident reports from organizations.

Data breach law sits between criminal and regulatory law. When personal information is exposed, organizations often have legal duties to notify regulators and affected individuals, whatever the cause. Lesson 5 covers breach notification rules in detail, because they are mainly part of privacy law. From a governance view, the key point is that the organization that held the data is responsible for the breach response even when a criminal caused it.

Intellectual property

Intellectual property (IP) is often an organization's most valuable information asset. Security programs protect it, and security professionals must also respect others' IP, for example by complying with software licences. The four main types are copyright, trademarks, patents and trade secrets.

Trade secrets deserve special attention from security leaders, because their legal protection depends on the owner taking reasonable measures to keep them secret. Access controls, classification labels, non-disclosure agreements, exit interviews and monitoring of data transfers are not only good practice; they are evidence that the organization treated the information as secret if it ever has to go to court.

In Canada, copyright is governed by the Copyright Act, which extended the general term to life of the author plus 70 years from 30 December 2022, without reviving expired works; it also prohibits circumventing technological protection measures, with exceptions such as security research and interoperability. Trademarks are registered with the Canadian Intellectual Property Office (CIPO) under the Trademarks Act, and patents under the Patent Act. Canada has no single trade secret statute; protection comes from common law and equity (breach of confidence), contracts and, in Quebec, the Civil Code, and the Criminal Code was amended in 2020 to add a trade secret offence (section 391).

Licensing

Software is usually licensed rather than sold: the buyer gets rights to use it under conditions. Common models include perpetual licences, subscriptions, per-user and per-core licensing, site licences, and open-source licences ranging from permissive (MIT, Apache 2.0, BSD) to copyleft (GPL), which requires derivative works distributed to others to be released under the same terms. Click-through and shrink-wrap licences are generally enforceable if users had a reasonable chance to see the terms.

Licence management is a security and compliance issue. Unlicensed software can bring legal claims and audits from vendors or industry groups; unmanaged open-source components can bring both licence obligations and security vulnerabilities. A software bill of materials (SBOM), discussed in Lesson 10, helps track what components are in use and under which licences. Software asset management tools and clear procurement policies keep usage within licensed limits.

Import and export controls

Many countries control the export of certain technologies, including some encryption products, intrusion software and items with military uses. Controls apply not only to shipping hardware but also to transferring software and technical data electronically, and sometimes to sharing controlled technical information with foreign nationals inside the country, which the US calls a deemed export. Multilateral regimes coordinate these controls. The Wassenaar Arrangement, with 42 participating states including Canada and the United States, maintains lists of dual-use goods and technologies, including categories for information security items.

In Canada, export controls are administered by Global Affairs Canada under the Export and Import Permits Act. The Export Control List, which incorporates the Wassenaar lists, identifies controlled items, and Group 1 Category 5 Part 2 covers information security items such as some cryptography. Many mass-market encryption products are released from control, but specialized products may need a permit. Canada also maintains economic sanctions against certain countries and persons under the Special Economic Measures Act and related laws, and the Controlled Goods Program, run by Public Services and Procurement Canada, regulates access to controlled military goods and technical data in Canada.

Import controls also matter. Some countries restrict the import or use of encryption, require registration of cryptographic products, or require access to keys. Before sending staff abroad with encrypted laptops, or deploying products in a new country, security teams should check both export rules at home and import rules at the destination.

Working with law enforcement and counsel

Deciding whether to involve law enforcement after a cybercrime is a business decision that should be planned before an incident. Benefits include access to intelligence about the attackers, the possibility of recovering funds or decryption keys, and support for prosecution. Concerns include loss of control over the timeline, disclosure of sensitive information and the time staff must spend supporting the investigation. Many organizations decide in their incident response plan which kinds of incidents they will report, and build relationships with police cybercrime units and national cyber centres in advance.

Legal counsel should be involved early in any significant incident. Counsel can advise on notification duties, contractual obligations, evidence preservation and communications, and can direct forensic investigations in a way that may protect sensitive findings under privilege. Security leaders should know which outside law firms and forensic providers the organization will call, whether its cyber insurer requires specific panel firms, and who has authority to engage them at short notice. Ransom payments raise further legal questions, including sanctions laws that can make paying certain groups illegal, and most governments discourage paying at all.

Contracts with suppliers and customers often address these legal topics directly: who owns the intellectual property in work product, which country's law governs, how export-controlled data must be handled, and what each party must do if a cybercrime affects shared systems. Security leaders should review such clauses with counsel, because they shape responsibilities long before any incident occurs.