Contrary to popular belief, the law is reasonably well equipped to deal with computer crime and has been substantially strengthened by recent legislation. Discuss

Computer-enabled crimes, ie those crimes which involved the use of a computer to commit such crimes as forgery, fraud, obscenity, criminal damage and hate crimes, had been governed by a variety of legislative instruments, though sometimes amended to close loopholes and lacunas and will be identified and addressed more fully below.

The CMA was enacted to redress the clear inability of criminal law to combat computer fraud and misuse crimes due to advances in technology or the courts interpretation of the law and made hacking, unless performed under statutory powers, and the introduction of viruses into computer systems, criminal offences. However, existing legislation and the common law was left to deal with computer-enabled traditional crimes where alternative charges could be used.  The first case heard under the CMA  established that only one computer need be involved.

One of the CMA’s main failings was that it was only applicable to computer crimes which accessed  or modified computers without authorisation. However, where authorisation is given for access but none for accessing programs or data this must be clearly defined in order to obtain a conviction. Technological developments meant that the CMA gave no legal protection or redress for DoS or DDoS attacks.

Intent need not now be proved. Recklessness is sufficient for the making, adapting or supplying of tools for use, or likely use, in computer offences and together with the inclusion of reckless and intentional launching of DoS, DDoS, botnet or blended threat attacks, these are now all criminal offences.

                                        

Another major concern is that computers and other electronic technological devices can be used to commit fraud. This computer crime can be used to obtain money, have an identity accepted from information misappropriated. However, most information or data is not property unless safeguarded under criminal law.

Computer fraud can be defined as “any fraudulent behaviour connected with computerisation by which someone intends to gain dishonest advantage.” It can be committed by input, output and program frauds whether to access data without the required payment, to make phantom withdrawals from ATM’s or to phish  or pharm for data or even to use a telecommunications service with the intention not to pay for it.

The enactment of the recent Fraud Act (hereinafter FA) provided an opportunity not only to modernise by including on-line frauds and other offences using technology, redress judicial trouble in applying existing law and of bit by bit amendments, but to finally define fraud and  article. Fraud can now be committed in one of three ways; by (1) making a false representation e.g. phishing. There is no necessity to have need a victim as the attention is on the representation itself. This removes occurrences where a credit card is used in breach of the victims authorisation; (2) wrongfully failing to disclose information e.g. in fraudulent credit card transactions over the Internet or where a person is under a legal duty to disclose information. The dishonesty is in the failure to give the information and not of any representation. Finally (3) an offence can be committed by secretly abusing a position of trust e.g. an employee enables a competitor to win a tender contrary to his contractual duties. All offences are inchoate but require dishonesty as defined in the Ghosh test and an intention to gain some material benefit. However, there is no longer any requirement to prove any actual gain or loss, or that the property belonged to another or that there was a link between the deception and the obtaining. The FA also repeals some of the deception and other offences in the Theft Acts,  updates the offence of dishonestly obtaining a service and introduces new offences which will cover the credit card skimmers on ATM’s. 

One of the main problems prior to the FA, which now removes the need for a person to be deceived, was that in order to convict, many frauds prosecuted under some of the theft offences required proof of the deception of a human mind. Deception is

“…any deception (whether deliberate or reckless) by words or conduct as to fact or as to law, including a deception as to the present intentions of the person using the deception or any other person.” 

   

The common law had previously defined deception, but this proved difficult for the courts to apply especially where ATM’s or other electronic means were used to commit crimes which led to acquittals or quashing of convictions as the courts concluded it was not possible to deceive a machine.

Computer crime encompasses issues of the processing, storage, display or transmission of personal information or data and some offences may be charged under the Data Protection Act (hereinafter DPA) as opposed to the CMA or PJA. The DPA widened the range of data protection further than that of automatically processed information and makes individuals liable to prosecution for any unauthorised disclosure of someone’s personal data. It applies if personal data is kept on, or in connection with, a web site, computer, office system or in manual records providing that they form part of a relevant filing system or if the holder of that information or data is unregistered.

There are websites that sell fake ID documents. They usually require a purchaser’s agreement that these documents are for “novelty and fun purposes only”. It was recently estimated identity fraud cost the UK market £1.7 billion. Whilst this may be a criminal offence, it is one that would be difficult, even with recent legislation passed, to effectively prosecute as the documents are not listed, they themselves worthlessand intent would be extremely hard to establish. However belief or recklessness may be possible to establish.

Obscenity and pornography can also be unlawful data use and data publication and a public telecommunications network’s definition can encompass Internet traffic as it uses phone lines or other cables. The Internet provides an illegal way to publish,  view, storeand transmit obscene material which “tends to deprave and corrupt those who are likely…to read, see or hear it” or indecent material. Additionally, the burden of proof is reversed. 

The pornographic depiction of children in cyberspace has become a growing concern and recent legislation has been modernised to attempt to prevent and convict those involved in such photographic imagery, is criminal and virtually a strict liability offencewhether committed in the UK or abroad. However, these photographic or pseudo-photographic images must be in the possession of the defendant and need only be for their own useand not for financial gain or sharing. Even if they are unaware of downloading them, as their browser setting allows it to be, the offence of “making”  is satisfied.

The Internet provides not only the opportunity to possess and to  supply obscene or indecent material, but creates a danger from online predators by their submitting children to sexual grooming which can occur without any meeting actually taking place, or in the commission of other offences. The recent Safeguarding Vulnerable Groups Act includes some online services as regulated activities. This

means that any organisation which knows it is regulated and knowingly employs a barred person to perform work, commits a criminal offence.                        

The Terrorism Act 2006 makes the dissemination of terrorist publications or training material, any acts preparatory to or for the encouragement of terrorism and the threat or use of hacking a potential act of cyber-terrorism. Hacking must be designed to interfere with or seriously disrupt an electronic system, or by influencing the government or intimidating a section or all of the public and to be used to advance a political, religious or ideological cause. However, the internet can be used legitimately even for an illegitimate useand any prosecution will be made under the CMA, Criminal Damage Act or PJA.                  

Inciting either racial or religious hatred by publishing and disseminating online materials is a criminal offence and the Racial and Religious Hatred Act  was enacted to close the gaps in existing law  which had addressed anti-religious, racist, inflammatory, politically subversive or seditious statements on computer systems or the internet. Recent legislation has extended this to include hatred against people on grounds of sexual orientation.

The Protection from Harassment Act, updating the Malicious Communications Act makes 'stalking' or harassment by targeted email or other online method a criminal offence and sending unsolicited email messages and advertisements can also be Internet harassment if the content is offensive or is explicitly sexual.

Whilst many computer crimes are covered by statutory legislation, some even though not truly criminal are covered by common law; i.e. laws of defamation, contract, confidence and conspiracy to defraud, apply in cyberspace. Postings on internet message boards, discussion forums, blogs and other similar facilities can, if defamatory may be held to be libelous. An individual or company can terminate a contract of employment, under the law of contract, where an employee has breached confidentiality terms in that contract by their using or disseminating, without permission, information contained in company computers, digitalised data and programs. They can also sue to prevent the spread and to enforce the return of such information. The law of conspiracy to defraud does not require a deceit and has been excluded in the FA reforms as being adaptable and therefore could be applied, even when another crime is committed, when the original computer crime is carried out or to criminal acts outside UK jurisdiction.        

In conclusion computer crimes are usually the result of weaknesses in computer systems which allow some people to take advantage of them. The speed at which technology evolves and the process and speed at which legislation is implemented means that any law is only adequate at that particular time it is drafted. The recent case of McKinnon v USA for offences under s2 CMA committed from the UK but target and damage caused in USA shows that it may be better to be tried under one country’s laws than those of another.

Many people, as a result of computer technological advances, now bank on-line and buy goods and services over the internet from others who may be based here in the UK or overseas. Cyber frauds are developing from the familiar fraudulent use of credit cards, as the cards themselves need not be used, to raiding these e-bank accounts.

There are already critics who are concerned that anyone who makes software tools, which could be used for legitimate as well as illegal hacking, could be criminalised as legislative provisions do not make any difference for the reasons for their use. However, s3A CMA will require enforcement agencies and the judiciary to ascertain whether any offences have been satisfied as articles can be quite legally made, supplied etc before convicting. 

Paul Mobbs stated:

 “…it is difficult to clamp down on computer-based crime by legislating against certain types of activity without affecting others…many innocent people could be covered as part of efforts to control a very small minority of 'Net users.”  

Furthermore, consideration has not been given, in any new UK legislation, to some cyber issues such as spamming. 

Between 2001 and 2006 there were only 89 convictions under the CMA. The amendments made to the CMA and the introduction of the PJA should go some way to convict those committing  DoS and DDoS attacks and the stiffer penalties may help to deter,  as viruses can be both costly in terms of finance and disruption. The Solicitor-General stated that there were over 36,000 prosecutions under the FA since its introduction and it would appear that the Act is effectively tackling the prior problems of needing a deception, the obtaining property of another which resulted in a permanent loss as the loss can now be temporary or being open just to the possibility of a loss.

The recent National Fraud Strategy identified that “fraudsters [annually] rob us all of around £14 billion pounds of hard-earned income…fraudsters are adept at adapting…advances in technology will continue to facilitate new types of fraud,” and includes a data sharing framework and establishment of anti-fraud organisations which may assist in the battle against e-crimes.

Computer crimes are borderless and as a result of fast technological advances new computer crimes, and the commission of existing or more traditional crimes, are often unforeseen and unforeseeable. In order not to have laws that are successful in preventing, enforcing and punishing computer crime there needs to be co-operation from all countries, and with similar national and international laws. 

It is virtually impossible to legislate against unknown risks and, if drafting is too middle-of-the-road, this may result in legislative instruments which are either too broad or constricting to be effective. As Charlotte Walker-Osborn stated:  

"the law takes a while to catch up and the practice of it is key…it is not going to put strong offenders off… the cross-jurisdictional nature of many online crimes will also make it difficult to prosecute offenders under these laws.” 

Recent legislation does appear to have strengthened existing law, and therefore the statement given may be correct. However, the law will continue to be in a catch-up situation as new legislation and amendments are reactive and may be seen by some not to be reasonable in the prevention, deterrence and punishment of computer and cybercrimes.

WORDS :  3,257

---