Computer Misuse Act

11 Key excerpts on "Computer Misuse Act"

• 

  eBook - PDF

  Essential Law for Information Professionals

  • Paul Pedley(Author)
  • 2019(Publication Date)
  • Facet Publishing

    (Publisher)

  186 on Criminal Law: Computer Misuse (Cm 819), published in October 1989 in order to create specific offences to secure computers against unauthorised access or modification. Whilst the Act was originally intended mainly to address the problems caused by computer hacking, it is also being used effectively to deal with the deliberate release of computer viruses. The CMA (as amended) creates five offences: 1 It is an offence to cause a computer to perform any function with intent to gain unauthorised access to any program or data held in any computer, knowing at the time that it is unauthorised (Computer Misuse Act section 1). 2 It is an offence to commit an offence of unauthorised access under section 1 with the intention of committing or facilitating the commission of further offences (Computer Misuse Act section 2). 3 Unauthorised acts with intent to impair, or with recklessness as to impairing, operation of computer, etc. (Computer Misuse Act section 3). CYBERSECURITY AND CYBERCRIME 289 Illegal access Article 2 Illegal interception Article 3 Data interference Article 4 System interference Article 5 Misuse of devices Article 6 Computer-related forgery Article 7 Computer-related fraud Article 8 Offences related to child pornography Article 9 Offences related to infringement of copyright and related rights Article 10 Figure 14.2 Offences covered by the Council of Europe Convention on Cybercrime 290 ESSENTIAL LAW FOR INFORMATION PROFESSIONALS 4 Making, supplying or obtaining articles for use in offence under section 1, 3 or 3ZA. (Computer Misuse Act section 3A which was inserted by the Police and Justice Act 2006). 5 Unauthorised acts causing, or creating risk of, serious damage (Computer Misuse Act section 3ZA which was inserted by the Serious Crime Act 2015). This means that the Act is suitable for use against activities carried out across networks.

  Sign up to read

  Learn more about book
• 

  eBook - ePub

  Security and Crime Prevention in Libraries

  • Michael Chaney, Alan F. MacDougall(Authors)
  • 2019(Publication Date)
  • Taylor & Francis

    (Publisher)

  There are also the more generalised problems of terrorism which are tending to increase in a society where more and more groups seem to emerge with a grievance that they are unable or unwilling to articulate by more rational means. Allied to this is the problem of hoaxers and sensation seekers whose aim is mainly to cause disruption rather than damage. Many managers will have experienced bomb hoaxes which have involved the troublesome and costly evacuation of buildings and shutdown of systems.

  THE Computer Misuse Act 1990

  Mention was made earlier of the Computer Misuse Act 1990 as a recent component in the endeavour to combat IT crime and misuse. Whereas in the past legal sanctions for misuses relied on conventional approaches such as theft, trespass, and the like (which were sometimes difficult to establish) the new Act prescribes specifically for IT related wrongdoing. The Act defines three criminal offences for misusing computers:

  - unauthorised access to computer material (s. 1) - unauthorised access with intent to commit or facilitate commission of further offences (s. 2) - causing unauthorised modification of the contents of any computer (s. 3)

  A person commits the unauthorised access offence if ‘he causes a computer to perform any function with intent to secure access to any program or data held in any computer’ (s. 1(a)) and that ‘the access he intends to secure is unauthorised; and he knows at the time when he causes the computer to perform the function that this is the case’ (ss. 1(b) and (c)).

  The offence attracts a liability of imprisonment for up to six months and/or a fine of up to £2000 (s. 1(3)). Furthermore, the target of the offence need not be a specific programme or data or a particular machine (ss. 2(a), (b) and (c)).

  The second offence of unauthorised access with intent to commit or facilitate commission of further offences is clearly more serious and the maximum penalties available increase to five years imprisonment and/ or an unlimited fine (ss. 3(5) (a) and (b)). It is immaterial whether the further offence is to be committed on the same or any future occasion as the unauthorised access offence (s. 3 (3)). Moreover, a person may be guilty of the offence even though it may be impossible to commit the further offence intended (s. 3(4)).

  Sign up to read

  Learn more about book
• 

  eBook - ePub

  Practical Data Security

  • John Gordon(Author)
  • 2019(Publication Date)
  • CRC Press

    (Publisher)

  In addition, the UN Congress called for mutual assistance on criminal matters and an investment in research and analysis to find new ways to deal with computer crime.

  The economic stakes are large. If mutual understanding and harmonisation are not achieved, data havens will result and barriers will be erected which will thwart the free flow of information. Barriers could result in companies being unable to export their goods and services to countries which have lower degrees of legal protection for computers than their own (a threat which is perceived as extremely serious by the EC in its quest to establish the Single Market) and in governments restricting data flow between their country and others which have less-developed laws, especially in the area of Data Protection.

  10.6 Other Issues Not Directly or Obviously Addressed by the Computer Misuse Act

  10.6.1 Interaction with the Data Protection Act 1984

  The words ‘unauthorised’ and ‘access’ found in section 1(b) of the CMA also can be found in Schedule 1 of the Data Protection Act 1984 which urges data holders to take ‘appropriate security measures…against unauthorised access to, or alteration, disclosure or destruction of, personal data’.

  10.6.2 Bulletin boards

  The use of bulletin boards as a means of dealing in passwords and giving advice on how to hack into any given system constitutes an offence under the Computer Misuse Act.

  10.6.3 Misuse of computer time and services

  Since it is not a criminal offence to use your firm’s electric typewriter for personal business (although I am sure many office managers would like to make it one!), why should the use of the firm’s computers for the same purpose be made into an offence? Hence, the absence of such an offence from the UK statute. However, it is not inconceivable that some activities would fall under the CMA, e.g. accessing the firm’s copy of Word Perfect without authorisation (hacking) or using up a substantial amount of processing power and thereby causing corruption to stored data (unauthorised modification to data).

  10.6.4 Fraud

  Fraud has proven to be a difficult issue for legislators in all jurisdictions. Under most definitions, fraud turns on the deceit of the human mind. Since it is not (yet) possible to deceive a machine, fraud in itself is not an actionable offence under computer crime statutes. However, there is clearly a recognition of the link between unauthorised access and fraud, a link which the Law Commission addressed.

  Sign up to read

  Learn more about book
• 

  No longer available |Learn more

  Introduction to Internet Governance, An

  • (Author)
  • 2014(Publication Date)
  • The English Press

    (Publisher)

  This Board offers advice to both the President of the United States and the entire executive branch of the Federal Government concerning its actions to ensure that the branch's information sharing policies are adequately protecting privacy and civil liberties. Legal enactments - examples The Computer Misuse Act 1990, enacted by Great Britain on 29 June 1990, and which came into force on 29 August 1990, is an example of one of the earliest of such legal enactments. This Act was enacted with an express purpose of making provision for securing computer material against unauthorised access or modification. Certain major provisions of the Computer Misuse Act 1990 relate to: • unauthorised access to computer materials, • unauthorised access with intent to commit or facilitate the commission of further offences, and • unauthorised modification of computer material. The impact of the Computer Misuse Act 1990 has been limited and with the adoption of the Council of Europe adopts its Convention on Cyber-Crime, it has been indicated that amending legislation would be introduced in paliamentary session 2004-05 in order to rectify possible gaps in its coverage, which are many. The CMA 1990 has many weaknesses, the most notable is its' inability to cater for, or provide suitable protection against a host of high tech attacks/crimes which have became more prevalent in the last decade. Certain attacks such as DDOS and BOTNET attacks can not be effectively brought to justice under the CMA. This ACT has been under review for a number of years. Computer crimes such as electronic theft are usually prosecuted in the UK under the legislation that caters for traditional theft (Theft Act 1968), because the CMA is so ineffective. A recent example of Information Technology Law is India's Information Technology Act 2000, which became effective from 17 October 2000.

  Sign up to read

  Learn more about book
• 

  eBook - PDF

  New Technologies for the Humanities

  • Christine Mullings, Stephanie Kenna, Marilyn Deegan, Seamus Ross, Christine Mullings, Stephanie Kenna, Marilyn Deegan, Seamus Ross(Authors)
  • 2019(Publication Date)
  • De Gruyter Saur

    (Publisher)

  Despite this, a recent survey by the Department of Trade and Industry, ICL, and the National Computing Centre (Woollacott 1994) reported that IT security breaches cost UK businesses £1.2 billion a year. Because the greater part of this sum can be attributed to fraud and theft from financial systems, it might be assumed that the issue of security has less relevance to the academic world. However, this is not the case: all computer systems are vulnerable to abuse. Criminal damage may be committed against the computer system itself, or the data, or software stored within. Such damage can be caused inadvertently by inexperienced users, or there can be malicious intent on the part of both authorized and unauthorized users. This latter category includes the dissemination of computer viruses: self-replicating pro-grams which can be designed to carry out destructive activity. Inadequate security can also lead to breaches of the Data Protection Act. Another area of concern is the use of the computer to commit other crimes, for example theft, or illegal copying of software. Fortunately, the legal system does afford protection against the abuse of computer systems. The Computer Misuse Act was passed in 1990 to combat the problems outlined above. The Act created three new catego-ries of criminal offence: unauthorized access to computer material, unauthorized access with intent to commit or facilitate commission of further offences, and the unauthorized modification of computer material (Austen 1993). Computer Usage and the Law 141 The first of these offences is aimed at 'hackers', those who break into, or 'hack* computer systems merely for the sense of achievement in overcoming the host security systems. A conviction renders the hacker liable to a jail term of up to six months, or a fine of £2,000, or both. To secure a conviction, it must be proved that the perpetrators knew they were unauthorized at the time of access.

  Sign up to read

  Learn more about book
• 

  eBook - ePub

  Cybersecurity Law

  • Jeff Kosseff(Author)
  • 2017(Publication Date)
  • Wiley

    (Publisher)

  Some prosecutors, plaintiffs, and courts have adopted particularly broad views of these anti-hacking laws. Many of these statutes prohibit not only traditional unauthorized access but the unauthorized use or transfer of information, or circumvention of access controls. Indeed, the laws often present barriers to cybersecurity researchers who are seeking to identify software bugs and other flaws in order to help companies improve the security of their products and services. At the same time, companies that often are the victims of hacking argue that the laws are not strong enough to deter the worst behavior. Anti-hacking legislation is particularly a concern for companies that experience widespread theft of their trade secrets and other confidential information.

  In short, there is little agreement about the scope and reach of computer hacking laws. For that reason, many of the laws discussed in this chapter are still controversial, and a number of key political players have long called for significant amendments to the laws.

  5.1 Computer Fraud and Abuse Act

  The Computer Fraud and Abuse Act is the primary U.S. federal statute that prohibits and penalizes certain forms of computer hacking. The statute imposes both criminal and civil penalties for actions taken by an individual who either lacks authorization to access a computer or exceeds authorized access to that computer.

  5.1.1 Origins of the CFAA

  Congress passed the CFAA due to a growing concern about computers becoming increasingly networked and subject to unauthorized access, compromising sensitive data such as credit card numbers. The modern version of the CFAA is based on a 1986 amendment to a 1984 law, the Counterfeit Access Device and Computer Fraud and Abuse Act, which was focused primarily on hacking financial institutions and the federal government. Rather than only addressing particular types of sensitive information, Congress chose to regulate the method by which people access all information without proper authorization. As the 1984 House Judiciary Committee Report accompanying the initial bill noted, experts testified in committee hearings “that we need to shift attention in our statutes from concepts such as ‘tangible property’ and credit and debit instruments to concepts of ‘information’ and ‘access to information.’”1

  Sign up to read

  Learn more about book
• 

  eBook - PDF

  Principles of Cybercrime

  • Jonathan Clough(Author)
  • 2015(Publication Date)
  • Cambridge University Press

    (Publisher)

  18 In addition, the recently enacted Serious Crime Act 2015 (UK) has inserted a new s. 3ZA into the Computer Misuse Act. 19 The new section is similar to s. 3 in that it applies to any unauthorised act in relation to a computer, where the person knows that the act is unauthorised. 15 Maximum penalty is ten years ’ imprisonment: ibid . , s. 430(5). 16 There is some debate in the UK as to the form of recklessness which applies in this context: see S. Fa fi nski, ‘ Computer misuse: The implications of the Police and Justice Act 2006 ’ (2008) 72 Journal of Criminal Law 53, 58. 17 Computer Misuse Act, s. 3(1) – (3). These offences are punishable on indictment by a maximum penalty of ten years ’ imprisonment: s. 3(6). 18 Law Commission (UK), Computer misuse , Final Report No. 186 (1989), [3.77]. 19 Serious Crime Act 2015 (UK), s. 41. modification or impairment of data 115 However, it will apply where the act ‘ causes, or creates a signi fi cant risk of, serious damage of a material kind ’ , 20 and the person intends to or is reckless as to causing such damage. 21 The act causing the damage may do so indirectly, and need not be the only or even the main cause. 22 D. The United States The principal federal offence relating to ‘ damage ’ to computers is found in 18 USC § 1030(a)(5). 23 There are three limbs to this offence. The fi rst is concerned with ‘ transmission of a program information, code or command ’ , and punishes the intentional causing of damage. 24 The second and third limbs are both concerned with intentional unauthorised access, where damage, or damage and loss, is caused, either recklessly or inadvertently. 25 Each offence requires proof that the conduct was unauthorised, and that damage, or damage and loss, was caused. The fault element of these provisions is signi fi cant. In the fi rst the transmission must be caused knowingly and the damage intentional.

  Sign up to read

  Learn more about book
• 

  eBook - ePub

  Policing Digital Crime

  • Robin Bryant(Author)
  • 2016(Publication Date)
  • Routledge

    (Publisher)

  Chapter 4Law and Digital Crime Ed Day with Robin Bryant

  Introduction

  Between 2006 and 2010 there were only 90 convictions in the UK under the Computer Misuse Act 1990 (total derived from data given in Hansard, 2012). Further, the number of convictions per year actually fell between 2006 and 2010 (from 25 to 10, ibid.). Yet it seems inconceivable that this small absolute number and relative decline is the result of fewer ‘computer crimes’ being committed. Part of the explanation for this apparent paradox is that many of the crimes within the UK that occur online, or with other digital characteristics, are prosecuted under alternative legislation such as the Fraud Act 2006. For example, hacking is covered explicitly by the Computer Misuse Act 1990 (CMA), and although it might be involved in enacting extortion (for example), it is the extortion that is likely to be prosecuted as this will carry the heavier penalty on conviction.

  Deciding how to make best use of the inevitably limited resources for tackling digital crime is a key aspect of a pertinent debate. It is estimated that the amount spent on defending against cybercrime (for example the cost of anti-virus software) is far higher than the amount spent on policing cybercrime (the actual apprehension and prosecution of offenders). However, research suggests that a small number of criminal networks are responsible for a large number of cybercrime incidents, so the money might be better spent on targeting these groups rather than trying to defend against the incidents in the first instance. If this is the case then legislation will have key role to play in the efficient policing of digital crime, and it is vital that the legislation be appropriate, reasonable and logically targeted.

  Many difficulties arise when using legislation for targeting crimes committed in rapidly changing technical contexts, not least of which is that it is difficult for the details of new legislation to keep pace with technological change. In addition the multi-jurisdictional nature of much digital crime presents additional challenges, as does the fact that legislation has to exist within complex political systems, for example the UK must follow European Union directives when creating legislation to combat much cybercrime. There are also debates on the necessary extent and the nature of such regulation. Many argue that there is too much legislation (Wilson, 2010) but others insist that more laws are required to protect individuals, e-commerce and society. Regulation of course may have unintended effects, for example on privacy (Busch, 2012), and this further colours the debate on how far cyberspace should be regulated.

  Sign up to read

  Learn more about book
• 

  eBook - ePub

  Computer Misuse

  Response, Regulation and the Law

  • Stefan Fafinski(Author)
  • 2013(Publication Date)
  • Willan

    (Publisher)

  13

  13 Police Officer 1.

  What would be the point in going to the police? They're not going to recover our data. Even if there's a miracle and they do catch whoever's done it, we'll still be out of pocket. Locking someone up won't help us.14

  14 User 3.

  It seems therefore that the 1990 Act has not been greatly exercised in comparison to the growth of the problem of computer misuse. In order to explore why this might be the case, the next section will consider the ways in which it is has been applied and examine whether the Act presents particular interpretative challenges for the court.

  Interpretation of the Computer Misuse Act 199015

  15 See also Fafinski, S., ‘Access denied: computer misuse in an era of technological change’ (2006) 70 Journal of Criminal Law 424.

  Section 1 — The basic hacking offence

  Early judicial interpretation of this section was somewhat curious. In R v. Cropp,16 the defendant visited his former employer and obtained a 70 per cent discount on goods by entering the discount on the computerised till part way through a transaction, while the sales assistant was absent in the storeroom checking details of the serial number of the goods in question. This resulted in an invoice for £204.60 plus VAT instead of the correct sum of £710.96 plus VAT. Cropp was charged under section 2(1) of the 1990 Act, allegedly having secured unauthorised access to a computer in contravention of section 1(1) of the 1990 Act with intent to commit the further offence of false accounting.17

  Sign up to read

  Learn more about book
• 

  eBook - PDF

  Cybersecurity Law

  • Jeff Kosseff(Author)
  • 2022(Publication Date)
  • Wiley

    (Publisher)

  Cybersecurity Law, Third Edition. Jeff Kosseff. © 2023 John Wiley & Sons, Inc. Published 2023 by John Wiley & Sons, Inc. Companion Website: www.wiley.com/go/kosseff/cybersecurity3e 193 5 Antihacking Laws U.S. legislators have passed statutes to address what they view as the increas- ingly big threat of computer hacking. This chapter looks at some of the laws commonly used to prosecute people who access computers, software, or data without authorization or in excess of authorization: the Computer Fraud and Abuse Act (CFAA), state computer hacking laws, Section 1201 of the Digital Millennium Copyright Act (DMCA), and the Economic Espionage Act (EEA). Section 2701 of the Stored Communications Act, which penalizes individuals for hacking stored communications, such as email, is discussed in Chapter 7, along with the rest of the Stored Communications Act. Some laws discussed in this chapter provide government prosecutors with the ability to bring criminal charges against individuals who hack computers without authorization. In some cases, conviction on a single count of violation of these laws can result in a prison sentence of ten or more years, as well as severe fines. The laws also allow the victims of computer hacking to bring civil suits to recover damages from the hackers and obtain injunctions to prevent further damage. Unfortunately, some antihacking laws were written before the arrival of many technologies that are now commonplace in computer networks and sys- tems. Accordingly, in many cases there are disagreements about the reach of the laws, and what constitutes illegal “hacking” that should lead to criminal sentences and civil liability. Some prosecutors, plaintiffs, and courts have adopted particularly broad views of these antihacking laws. Many of these statutes prohibit not only tradi- tional unauthorized access but also the unauthorized use or transfer of infor- mation, or circumvention of access controls.

  Sign up to read

  Learn more about book
• 

  eBook - PDF

  Cybercrime

  Key Issues and Debates

  • Alisdair A. Gillespie(Author)
  • 2019(Publication Date)
  • Routledge

    (Publisher)

  It is this behaviour that will be examined in this chapter. Four issues will be examined although they do overlap to an extent. The issues are: 1. Destroying data. 2. Inappropriate access to data. 3. Unlawful disclosure of data. 4. Interception of data. The first three types of behaviour are to an extent linked whereas the fourth is probably separate. Destroying, disclosing and accessing data The first type of behaviour to consider is that which relates to the destruction, disclosure or accessing of data. ‘Accessing’ has been considered quite exten-sively in the previous chapter but there are other offences that are relevant, and these will be briefly discussed in this chapter. Realistically there are two ways in which the destruction, access or disclosure of data can occur. The first is where a person gains unlawful access to a computer system and either destroys, accesses or discloses the data that they have found (or, in respect of destroying data, infects a computer with malware) and the second is where someone who is authorised to access the computer then subsequently destroys or discloses data (without authority). In respect of the first method the liability would be based on the unlawful access or the creation of malware. This was already discussed in Chapter 2 and reference should be made there. Offences relating to data 65 The second method of committing these crimes is linked by the concept of ‘authorised’. It will be remembered from Chapter 2 that the Computer Misuse Act 1990 (CMA) is based on unauthorised access and therefore it is necessary to initially consider what authorisation means. Authorisation As noted already the key to crimes under the CMA 1990 is whether the access or act is unauthorised.

  Sign up to read

  Learn more about book