The Development of ATM Skimming Criminal Law as a New and Growing Transnational Crime

In its early days, cybercrime was known only as a joke and the mischief of teenagers or hobbyists operating from their home laptops. But not anymore! Law enforcement agencies around the world are taking this type of crime increasingly seriously because attackers are no longer just individuals, but organized teams or groups exploiting technology vulnerabilities. As organized groups targeting control, power, and wealth, the criminals in these groups are not only skilled but also very well funded. That is why INTERPOL supports its 190 member countries in effectively combating this new type of crime.

How criminals use the internet to commit cybercrime has been a hot topic that has continued to develop over the past two decades. The discussion covers issues ranging from the early use of telephone systems to personal computers to the internet, and how modern cybercrime has evolved to include personal digital products. The proliferation of digital network technology allows anyone, anywhere, to use the latest technology as a tool to commit crimes easily and productively (Butterfield, 2014). These crimes can attack entities on the other side of the world that also use network devices.

The increasing scale of these types of transnational crimes prompted the Conference of State Parties (CoSP) of the United Nations Convention Against Transnational Organized Crime (UNTOC) in 2010 to identify several New and Emerging Transnational Crimes, one of which is cybercrime. UNTOC was established to serve as a basic guideline for countries in their efforts to combat transnational crime. In short, cybercrime can be defined as computer-oriented crime that exploits network systems, where computers are used as tools to commit crimes such as fraud, identity theft, or privacy violations.

As a violation of privacy and identity theft, ATM skimming crimes are generally punishable under Article 30 paragraph (2) in conjunction with Article 36 of Law Number 19 of 2016 concerning Amendments to Law Number 11 of 2008 concerning Electronic Information and Transactions (ITE Law). The act involves accessing an electronic system without the right or authority to do so, contrary to the rights of others, resulting in losses to others. Such acts are punishable by a maximum imprisonment of 12 years.

In its development, Indonesia has included money laundering as a form of transnational crime that receives special attention. Illegal ATM data theft has also been included in the typology of money laundering (PPATK, 2018: 2). Therefore, perpetrators of ATM skimming crimes can also be prosecuted under Law Number 8 of 2010 concerning the Prevention and Eradication of Money Laundering Crimes (TPPU Law).

Article 5 paragraph (1) in conjunction with Article 2 paragraph (1) of the TPPU Law criminalizes perpetrators who control the placement, transfer, payment, grant, donation, deposit, exchange or use of assets known or suspected to be the proceeds of crime. For these actions, perpetrators can be punished with a maximum imprisonment of five years and a maximum fine of one billion rupiah. Perpetrators who conceal or disguise the origin of such assets can be punished more severely, namely with 20 years imprisonment and a maximum fine of five billion rupiah (Article 4 of the TPPU).

The use of articles contained in the Anti-Money Laundering Law can be considered a progressive development in preventing and combating rapidly evolving transnational cybercrime. This law describes the act of placing, transferring, divesting, or bringing abroad assets obtained through criminal acts, in this case ATM skimming, as a criminal act in the banking sector punishable by a maximum imprisonment of 20 years and a maximum fine of 10 billion rupiah (Article 3 of the Anti-Money Laundering Law).

In general, perpetrators do not keep the stolen proceeds themselves, but transfer the stolen funds to other agreed bank accounts. Therefore, perpetrators can also be subject to criminal penalties under Law No. 3 of 2011 on Fund Transfers. Article 81 of this law stipulates that “Any person who unlawfully takes or transfers part or all of another person's funds through a false Fund Transfer Order shall be punished with a maximum imprisonment of 5 (five) years or a maximum fine of Rp5,000,000,000.00 (five billion rupiah).” However, this law has rarely been used to prosecute skimming criminals.

The transfer of criminal proceeds is not only carried out within the same financial institution, but also across banks and even across countries. Perpetrators who carry out their actions directly usually only act as field executors. Meanwhile, the proceeds of crime are transferred to another location, where the mastermind or leader of the criminal group could be located anywhere. This requires cooperation between countries in law enforcement. In this case, the instrument that can be used is the Mutual Legal Assistance (MLA) system for the exchange of information and capacity building in law enforcement. This system can be implemented either through agreements or without them.

The existence of MLA is reinforced by the United Nations Convention against Transnational Organized Crime (UNTOC). As mentioned at the beginning of this article, UNTOC created a legally binding instrument that regulates international cooperation between law enforcement and judicial authorities in terms of sharing evidence and pursuing criminals. UNTOC also provides a framework for countries to update their laws to better investigate and prosecute perpetrators of these crimes (Tenant, 2021: 55).

Regarding MLA, it is regulated in Law Number 1 of 2006 concerning Mutual Assistance in Criminal Matters. This law serves as a guideline and legal basis for parties in providing mutual assistance with regard to investigations, prosecutions, and examinations in court proceedings in accordance with the provisions of the requesting country's laws and regulations. Thus, it can be seen that countries have the flexibility to apply the framework of the Convention to their respective regulations and laws.

Finally, it should be emphasized that the use of a better digital environment requires better cybersecurity. Therefore, joint efforts are needed from all stakeholders, including the international community, governments, the technology industry, law enforcement agencies, and individual users themselves.