Introducing the Computer Misuse Act.

[the_leander]

Welcome one and all to this, my first “serious” piece for Sensitize.

In this I am going to do my level best to describe a serious piece of legislation that is currently being put down ready to go on the statute books that you all as computer users should be made aware of, welcome to the new electronic hell known as “The Computer Misuse Act”.

This one act, originally designed to protect us from the evils of computer hackers (because as we all know, hackers are really afraid of the law) malware writers and similar net dwelling scum.

The acts supposed goals as stated by Paul Goggins MP (The Parliamentary Under Secretary of State) are to “ratify Article 6 of the Cybercrime Convention, Which Requires the criminalization of the distribution or making available of a computer password (or similar data) by which a computer system is capable of being accessed with the intent to commit an offence”.

The problem is that the wording of the legislation is pretty poor. In particular, Section 41, where it says:

A person is guilty of an offence if he makes, adapts, supplies or offers to supply any article —
(a) intending it to be used to commit, or to assist in the commission of, an offence under section 1 or 3 [of the Computer Misuse Act]; or
(b) believing that it is likely to be so used.

Several experts have stated that as this wording stands, the law could well end up making illegal key parts of all current operating systems and many programs used for perfectly legitimate reasons. (http://news.zdnet.co.uk/business/legal/ ... 045,00.htm)

To put this in a less geeky context, it would be akin to making illegal the contents of a mechanic's toolkit, because in theory, some of those tools could be used in a crime.

If anyone has any questions about this subject, please feel free to ask.

[the_leander]

First off CMA - Computer Misuse Act.

A while back the Register brought out an article regarding the proposed changes to the CMA, whereupon it would be an offence to possess so called "Hacker Tools".

Now, being the geeky fecker that I am, it immediately occured to me that many of these so called tools are in fact legit tools being used for illegitamate purposes... So I wrote to my MP and pointed this out, she then sent this on to the ministry of truth (The Home Office) and this is my response:

Note: I had to retype this because MP's insist on using dead tree to correspond to one another, so any typos are mine.

Mr Fisher is specifically conerned with clause 35 of the Police and Justice Bill, which deals with the "Making, supply or obtaining articles for use under section 1 or 3 [of the CMA]". This clause creates a new section CMA 3A offence that will give effect to our international obligations and therefore allow us to ratify Article 6 of the Cybercrime Convention, which requires the criminalisation of the distribution or making available of a computer password (or similar data) by which a computer system is capable of being accessed with the intent to commit an offence.

We sympathise with Mr Fisher's concerns about the possible "dual use" of the requisite articles, but I am sure he will appreciate that whilst we seek to provide offences to deter and help us control those who are obviously developing tools for hacking, virus propagation, botnets, etc. That is why clause 35 seeks to make clear that a person must intend the article to be used to commit an offence of gaining unauthorised access or of doing an unauthorised act in relation to a computer.

Best wishes
Paul Goggins.

The problem is that the law isn't a scalpal, its a fecking great cleaver of meat. And its not a case of "possible dual use" its an out and out fact, this law would potentially make even things like the ping command illegal if it was deemed you were a naughty boy... Indeed given the utter ineptitude of the police and crown prosecution services in the UK regarding computers and all things IT related (they were the ones that convicted someone over his daring to check to see if a website claiming to be a charity was legit or just a show front) I do worry a great deal about this law. It would also make system recoveries a very very grey area to operate, not to mention firms that are hired to test security measures within company networks.

[Louis P. Burns aka Lugh]

What I am getting from this so far is that if I, as a site admin, asked someone to design a webpage or webpages for me and they used something like Perl to do this. I would be breaking the Law..?

They (the artists) would be breaking the Law..?

Bollocks to that..!

How are artists and writers here on SENSITIZE going to work on collaborative art projects or initiate community art works, if we don't share our skills?

What this appears to be doing in reality, is protecting those few elite who have creamed off the very best of work uploaded and made mini-fortunes and society names for themselves as internet gurus. While we, their exploited outcasts get screwed for taking back some control and creating our own legitimate or potential incomes from the new cyberworld that's opened up for us and in many cases, by us.

Let me clarify further...

Say Alan and me were to work on The Crafty Fecker. He as an artist and me as a writer / producer working in tandem with Kate. 3 people seperated by regional distances, but committed to bringing together the next phase of The Crafty Fecker, namely a comic version of it. Now, suppose Alan used tools that had been outlawed through this legislation, we'd all be banged up and / or fined?

Something's terrible wrong here and this needs addressing...

Please post your comments in here folks. This affects us all...

[Louis P. Burns aka Lugh]

Mr Fisher is specifically conerned with clause 35 of the Police and Justice Bill, which deals with the "Making, supply or obtaining articles for use under section 1 or 3 [of the CMA]". This clause creates a new section CMA 3A offence that will give effect to our international obligations and therefore allow us to ratify Article 6 of the Cybercrime Convention, which requires the criminalisation of the distribution or making available of a computer password (or similar data) by which a computer system is capable of being accessed with the intent to commit an offence.

We sympathise with Mr Fisher's concerns about the possible "dual use" of the requisite articles, but I am sure he will appreciate that whilst we seek to provide offences to deter and help us control those who are obviously developing tools for hacking, virus propagation, botnets, etc. That is why clause 35 seeks to make clear that a person must intend the article to be used to commit an offence of gaining unauthorised access or of doing an unauthorised act in relation to a computer.

Best wishes
Paul Goggins.

This is extremely interesting and potentially worrying stuff, Alan.

Looks like you are firmly on the ball with this thread mate...

I've put a direct link from the;- Activism on SENSTITZE © pages back to this thread. Just in case some of our members miss it here.

Cheers...