Cyber Law5Most Wanted

Cyber Law's Most Wanted

Five thoroughly made-up rascals, five very real Australian laws. The villains are fiction. The section numbers and penalties are not.

Characters100% FictionalLaws checked 20 Sep 2026
Wanted

Peeky McPassword

alias "The Shoulder Surfer of Humpty Doo"

Wanted for

Logging in to the boss's payroll system with a password read off a sticky note, just to have a squiz.

Threat level: nosy. Approach with a privacy screen.

The caper Invented

Peeky, junior biscuit auditor at Crumbleton Bikkies, spotted "Tim-Tam-4-Eva!" stuck to the payroll manager's monitor. At 12.07 pm, while everyone queued for the microwave, Peeky logged in and scrolled through everyone's salaries. Peeky changed nothing, stole nothing and told only eleven people. "I was only looking!" was the full extent of the defence.

Rap sheetReal law
Law
Criminal Code Act 1995 (Cth), Part 10.7 (Computer offences), s 478.1: unauthorised access to, or modification of, restricted data.
Rule broken
Intentionally causing access to restricted data while knowing the access is unauthorised. "Restricted data" is data held in a computer where access is restricted by an access control system, such as a password.
Maximum
2 years imprisonment.
Lesson for students

"Just looking" is the offence. No damage, theft or profit is needed: knowing you are not authorised and getting past the access control anyway is enough. Knowing a password is not the same as having permission.

Wanted

Dee Doss

alias "The Traffic Goblin"

Wanted for

Flooding a rival pie shop's online ordering site with junk traffic until it fell over on grand final day.

Threat level: loud. Known to travel in a swarm of 40,000 toasters.

The caper Invented

Furious that Pie Hard 2: Pie Harder had won Best Chunky Steak three years running, Dee rented a botnet of hijacked smart toasters and aimed it at the shop's ordering page. For six hours every genuine customer got a spinning wheel instead of a pie. Dee never broke in, never read a single file and considered it "basically a prank".

Rap sheetReal law
Law
Criminal Code Act 1995 (Cth), Part 10.7, Division 477 (Serious computer offences), s 477.3: unauthorised impairment of electronic communication.
Rule broken
Causing an unauthorised impairment of electronic communication to or from a computer, knowing the impairment is unauthorised. Its sibling, s 477.2 (unauthorised modification of data to cause impairment), carries the same maximum.
Maximum
10 years imprisonment.
Lesson for students

You do not have to get inside a system to commit a serious computer offence. Knocking a service offline is treated far more harshly than Peeky's snooping: a 10 year maximum, compared with 2.

Wanted

Colonel Clickbait

alias "The Inbox Invader"

Wanted for

Blasting 90,000 marketing emails to people who never signed up, from a fake sender name, with an unsubscribe link that went nowhere.

Threat level: relentless. Subject lines contain up to nine exclamation marks.

The caper Invented

To launch Colonel's Cut-Price Camo Cushions, the Colonel bought a "guaranteed fresh" email list from a bloke at the markets. Every message came from "Your Mate Dave" with no business name or contact details. The unsubscribe link led to a photo of a cushion. People who replied STOP were moved to a second list called "Keen".

Rap sheetReal law
Law
Spam Act 2003 (Cth), regulated by the ACMA. s 16: unsolicited commercial electronic messages must not be sent. s 17: messages must include accurate sender information. s 18: messages must contain a functional unsubscribe facility.
Rule broken
All three: no consent, no identification, no working unsubscribe. ACMA guidance says unsubscribe requests must be honoured within 5 working days.
Penalty
Civil penalties, not jail. The ACMA can investigate and take enforcement action, including financial penalties and court-enforceable undertakings. In March 2026 the ACMA reported that businesses had paid over $6.7 million in spam penalties in the previous 18 months, including one penalty of $702,900 for emails with no way to unsubscribe.
Lesson for students

Remember three words: consent, identify, unsubscribe. Most real spam penalties are paid by ordinary, legitimate businesses with sloppy mailing systems, not by cartoon villains.

Wanted

Lady Leaksworth

alias "The Duchess of Loose Buckets"

Wanted for

Leaving 200,000 customer records in a public cloud folder, then sitting on the breach for months and telling no one.

Threat level: drippy. Believes "the cloud" is a kind of weather.

The caper Invented

Her Ladyship runs Posh Paws Pet Insurance Pty Ltd. Names, addresses, bank details and the dental histories of 200,000 owners and their schnauzers sat in an open storage bucket labelled "backup_final_FINAL2". When a researcher emailed a warning, she filed it under "Later". When the data turned up for sale, she told the board it was "probably fine" and asked that nobody mention it to the customers, or to the regulator.

Rap sheetReal law
Law
Privacy Act 1988 (Cth). APP 11: take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Part IIIC: Notifiable Data Breaches scheme. s 13G: civil penalty for a serious interference with privacy.
Rule broken
An eligible data breach (s 26WE) is unauthorised access to, disclosure of, or loss of personal information that is likely to result in serious harm and that cannot be prevented by remedial action. An entity that suspects a breach must take all reasonable steps to complete its assessment within 30 calendar days (s 26WH). The OAIC and affected individuals must then be notified as soon as practicable (ss 26WK, 26WL). Failing to do so is itself an interference with privacy (s 13(4A)).
Maximum
Under s 13G, for a body corporate, the greater of $50 million, three times the value of the benefit obtained, or 30% of adjusted turnover in the breach turnover period. For an individual, $2.5 million. These are civil penalties ordered by a court.
Lesson for students

Two separate failures: weak security, then silence. The breach may be forgiven; the cover-up rarely is. Know the three-part test for an eligible data breach and the two clocks: 30 days to assess, then notify as soon as practicable.

Wanted

Hush-Hush Harold

alias "The Wombat Who Said Nothing"

Wanted for

Quietly paying a ransomware gang, then hiding the payment in the accounts and never reporting it.

Threat level: shifty. Last seen shredding a receipt.

The caper Invented

Harold Hushington is chief financial officer of Wombat Widgets Pty Ltd, annual turnover $12 million. When a gang calling itself the Naughty Numbats locked every widget blueprint, Harold paid the ransom in cryptocurrency on a Friday night and booked it as "miscellaneous stationery". Seventy-two hours ticked by. Then a week. Harold's plan was simple: if nobody knows, it never happened.

Rap sheetReal law
Law
Cyber Security Act 2024 (Cth), Part 3 (Ransomware reporting obligations), s 27. Mandatory reporting has been active since 30 May 2025.
Rule broken
A reporting business entity must report within 72 hours of making a ransomware or cyber extortion payment, or becoming aware one was made on its behalf. That covers businesses carrying on business in Australia with annual turnover above $3 million, and responsible entities for critical infrastructure assets. Reports are made through the Australian Signals Directorate form at cyber.gov.au.
Penalty
Civil penalty of 60 penalty units for failing to report. A Commonwealth penalty unit is $364 for contraventions on or after 1 July 2026 (previously $330), so 60 units works out to $21,840.
Lesson for students

Harold's contravention is the silence, not the payment. Paying a ransom is not generally prohibited under Australian law, although the Government strongly discourages it. If you pay, the 72 hour clock starts.