Understanding the Computer Misuse Act and Global Cybercrime Laws

many countries have a variety of laws to govern the use of computers laws that cover such things as the

buying and selling of goods and services electronically the storage and use of personal data

copying original work and electronic surveillance to name but a few in this computer science lesson you'll

learn about a law created specifically to deal with unauthorized access to computer systems

namely the computer misuse act you'll also learn about different types of cyber crime such as hacking malware

and social engineering the computer misuse act is a british law but later you'll hear about some

equivalent laws in other parts of the world such as the united states of america india and europe

the original computer misuse act became british law in 1990 it included three specific offences which you can see here

but it has been more than 30 years since the law was enacted and in this time society's use of the internet and an

increasing threat from cyber criminals means that it has been updated more than once

and it needs to be reviewed regularly to ensure that it continues to be fit for purpose

as of 2022 these are the sections of the current computer misuse act

if you're interested you can look up the details of each section on the website legislation.gov dot uk

but i'm going to summarize the details of each section for you now i'll explain the letter of the law as it

were the first section of the computer misuse act forbids unauthorized access to

computer material a person is guilty of this offence if they access a program or data on someone

else's computer without their permission this is usually done over the internet and is commonly known as hacking

some hackers gain access by brute force that is repeatedly trying different passwords until they guess the correct

one other hackers use more sophisticated techniques

more about those in a moment a person is guilty of unauthorized access even if they weren't looking for

any particular program or data on any particular computer they might argue that they were just

having a casual look around and that they didn't do any damage or take anything but it makes no difference if

they knew what they were doing and they were doing it deliberately then they broke the law

a person is also guilty of this offence if they simply help someone else to hack into a computer

however a person is not necessarily guilty of breaking the law if they can prove that their unauthorized access was

an accident or that they were forced to do it or perhaps they weren't in their right mind at the time

if caught and found guilty under this section of the computer misuse act then depending on the particular

circumstances an offender can be fined and sent to prison for up to two years in the second section of the computer

misuse act unauthorized access with intent to commit or facilitate commission of further offenses

the law considers why an offender was hacking if their intention was to commit a

further crime perhaps fraud robbery blackmail or even worse then the law takes a much dimmer view

the same applies if the offender was knowingly helping someone else to commit an offence

in fact they may not even get as far as committing a further offence they can be punished for what they were planning to

do if convicted of doing this someone over the age of 18 could be sent to prison

for up to five years along with a big fine the wording of the third section of the

computer misuse act might seem vague even a little clumsy unauthorized acts with intent to impair

or with recklessness as to impairing operation of computer etc but this is by design the wording is

open to a range of interpretations by a court of law and therefore covers a multitude of sins

a person is guilty under this section of the act if their intention is to prevent someone else's computer from working

properly without their permission of course in other words making it difficult or

even impossible for them to run a program or to access their data even if the impaired access is only temporary it

is still an offence an offender might for example reconfigure a computer to slow it down

or send it instructions over the internet that keep it so busy that it can't do the jobs it was designed to do

this section of the act also makes it illegal to knowingly introduce malware the term malware is short for malicious

software that is a program written specifically to harm or exploit a computer

a malware program that propagates itself to other computers after some kind of human interaction is called a virus

for example a virus could be embedded inside a document that you've downloaded from a website

it could even be lurking inside what appears to be a simple image file the virus might then be activated when

you open the document or try to view the image a malware program that propagates

without any kind of human interaction is called a worm a computer can pick up a worm from an

email attachment an instant message or when its user simply visits an untrustworthy website

once infected a computer can pass the worm onto other computers automatically and it can spread very quickly indeed

in a so-called distributed denial of service attack or ddos for short malware is copied onto hundreds of

computers without their owner's knowledge and these send a flood of messages to a

target such as a web server which is consequently rendered useless computers infected in this way are known

as bots the ddos attack comes from a so-called botnet

in another example an offender might install software that encrypts documents or other files so that they can't be

opened without a password they might then demand payment for the password

this type of malware is called ransomware you can imagine this particular offence

could have devastating consequences for a large organization such as an airport or a

hospital in the eyes of the law it makes no difference if the offence was carefully planned or quite deliberate

or if the offender was simply being reckless with little or no thought for the consequences of their

actions there are hundreds of thousands of malware programs in circulation including spyware designed to collect

personal information about an unsuspecting computer user adware that bombards a user with

unwanted advertising trojans which are malware programs that pretend to be legitimate applications

and more indeed hundreds of new malware programs are being created by criminals every day

for impairing the operation of someone else's computer deliberately or carelessly an offender could be sent to

prison for up to 10 years along with a big fine of course the fourth section of the computer

misuse act forbids unauthorized acts causing or creating risk of serious damage

if someone intentionally or recklessly either directly or indirectly uses a computer in any way that poses a

significant risk or causes serious damage they could be prosecuted under this

section of the act the letter of the law includes a long list of what this could mean for example

damage to human welfare such as causing illness injury or loss of life disruption of a supply of money food

water energy or fuel disruption of a communication system disruption of transport facilities

disruption of services relating to health damage to the environment anywhere

damage to the economy of any country or any place for that matter damage to the national security of any

country an offender could be sent to prison for up to 14 years for breaking the law

under this section of the act along with a fine however if human welfare or national

security are involved they could go to prison for life the final section of the computer misuse

act is making supplying or obtaining articles for use in computer misuse offences

this covers creating malware that is writing malware program code with the belief that it may be used to commit a

crime it also covers supplying malware to someone else or simply obtaining it with

criminal intent the word articles in this section of the computer misuse act is defined as any

program or data held in electronic form so this section of the act includes the creation of fake websites email spamming

and fishing phishing which starts with ph instead of an f is one of the most insidious and

fastest growing types of computer crime victims are sent a message via email text social media or even a voice call

which in turn directs them to a bogus website that website might then convince them to

hand over money or sensitive information such as their bank details or online shopping passwords

it might even install malware on their computer fishing is a form of social engineering

so called because it takes advantage of the way people behave exploiting their fears greed sympathy or just their

curiosity sometimes it's carefully targeted at only one or two individuals so called spear phishing but more often

than not the same message is broadcast to millions of people there are billions of phishing attacks

every day and only a tiny proportion of these need to succeed in order for the criminals to profit

but the law doesn't stop at software you can imagine someone could create supply or obtain

computer hardware for criminal purposes for example to automate brute force hacking phishing attacks or to mine

cryptocurrency using stolen electricity if found guilty under this section of the computer misuse act then depending

on the seriousness an offender can be sent to prison for up to two years along with a fine

here is a summary of the sections of the computer misuse act many countries have their own specific

laws for cybercrime the united states of america has the computer fraud and abuse act

india has the information technology act and the philippines has the cyber crime prevention act

countries like canada and germany have wide-ranging criminal codes that include sections to cover cybercrime

but cybercrime is very much an international problem the internet allows individuals and

well-organized criminal gangs to operate on a global scale and although lots of countries legislate

for cyber crime their different approaches can cause issues a five-year prison sentence might be

deemed appropriate for a particular offence in one country but the same offence might carry a sentence of 50

years in another how then should hackers be punished for attacking computers on foreign soil

there are a number of initiatives in place to enable cooperation between countries when it comes to investigating

and prosecuting cyber crime for example the council of europe's convention on cyber crime also known as

the budapest convention the asia pacific economic cooperation apec have developed a cyber security

strategy and the economic community of west african states has a directive on fighting cyber crime

finally it should be said that there is no international law on how to deal with so-called cyber warfare

cyber warfare is when a government a terrorist organization or a patriotic hacker attacks another nation state

this might involve the disruption of vital infrastructure such as power grids transport systems or financial markets

it might even involve an attempt to interfere with elections cyber attacks are also used during

shooting wars to gather intelligence disrupt communications and supply chains or to change hearts and minds

when the development of cyber weapons is sponsored by a government the fight against cybercrime becomes even more

complex but that as they say is another story