As far as computing-related crime, the Police and Justice Bill, which was published last week, is at least a step in the right direction.
The problem with the existing legislation (The Computer Misuse Act 1990) is that it is out-of-date in computing terms. This is adequately illustrated by a recent case heard by District Judge Kenneth Grant (2nd November 2005), sitting at Wimbledon Magistrates Court, in which a teenage defendant was charged under Section 3 of The Computer Misuse Act 1990. Section 3 of the Act concerns unauthorised modification of or tampering with a computer system.
The defendant was alleged to have sent an enormous amount of email to an organisation, which caused its email server to crash under the load. This may seem unlikely to happen elsewhere, but our experience is that most Microsoft Small Business Server Systems are configured to have their email database on the system partition, making not only the internal and external email vulnerable to this sort of attack, but also their entire computer system. If you use such a system, this could have been you!
Presumably, the prosecution intended to show that this was a malicious attack, intent on crashing the server and causing damage to the organisation.
However, the defendant's lawyers argued that since an organisation's email server, by its very nature, is there to receive that organisation's email, the organisation had authorised its correspondents to use its email system. Consequently, no offence could have been committed under the Act, regardless of the volume involved. District Judge Kenneth Grant agreed with their argument, causing consternation in the IT community. Effectively, this form of Denial of Service attack is legal in the United Kingdom.
The problem is that the existing law was drafted long before concepts like Denial of Service (and the stronger Distrubuted Denial of Service) attacks had been conceived. In fact, as far as the general public is concerned, it was drafted long before the Internet had even entered popular language.
The Police and Justice Bill does aim to plug this hole in English Law and extends sentencing periods for hackers in line with the commercial damage that they can cause. However, does it go far enough?
I think that we need to understand that our computing legislation needs to be reviewed regularly and that we must expect to replace the existing legislation lock, stock and barrel every so many years, simply because computing is not what is was last year, let alone 16 years ago. I would like to see HM Government publish a new Computer Misuse Bill for this decade to deal with the problems that have emerged in the last few years. There have been several private member's bills, but none have been successful. I think it is time for the Home Office to bite the bullet...
The Computer Misuse Act (1990) was enacted in June 1990 and was, no doubt, drafted earlier. To put January 1990 into perspective - Microsoft had not even yet launced Windows 3.0! We were still using MS-DOS - black and white text screens...
Our principal legislation on computer misuse dates from this era when few people had access to personal computers outside of work.