The Vagueness of Norms on Attempted Cybercrimes in Article 17 Paragraph (2) of Law Number 1 of 2023 concerning the Criminal Code

The development of digital technology has given rise to new forms of crime that are fundamentally different from conventional offenses. This study examines the normative ambiguity surrounding attempted offenses in cybercrimes under Law Number 1 of 2023 concerning the Criminal Code (the New Criminal Code/New KUHP) and the Electronic Information and Transactions Law (the EIT Law/UU ITE). Article 17 Paragraph (1) of the New Criminal Code stipulates that for an attempt to be punishable, there must be intent, the commencement of execution, and the non-completion of the act due to circumstances independent of the perpetrator’s will. However, this concept was constructed upon the paradigm of conventional crime, which is physical and linear. Consequently, it creates serious complications when applied to cybercrimes that are virtual, automated, and simultaneous in nature. Furthermore, the formal offense characteristics found in several articles of the EIT Law logically clash with the doctrine of criminal attempt, which inherently requires the non-completion of an act. Using a normative legal research method, this study demonstrates that the phrase "directly potential to cause a criminal offense" in Article 17 Paragraph (2) of the New Criminal Code contains clear normative ambiguity. This ambiguity potentially leads to overcriminalization (an excessive application of criminal law where it encompasses too many actions, including activities that have not yet caused real harm or remain within the scope of legitimate use) of incomplete cybercrimes. Concurrently, it risks undercriminalization (an inadequate application of criminal law where it fails to encompass substantively dangerous acts due to limitations or ambiguity in the formulation of legal norms) regarding legitimate digital activities. To address this ambiguity, normative harmonization and law enforcement guidelines based on technical understanding are urgently required. The novelty of this study lies in formulating normative-functional parameters to determine the threshold for the 'commencement of execution' in cybercrimes under Article 17 Paragraph (2) of the New Criminal Code—an area left undeveloped in prior research. Concretely, the proposed functional-technical parameters focus on the cumulative intensity of technical actions, the degree of the perpetrator’s control over automated processes, and the objective manifestation of criminal intent to measure the direct risk posed to the target electronic system.