Computer Misuse
Total Page:16
File Type:pdf, Size:1020Kb
The Law Commission Working Paper No. 110 Computer Misuse I HER MAJESTY'S STATIONERY OFFICE I The Law Commission was set up by section 1 of the Law Commissions Act 1965 for the purpose of promoting the reform of the law. The Law Commissioners are: The Honourable Mr. Justice Beldam, Chairman Mr. Trevor M. Aldridge Mr. Brian Davenport, Q.C. Professor Julian Farrand Professor Brenda Hoggett The Secretary of the Law Commission is Mr. Michael Collon and its offices are at Conquest House, 37-38 John Street, Theobalds Road, London, WC1 N 280. Thisworkingpaper,completed on 11 August 1988,iscirculatedforcomment and criticism only. It does not represent the final views of the Law Commission. The Law Commission would be grateful for comments before 28 February 1989. All correspondence should be addressed to: Mr M N Farmer Law Commission Conquest House 37-38 John Street Theobalds Road London WClN 2BQ (Tel: 01-242 0861 Ext. 231 Fax: 01-242 1885) It may be helpful for the Law Commission, either in discussion with others concerned or in any subsequent recommendations,to be able to refer to and attribute comments submitted in response to thisworking paper. Whilst any request to treat all, or part, of a response in confidence will, of course, be respected, if no such request is made the Law Commission will assume that the response is not intended to be confidential. The Law Commission Working Paper No. 1 10 Computer Misuse LONDON HER MAJESTY'S STATIONERY OFFICE 0 Crown copyright 7988 First published 1988 ISBN 0 11 730192 2 THE LAW COMMJSSION WORKING PAPER NO. 110 Paragraphs I!%!? PARTI - JN"ROIX.JCTION 1.1-1.16 1 A. BACKGROUND 1.1-1.4 1 B. "COhWUI'ER CRIME" 1.6 - 1.6 3 C. PREPARATION AND STRUCTURE OF THE PAPER 1.1-1.10 4 D. GUIDELINES FOR THE CREATION OF NEW CRIMINAL OFFENCES 1.11 6 E. TERMINOLOGY 1.12-1.16 7 PARTE -TYJ?ESOFCOMPUI'ER- 2.1-2.19 10 A. COMPWI'ERFRAUD 2.2-2.9 11 1. Input frauds 2.4-2.6 11 2. Output frauds 2.7 13 3. Program frauds 2.8-2.9 13 B. UNAWIWORISED OBTAINING OF INFORMATION FROM A COMPUI'ER 2.10-2.16 14 1. Computer "hacking" 2.11-2.12 14 2. Eavesdropping on a computer 2.13 15 3. Making unauthorised use of computer facilities for personal benefit 2.14-2.16 16 C. UNAUTHORISED ALTERATION OR DESTRUCTION OF INFORMATION STORED ON A COMPUTER 2.16-2.17 17 D. DENYING ACCESS TO AN AWORLSED USER 2.18 18 iii Paragraphs E. UNAUTHORLSED REMOVAL OF INFORMATION STORED ON A COMPUTER 2.19 19 PART III - 'LHE SCOPE OF 'RIE PRESENT LAW 3.1-3.71 20 A. COMPUI'ERFRAUD 3.2-3.11 20 1. Theft 3.3-3.4 21 2. Obtaining property by deception, and other deception offences 3.6-3.7 21 3. False accounting 3.8-3.9 23 4. Conspiracy to defraud 3.10-3.11 26 B. OBTAINING UNAUI'HORLSED ACCESS TO A COMPUI'ER 3.12-3.34 26 1. Hacking 3.13-3.29 27 (a) Forgery 3.14-3.22 27 (b) Abstraction of electricity 3.23-3.26 32 (c) Criminal damage 3.26-3.27 33 (d) Interception of communications 3.28 34 (e) Improper use of a public telecommunication system 3.29 36 2. Eavesdropping on a computer 3.30-3.32 36 3. Using a computer for unauthorised private purposes 3.33-3.34 37 C. UNAUTHORISED ALTERATION OR ERASURE OF DATA OR SOFTWARE 3.36-3.40 38 D. UNAUI'HORISED COPYING OF DATA OR SOFTWARE 3.41-3.48 42 1. Temporary physical removal 3.42-3.44 43 2. Electronic copying 3.46-3.48 46 (a) Unauthorised copying under the Theft Act 1968 3.46-3.47 46 (b) Unauthorised copying under the Copyright, Designs and Patents Bill 1988 3.48 47 E. USE OF INFORMATION HELD UNDER ?HE DATA PROTECTION ACT 1984 3.49-3.60 47 iv Paiagraptis 1. The structure of the Act 3.60-3.63 48 2. Enforcement of the Act 3.64-3.67 61 3. The Data Protection Act 1984 and hacking 3.68-3.60 66 F. CML LIABlLITY FOR COMPUl'ER MISIKSE 3.61-3.63 66 C. THE SCOPE OF THE PRESENT LAW RELATING TO COMPVTER MIEXBE: CONCLWIONS 3.64-3.71 69 1. Computer fraud 3.64 69 2. Obtaining unauthorised access to a computer 3.66-3.67' 60 (a) Hacking 3.66 60 (b) Eavesdropping on a computer 3.66 60 (c) Using a computer for unauthorised private purposes 3.67 60 3. Unauthorised alteration or erasure of data or software 3.68 61 4. Unauthorised copying of data or software 3.69 61 5. Use of information held under the Data Protection Act 1984 3.70 62 6. Civil liability for computer misuse 3.71 62 PART Iv - REFORMING THE PRESENT LAW (1): OUR GENERAL APPROACH 4.1-4.7 63 A. POSSIBLE GENERAL APPROACHES TO REFORM 4.2-4.7 63 1. A computer crime statute 4.3 64 2. Limited reform of the general law 4.4 64 3. A "half-way'' approach 4.6-4.7 66 PART V - REFQRMING THE PRESENl' LAW (2): COMF'UER FRAUD 6.1-5.7 67 A. "DECEIVING" A MACHINE 6.1-6.6 67 B. OBTAlNING (COMPUl'ER) SERVICES BY DECEPTION 6.6 70 C. CONSPIRACY TO DEFRAUD 6.7 71 V 73 A. COULD THE CML LAW PROVIDE AN EFFECTIVE REMEDY AGAINST UNAUTHORISED ACCESS TO A COMPUTER? 6.4-6.6 74 B. SHOUI+D THE OBTAINING OF UNAWIl-iORISED ACCESS TO A COMPUTER BY HACKING BE A CRIMINAL OFFENCE? 6.7-6.19 76 1. The arguments for an offence 6.8-6.14 17 2. The arguments against an offence 6.16-6.16 81 3. The extent of the problem 6.17-6.18 82 4. Conclusions 6.19 86 C. OPTIONS FOR REFORM - GENERAL 6.20-6.24 86 1. "Obtaining access to a computer" 6.22-6.23 86 2. "Unauthorised" 6.24 88 D. PARTICULAR OPTIONS 6.26-6.37 90 1. Option A 6.26-6.28 . 90 (a) Arguments for 6.26 90 (b) Arguments against 6.27-6.28 90 2. Option B 6.29-6.31 91 (a) Arguments for 6.30 91 (b) Arguments against 6.31 91 3. Option C 6.32-6.34 92 (a) Arguments for 6.33 92 (b) Arguments against 6.34 92 3. Option D 6.36-6.37 93 (a) Arguments for 6.36 93 (b) Arguments against 6.37 . 94.. ' E. MODE OF TRIAL AND PENALTIES 6.38 94 F. A'ITEMPTS 6.39 96 PART W - REF'ClRMlNG THE PRE!SEW LAW (4): JuRlsDpcTION 7.1-7.14 96 vi Paragraphs A. COMMON-LAW RULES OF JURISDICTION 7.2-7.3 96 B. PARTICULAR FEATURES OF COMPUlER MISUSE 7.4-7.14 97 1. Computer fraud 7.6-7.9 98 2. Hacking 7.10-7.12 101 3. Unauthorised alteration or erasure of data or software 7.13-7.14 103 PART Vm - PROVISIONAL CONCLXE30W AND SUMMARY OF POINIS FOR COPSLILTATION 8.1-8.10 104 A. FRAUD 8.3 104 B. HACKING 8.4-8.8 106 C. USING A COMPUT'ER FOR UNAUI'HORLSED PRIVATE PURPOSES 8.10 107 D. UNAVT'HORISED ALTERATION OR ERASURE OF DATA OR SOFTWARE 8.11 108 . APPENDIX A - C0MF"ER MISUSE: ?HE LAW JN OTHER JURISDICTION5 1-58 109 A. INTRODUCTION 1-14 109 1. The "evolutionary" approach 6-9 111 2. Enacting computer-specific offences to "fit" into existing statutes 10-11 112 3. Enacting computer-specific statutes 12-14 112 B. CATEGORIES OF MISUSE 16-60 113 1. Unauthorised access 15-26 113 2. Other categories of misuse 27-37 119 3. Defences 38-43 123 4. Penalties 44-60 125 C. DEFINITIONS OF "COMPUTER" 51-58 126 APPENDM B - m To DISCLOSE INcIDENls OF COMPUIER MlSE4E 129 vii THE LAW COMMISSION WORKING PAPER NO. 110 COMPUTER MISUSE SUWMARY In this Working Paper, the Law Commission examines a range of activities which might be said to constitute computer misuse, and considers the application of the criminal law in England and Wales to them. The paper concludes that, in general, the present scheme of criminal offences is sufficient to deal with the forms of computer misuse identified. The Commission‘s provisional view is that a comprehensive computer crime statute is neither necessary nor appropriate here. Only one form of computer misuse might be said to require the creation of a “computer crime”: the obtaining of unauthorised access to a computer by “hacking“. The paper sets out the arguments for and against the criminalization of such conduct, and considers a range of options for a new offence. The Commission asks whether hacking should be criminalized and, if so, whether it should be an offence along the lines of one of the four options suggested. The purpose of this paper is to obtain the views of the public on the matters considered in it. viii THE LAW COMMISSION WORKING PAPER NO. 110 COMPUTER MISUSE PART I INTRODUCTION BACKGROUND 1.1 Computers now play an important part in our everyday lives. This technological development , upon which society is becoming ever more dependent in hundreds of different ways , has without doubt produced substantial benefits for us all. However, alongside these benefits lies I the disadvantage that computers and computer systems are vulnerable to all manner of misuse.