What are we going to do? 

Ensure the police and courts have the necessary powers to help tackle serious and organised crime. Measures in the Crime and Policing Bill will: 

(a) Create new powers to ban electronic devices used in vehicle theft or theft from a vehicle. 

(b) Strengthen the ability to apply corporate criminal liability to the makeup of modern corporations, particularly large complex structures. 

(c) Introduce a court order to mandate the suspension of access to criminally associated domain names and Internet Protocol (IP) addresses. 

How are we going to do it? 

Vehicle theft 

The bill introduces two new offences to criminalise the possession, importation, making, adapting, supplying or offering to supply an electronic device (such as a signal jammer) for use in theft of a vehicle or theft of anything in a vehicle. The maximum penalty for these offences will be five years’ imprisonment, an unlimited fine, or both. 

Identification doctrine reform 

The bill makes provision for corporate liability where a senior manager commits an offence while acting in the scope of their actual or apparent authority, for all crimes, replacing the provisions in Economic Crime Corporate Transparency Act 2023 which are confined to economic crimes. 

Suspension of domain names and IP addresses 

The bill provides law enforcement and certain investigative agencies with the ability to apply for a court order to mandate the suspension of access to IP addresses and domain names associated with serious crime. The UK currently utilises strong public/private partnerships where industry will, in the vast majority of cases, voluntarily suspend domain names and IP addresses which are facilitating criminal activity in the domestic market. The government strongly supports these voluntary arrangements, and they will continue to be the first port of call for any activity in this space.  

However, most domain name registries and registrars are situated outside of the UK and require a court order before they will action requests. These orders (an IP address suspension order or a domain name suspension order) will therefore primarily be served internationally, to ensure that any threat originating from outside the UK can be effectively tackled. 

Background 

Vehicle theft 

A significant proportion of vehicle theft is driven by organised crime groups, which costs hundreds of millions of pounds in social and economic harm each year. There is a demand for stolen vehicles, which means this is a highly attractive and lucrative area for criminals to gain profit from selling stolen vehicles and vehicle parts. Particular makes and models are targeted due to their resale value, the ease with which they can be accessed illegally or because they are being stolen to order. Organised criminals find ways to overcome security measures, even in the latest vehicle models, by exploiting vulnerabilities in vehicles and new technologies. 

Electronic devices include devices which manipulate the signal from remote locking devices, such as signal jammers and signal amplifiers. 

These devices are not, in themselves, currently illegal to possess. Offenders can be charged with going equipped to commit theft under section 5 of the Theft Act 1968, conspiracy to steal or conspiracy to handle stolen goods but the offender’s motivation needs to be proved. 

Identification doctrine reform 

The identification doctrine is the legal test for deciding whether the actions and state of mind of a corporate body can be regarded as those of a natural person. Specifically, the Economic Crime and Corporate Transparency Act 2023 makes provision for corporate liability where a senior manager commits an offence while acting in the scope of their actual or apparent authority, in relation to economic crime offences only. Although this addressed shortcomings in corporate liability laws in a significant number of cases, the then government acknowledged during the passage of the 2023 Act that wider reform is required to introduce corporate liability for all crimes.  

The bill adopts the definition of ‘senior manager’ as provided in the Corporate Manslaughter and Corporate Homicide Act 2007. This definition looks at what the senior manager’s roles and responsibilities are within the organisation - the level of managerial influence they might exert - rather than their job title. It covers instances where the senior manager is a person who plays a significant role in the making of decisions about the whole or a substantial part of the activities of the body corporate. 

This has the advantage of providing greater clarity on the parameters of the legal test and will also bring the law up to date to reflect modern company structures where directing minds are spread across different functions of a business. It will enable prosecutions to progress in more cases where senior level employees who do exert decision making power are found to be involved in the offending. 

Suspension of domain names and IP addresses 

A domain name is another term for a website address (for example, www.gov.uk) that is easy to remember and, when typed into the search bar of a browser, directs the user to a website. It is different to a URL (Uniform Resource Locator), which is a unique identifier for the location of a webpage on the internet.  Domain names are created and leased by authorised registrars and issued by registries. These organisations keep a database of all domain names and manage their allocation and administration to avoid issues such as duplication.  

An IP address is a unique numerical address given to every device connected to any network on the internet, and can be used to identify devices, send and receive information, and to see when content has been accessed on the internet. Organisations may knowingly or unknowingly assign an IP address, or a range of IP addresses, to a person who uses it to facilitate criminal activity. 

Domain names and IP addresses are frequently used by criminals to facilitate a range of criminal offences including phishing, fraud consumer scams, child sexual abuse material, and dissemination of malware. Members of the public may access these domain names and IP addresses unknowingly and, in some cases, become the victims of serious crimes. 

At present there is no legal power available to require industry to take action to suspend these IP addresses and domain names. Law enforcement and investigative agencies utilise public/private partnerships where industry will voluntarily suspend domain names and IP addresses which are facilitating criminal activity, as this would be against their terms of service.  

Domestically, these voluntary arrangements work well and the majority of organisations will agree to suspend IP addresses and domain names. This has resulted in the UK cyber landscape being one of the safest in the world. 

However, these voluntary domestic arrangements are dependent on cooperation and limited to what we can control from within the UK. The overwhelming majority of entities that allocate IP addresses and domain names are situated in foreign jurisdictions and require a court order before they will suspend IP addresses or domain names.  

The bill enables law enforcement and investigative agencies to obtain a court order to request action by organisations outside of the UK, and in the small number of domestic cases where voluntary arrangements will not work. This will protect UK citizens from becoming potential victims to serious crimes facilitated through domain names and IP addresses. 

Key statistics 

Vehicle theft 

The latest estimates from the Crime Survey for England Wales (CSEW) show that there were 732,000 incidents of vehicle-related theft in the year ending September 2024 ^{[footnote 1]}

Police Recorded Crime data shows a breakdown of vehicle offences which shows there was a total of 375,048 vehicle related thefts in year ending September 2024. 188,517 of these offences were theft from a vehicle and 132,412 were theft of a motor vehicle. ^{[footnote 2]}   

The Metropolitan Police Service estimates that in London, electronic devices are used in approximately 60% of vehicle theft. 

According to the CSEW, from April 2019 to March 2020, an offender manipulated signal from remote locking device was used in 36% of vehicle thefts. ^{[footnote 3]} The CSEW also shows there were 726,000 vehicle-related thefts in the year ending September 2023. This figure includes theft of a vehicle, theft from a vehicle and attempted thefts. ^{[footnote 4]} 

Domain names and IP addresses 

The CSEW estimated that there were 867,000 ‘computer misuse’ offences against individuals in England and Wales in the year ending September 2024. This does not represent a statistically significant change from the prior year (898,000). 

For the longer-term trend, the most recent figures represent a 51% decrease compared to the year ending March 2017 (1,764,000 estimated computer misuse offences), when the data was first collected. This decrease has been driven by an 87% decline in computer virus incidents over the period (from 1,191,000 incidents to 154,000).  

CSEW estimates show that there were 741,000 victims of computer misuse in England and Wales in the year ending September 2024, which does not represent a statistically significant change from the previous year (711,000 victims). 

Frequently asked questions 

Vehicle theft 

What is covered within the definition ‘electronic device’?  

Using a broad definition means electronic devices which may be developed in the future would be covered by this legislation. If the types of devices currently in use were to be described in the provision, the legislation would need to be constantly updated if a new device was developed by criminals, and would not offer sufficient flexibility to ensure that prosecutions for this offence can continue. 

Isn’t this covered by existing offences? 

Offenders can be charged with going equipped to commit theft under section 5 of the Theft Act 1968, conspiracy to steal or conspiracy to handle stolen goods.  

These existing offences put the burden on the prosecution to prove the defendant’s intention to steal a vehicle.  

Will all signal jammers be blocked? 

There are some legitimate uses for signal devices, such as signal repeaters which have been approved for use by Ofcom, and are legal to own and use, for example to boost mobile phone signal where the signal is otherwise weak.   

We must ensure the new offence is proportionate and able to be used without creating legal ambiguity. 

How will users of these electronic devices prove their legitimate use? 

There are very few legitimate uses for these devices which is why we are taking steps to criminalise their possession. Those who do have a valid use for such a device should have no difficulty in demonstrating that. 

Identification doctrine reform 

What is the penalty for the corporation? 

The company will be criminally convicted and receive a fine, in addition to any sentences imposed for individuals who are also found guilty of the same offence(s). 

The maximum fine will depend on the particular offence charged, but for most serious crimes an unlimited fine will be available. 

How will the measures affect small and medium sized businesses? 

The measures in the Economic Crime Corporate Transparency Act 2023 were intended to level the playing field between small and large companies. The measures in this bill simply expand the types of offences that a corporate body may be convicted for. 

Under the common law principle, developed prior to the introduction of that Act, small and micro companies were disadvantaged. Those firms are more likely to have one or two directors with oversight of all of a company’s operations, who could be charged. In a large corporate with complex governance structures, where responsibilities are shared far and wide, it had proven difficult for prosecutors to identify any person to meet the criminal threshold. 

It is important that the playing field is levelled, and small and medium sized businesses are not unfairly penalised. Reform of the identification doctrine to extend it to senior managers as defined in the bill will mitigate the unfairness by better reflecting the make-up of large companies with diffuse decision-making structures. 

What is the relationship between the Economic Crime and Corporate Transparency Bill and now in the Criminal and Policing Bill? 

Economic crimes, including fraud, currently makeup over 40% of crime in the UK and are deeply harmful and system threats to our society. This crime is not only by lone actors but also by businesses that can conduct large scale harm.  

The Economic Crime and Corporate Transparency Bill took the opportunity to reform the identification doctrine for economic crimes which the scope of the bill allowed. However, the identification doctrine is by no means an economic crime regime. Reform is required to bring corporations to justice in their own right for conducting all types of crime which this bill will do.   

What will be the cost impact on business?  

The cost to business of reforming the identification doctrine is low given that the changes largely codify what already exists in law. 

The reform will also reverse an imbalance currently faced by smaller businesses.  

Under the regime developed in the 1970s, smaller companies were at a disadvantage as their directors were  more easily identifiable. It is important that the playing field is levelled, and small and medium sized businesses are not unfairly penalised by bringing the reform up to date with the structure of large modern companies. 

Suspension of domain names and IP addresses 

What does this provision add to the existing voluntary arrangements? 

The voluntary arrangements are crucial in ensuring the UK remains one of the world’s safest cyber spaces, and will remain the first port of call for domain name and IP address suspension. However, there are instances where these arrangements are not effective. This includes when the organisation will not respond to a law enforcement agency’s request, or when law enforcement agencies are seeking to act collectively with international counterparts in response to criminal activity that involves multiple jurisdictions.  

Crucially, these voluntary arrangements only exist in the UK.  Many organisations based outside of the UK require a court order before they will take action. This provision will allow UK law enforcement agencies to obtain an order to formally request action by organisations outside of the UK. We expect orders against domestic providers to be rarely needed. We expect orders against domestic providers to be rarely needed. 

How will you prevent any unintended impacts on legitimate businesses? 

There are multiple safeguards built in to ensure the IP address and domain name provision is used proportionately. Firstly, a senior officer, of the rank of superintendent or equivalent, must make or authorise the application. The court must only grant that application if they consider that the action is both necessary and proportionate to disrupt the criminality taking place.  In addition, if an industry body receiving the order is not satisfied, they can apply to the court to have the order varied or discharged. All orders to suspend IP addresses and domain names will be limited to serious crime. 

How will you achieve action overseas?  

With regard to both domain names and IP addresses, there are international governance arrangements in place for providers which are designed to help in the response to criminal activity. The Internet Organisation for Assigned Names and Numbers (ICANN), which governs the provision of internet numbering, provides guidance to its members on recognising court orders from other jurisdictions. 

If an overseas company did not respond favourably, police-to-police cooperation and Mutual Legal Assistance (MLA) would be considered. The UK is party to a number of treaties on MLA in criminal matters which cover state cooperation in the investigation and prosecution of crimes. 

How will this affect freedom of expression? 

The court must be satisfied that the action is necessary and proportionate and that there are reasonable grounds to believe that the domain or IP address is being used for criminality. 

Given the scale and impact of criminal use of domain names and IP addresses, it is considered the power is necessary to disrupt and prevent crime, and to protect the public from threats both at home and abroad.

Footnotes