Computer Misuse

Response, Regulation and the Law

Stefan Fafinski

• Publisher: Willan
• Year: 2013
• eBook ISBN: 9781134027866
• Edition: 1
• Topic: Social Sciences
• Subtopic: Criminology
• Index: Social Sciences

This book is concerned with the nature of computer misuse and the legal and extra-legal responses to it. It explores what is meant by the term 'computer misuse' and charts its emergence as a problem as well as its expansion in parallel with the continued progression in computing power, networking, reach and accessibility. In doing so, it surveys the attempts of the domestic criminal law to deal with some early manifestations of computer misuse and the consequent legislative passage of the Computer Misuse Act 1990.

This book will be of interest to students of IT law as well as to sociologists and criminologists, and those who have a professional concern with preventing computer misuse and fraud.

Chapter 1

Introduction

I do not fear computers. I fear the lack of them.

Isaac Asimov (1920–92)

In 1990, Tim Berners-Lee, working with Robert Cailliau at CERN, proposed a ‘hypertext’ system which provided one of the building blocks of the Internet as we understand it today; Microsoft released Windows 3.0 and the first commercial Internet dialup access provider, ‘The World’, came online. By comparison, as of July 2008, it is estimated that in excess of 1.4 billion people are online throughout the world.¹ Over the last twenty years, computers have become an increasingly unremarkable part of contemporary western society. Computer technology is no longer just concerned with specialist scientific, engineering or military applications. It pervades many aspects of everyday life and underpins both state and commercial enterprises as well as the routine activities of many individuals.

Although computers have been used for unauthorised or illegitimate purposes since the earliest days of their existence, the proliferation of networked technology which transcends traditional state boundaries is generating, in turn, a greatly expanding realm of potential computer misuse and its victims. It follows that, as everyday life and computer technology converge, the misuse of that technology has the capacity greatly to disrupt many facets of global society. As such, computer misuse is both a prevalent and contemporary issue and it is the purpose of this book to explore the range of possible legal and extra-legal responses by which computer misuse might be regulated.

This chapter seeks to set the overall framework for the remainder of the book. It will describe the central hypothesis which will be examined and provide an overview of the structure of the main body of the work in the context of the research questions to be answered before concluding with a discussion of the concept and definition of computer misuse which will be used throughout the book. The main narrative of this book draws upon a range of different sources and is founded on documentary research supported by findings from fieldwork which was designed to provide an insight into the views of experts on the efficacy of various forms of regulation and their practices and attitudes towards the issue of computer misuse. An outline of the research methodology used is provided in the Appendix.

Principal research questions and chapter structure

The central hypothesis which is explored by this book is as follows:

There are a number of incompatibilities between the nature of computer misuse and the nature of the criminal law. This means that computer misuse cannot be regulated effectively by the criminal law alone. Such regulation requires a reflexive and cohesive approach which is only viable in a global networked society by a networked response combining nodes of both legal and extra-legal governance.

The book breaks down into three discrete but interrelated parts. The first part explores whether computer misuse has presented problems for the law. This requires an examination of the nature and purpose of both computer misuse and the domestic criminal law. The second part considers the application of a multi-tiered governance approach as a response to the types of risk posed by computer misuse. In doing so, it expands upon the discussion in the first part to encompass the use of the law in general and extra-legal governance mechanisms. The final part concludes with an examination of the central hypothesis.

Within the confines of this hypothesis, this book seeks to answer six principal research questions in the forthcoming chapters.

• What is computer misuse and did it present a problem for the domestic law? If so, how did the law respond?

Chapter 2 considers both the evolution of computer technology and computer use and misuse up until the enactment of the Computer Misuse Act 1990. It explores whether there were any shortcomings in the application of domestic law to computer misuse before charting the legislative history, genesis and purpose of the 1990 Act in more detail.

• Was the Computer Misuse Act 1990 an effective response to computer misuse and has it stood the test of time?

Chapter 3 continues the coverage of the two parallel evolutionary strands begun in Chapter 2 from 1990 to the present. It discusses the continued progression in computing power, reach and accessibility and the consequent expansion of manifestations of computer misuse. Following on from Chapter 2, it will examine whether or not the 1990 Act has been effective in controlling the problems inherent in computer misuse considering both prosecution rates and judicial interpretation. It will also discuss any proposed updates and amendments to the 1990 Act, with particular focus on the Police and Justice Act 2006 and its possible ramifications.

• Does the effective regulation of computer misuse require more than just a response in domestic criminal law?

Having considered the evolution of computing, computer misuse and the Computer Misuse Act 1990 in Chapters 2 and 3, Chapter 4 reflects upon the question of whether the solution to the effective regulation of computer misuse requires more than just the domestic criminal law. It considers the characteristics and purpose of the criminal law from a range of theoretical perspectives and its application to the problem of computer misuse in particular. This facilitates an examination of whether the domestic criminal law has limitations and, if so, whether those limitations arise from the nature of computer misuse or the nature of the criminal law itself.

• How do theories of risk and governance apply to computer misuse and the domestic criminal law?

Chapter 5 introduces the theoretical framework upon which the second part of the book is based. It explores theories relating to risk from realist, cultural and symbolic, ‘risk society’ and governmentality perspectives before considering the idea of a governance network as a means of responding to risk. It concludes with an examination of computer misuse and the role of the domestic criminal law in the light of these theories.

• What is the role of the law in the governance of computer misuse?

Chapter 6 builds upon the discussion from Chapter 5 by evaluating the role of the law in general within the governance framework. It broadens the analysis beyond the domestic criminal law to introduce new nodes of governance at the European Union, Council of Europe, Commonwealth, United Nations and G8 levels in order to explore whether there may be advantages in moving beyond the domestic criminal law in the response to computer misuse.

• Can extra-legal approaches provide an effective response to computer misuse?

Chapter 7 widens the discussion of the role of the law in relation to computer misuse covered in Chapter 6 to include potential extralegal responses. It will establish a typology of extra-legal governance initiatives and will examine the contribution made by each of these to the regulation of computer misuse.

Chapter 8 summarises the findings of the preceding chapters by way of conclusion and provides a final critical examination of the central hypothesis.

Terminology

‘Computer misuse’ has been defined as ‘unethical or unauthorised behaviour in relation to the use of computers, programs, or data’.² Defined in this way, a wide variety of computer misuse issues can be considered to determine the most appropriate means of response to them.

Computer misuse is a different concept to ‘computer crime’ or ‘cybercrime’. It is important to differentiate between these terms. Computer crime is usually defined by reference both to the use of a computer as the principal tool to perpetrate criminal offences and by threats to the computer or system itself.³ In essence, a computer crime is one in which a computer has either been the object, subject or instrument of a crime. For example, by this definition, ‘phishing’⁴ is a computer crime, since it would fall within the boundaries of section 1 of the Fraud Act 2006 which criminalises fraud by false representation. This is satisfied by the dishonest false representation that the phishing website is legitimate, with the intention of making a gain or causing the victim to suffer loss. The use of the computer here could be considered peripheral to the offence itself. Fraud by false representation can be committed without a computer by, for example, dishonestly using a stolen credit card or selling fake designer goods. Similarly, physical threats to the computer or system itself such as the theft of hardware or software are manifestations of familiar property offences. They are not ‘special’ simply because a computer is the target of the attack. As Ingraham comments:

Striking a watchman with a disk pack should remain the battery that it is, and ...

Table of contents

• Cover Page
• Half Title Page
• Title Page
• Copyright Page
• Contents
• List of abbreviations
• List of figures and tables
• Table of cases
• Table of legislation
• Acknowledgements
• Preface
• 1 Introduction
• Part 1 Constructing the problem of computer misuse
• Part 2 The governance of computer misuse
• Part 3 Examining the solution
• Appendix: Outline research methodology
• Bibliography
• Index