IS Lecture 10 Legal Control of Computer Crime Information Management and Computer Security, 3, 2, 13-19, 1995

F Introduction F Hacking and computer viruses - 2 of the more fashionable activities under the computer crime umbrella. F In some countries they may not be criminal acts due to the lack of legislation outlawing such activities. F This is particularly true in the Asia Pacific region.

F Definitions F No precise definition of computer crime, but includes both criminal and antisocial activities, for example computer fraud, computer abuse and software piracy. F Computer Fraud - Kwilful misrepresentation with intent to gain unlawfully or to cause others to lose. KFraud - a means to another end

F Computer Abuse - Kcertain types of abusive misuse of computer resources, viz. hacking (unauthorised use and access of computer resources), unauthorised modification of data, propagation of computer viruses,… F Abuse - an end in its own right F Piracy - u unauthorised copying and distribution of proprietary software. - cf. Intellectual property law.

F HK Govt Computer Crimes Ordinance established in April F New criminal offences involving use of computers

Unauthorised access/hacking ($20,000) F even just trying to log on.  must be through telecommunications (i.e. cannot be voice or retina activated)  must be knowingly unauthorised, i.e. not innocent/accidental F if the accused does not “know” or “believe” that the access is unauthorised, guilt is hard to prove

Tampering with Computers, Programs, Data (10 years)  causing a computer not to function normally  altering or deleting any program or data held in any form/medium  adding any program/data to a computer or other storage medium.  Irrelevant whether or not the computer functions better or worse as a result.  Intention is a necessary condition here for prosecution, i.e. not inadvertent or accidental modification

Defence? F Defence possible if accused believes s/he either had already been given permission to do the activities, or would have been given that permission if s/he asked for it and if the authorising person knew all the circumstances of the activities. F A genuine belief is enough, even if the belief seems unreasonable.

Other Aspects F Threatening to do an activity is illegal F Possessing something with which to do an illegal activity, e.g. possessing a virus-infected disk with the intent to copy data from the disk (even if the accused had no knowledge of the virus’ existence as this equates to recklessness).

 Accessing a computer with the intent to commit further or subsequent crimes. F Even if the access is authorised, the intent to commit crimes is illegal. (5 years) F Trespassing with the intent to commit a crime with computers (14 years) F But trespass must be in a fixed and permanent structure, i.e. not a tent or portable toilet

F A key problem in the IS security area is that crimes are often not reported by management which fears losing its credibility with its customers and exposing internal IS security weaknesses. F Reporting and prosecution of such cases is essential if legal deterrents are to work. Such reporting should be incorporated into company policies, even if there is no legal obligation to make such reports.