Computer Crime:
Current Practices, Problems and Proposed Solutions
Second Draft Brian J. Peretti
It would have been surprising if there had been satisfactory
road traffic legislation before the invention of the wheel, but
it would also have been surprising if the law on the passage of
laden donkeys proved entirely satisfactory when applied to
vehicles.1
I. Introduction
Within recent years, computer crime has become a
preoccupation with law enforcement officials. In California, a
group of West German hackers2 using phone lines and satellite
hookups, gained unauthorized access into civilian and military
computers and stole sensitive documents that were sold to the
Soviet Union.3 A young New York programmer broke into a
Washington computer to run a program that he could not run from
his personal computer.4 After Southeastern Bell Stated that a
document published in an electronic publication5 was valued at
more than $75,000 the publisher was arrested and brought to trial
before the discovery that the document could be publicly bought
from the company for $12.6 The Chaos Computer Club, a Hamburg,
Germany, club, went into government computers and access
information and gave it to reporters.7 In May, 1988, the United
States government launched Operation Sun Devil, which lead to the
seizure of 23,000 computer disks and 40 computers.8 In
addition, poor police performance9 has also been blamed on
computers.
Since its creation, the computer has become increasing
important in society.10 The law, as in the past, has not been
able to evolve as quickly as the rapidly expanding
technology.11 This lack of movement on the part of governments
shows a lack of understanding with the area. The need to create
a comprehensive regulation or code of ethics has become
increasing necessary.
Due to the nature of computer systems and their
transnational connections through telephone lines12, an
individual state's action will only stop the problems associated
with computer crime if many states join together. The patchwork
of legislation that exists covers only a small part of the
problem. To adequately address computer crime, greater efforts
must be made within the computer community to discourage
unauthorized computer access, countries must strengthen and
co-ordinated their computer related laws, as well as proper
enforcement mechanism created, computer program copyright laws be
enhanced and computer systems should be created to allow those
who wish to explore computer systems which will not disrupt the
users of computer systems.
This paper will first set out a definition of computer crime
and why laws or regulation by the computer community must be
created. Section II will then discuss the United States law
concerning computer crime and why it needs to be strengthened.
Section III will discuss the proposed Israeli computer crime
bill, Britain's Computer Misuse Act and Ghana's proposed law.
Section IV will discuss what can be done by both the government
and computer owners and users to make computer crime less
possible.
II. Computer crime
The definition of what constitutes a computer crime has been
the subject of much controversy. A computer crime has been
defined as "any illegal act for which knowledge of computer
technology is used to commit an offense."13 The typical
computer criminal has been described as between 15 and 45 years
old, usually male, no previous contact with law enforcement, goes
after both government and business, bright, motivated, fears loss
of status in computer community and views his acts as games.14
For the purposes of this article, this will be the definition
used because of its broad reach.
Estimates regarding how much is lost to computer crime very
widely15. In the only authoritative study, the loss due to
computer crime was given at $555,000,000, 930 personnel years
lost and 153 computer time years lost.16 The amount of total
incidents for 1988 was 485 resulting in 31 prosecutions17. In
1987, there were 335 incidents with 8 prosecutions.18 Security
spent on prevention of computer crime is becoming more
commonplace19.
The most publicized danger to computer systems are
viruses20 and worms. A virus is a code segment which, when
executed, replicates itself and infects another program.21
These viruses may be created anywhere in the world22 and may
attack anything.23 A virus may be transmitted through a trojan
horse24 program. A worm exists as a program in its own right
and may spread over a network via electronic mail25. A virus
attacks a program while a worm attacks the computer's operating
system.26 The most notorious computer worm brought the
Internet computer network to a halt.27
Computer virus attacks may be overrated.28 It is said
that the biggest threat to computing includes "not backing up
your data, not learning the ins and outs of your application
programs, not putting enough memory in your computer, not
organizing your hard disk, [and] not upgrading to the latest
version of your applications.29 These computer programs have
been compared to the AIDS virus.30 One author has stated that
the viruses are used to both increase the amount of profits of
computer program producers and anti-virus computer programs.31
Computer viruses may also be used to benefit computer
systems, by either detecting flaws in security measures or
detecting other viruses.32 Virus are very dangerous, though.
The effects of a virus called Datacrime, activated on October 13,
1989, brought down 35,000 personal computers within the Swiss
government and several companies in Holland.33
With the opening up of Eastern Europe, the virus problem is
expected to increase.34 In Bulgaria, a country which does not
have any laws against computer viruses, one new virus appears
week.35 Computer viruses are created in countries like the
Soviet Union as a way to punish computer pirates because of the
lack of copyright laws.36
Perhaps the most dangerous threat to information contained
in a computer is the "leakage" of radiation from the computer
monitors.37 With inexpensive equipment38 a person can "read"
the information off the computer screen and then replicate the
information from the screen in a readable manner.39
The threat of attack on a computer system can also come from
a hacker. A hacker is a person who breaks into, whether
maliciously or not, computers or computer systems.40 A hacker
can, if the system is not adequately secured, cause havoc in the
computer by either deleting or altering programs or data or
planting logic bombs or viruses in the computer system.41
Threats from hackers to plant viruses have been made in the
past.42 The threat from computer hackers, as with viruses, has
been said to be overrated.43
The issues surrounding computers still have not been decided
by those within the computer community. Whether or not persons
should be allowed to access computer systems without
authorization is still a subject of debate within the computing
community. A West German Computing Club, called The Chaos
Computing Club, holds the belief that it is not improper to enter
any system which they can gain access to and to "look" around
inside of the system as much as they wish.44 They do not,
however, condone destroying or altering any of the information
within the system.45 On the other side, represented by
Clifford Stoll, when individuals break into computer systems they
disrupt the trust that the computer system is based on.46 This
breach of trust not only makes operating the system tougher for
the manager in control of the system, but also will decrease the
amount of use of the system so less information will be
transferred within the system.47
There is also conflicting views as to whether the authors of
computer viruses should be punished. Marc Rotenberg48 holds
the belief that a virus should be granted first amendment
protection in some instances.49 In response to the Internet
worm, there were 21 editorials that stated that the attack showed
the need for more security in computers while there were 10
letters to editors that stated that the creator should be
applauded rather then punished.50 They argue that this was a
good way to raise consciousness concerning computer security.51
Alan Solomon, a consultant who specializes in virus detection and
eradication, believes that viruses are, at most, an
inconvenience.52
III.United States Computer Legislation
The United States government53 and most states54 have
computer crime laws. In 1979, only six states had such laws.55
Almost every computer crime will, in addition to violating a
state and/or federal law, can also be prosecuted under other
laws.56
A. Computer Fraud and Abuse Act.
Congress originally enacted the Counterfeit Access Device
and Computer Fraud and Abuse Act57 to address the problem of
computer crime. Understanding that the scope of the original law
was too narrow,58 in 1986 Congress enacted amendments to the
Computer Fraud and Misuse Act of 1984.59 The Act essentially
lists acts that if done with a computer are illegal. The Act
also makes individuals culpable for attempting to commit a
computer crime.60
In order to commit any of the crimes mentioned in the act,
the actor must have acted either "intentionally" or "knowingly"
when committing the act. The law addresses national security
issues by making a crime of anyone using a computer to obtain
information and giving the information to foreign countries.61
The penalty for this crime or its attempt is 10 years for the
first offense62 and 20 years for subsequent offenses63. If a
person intentionally accesses a computer either without
authorization or in excess of his authorization and obtains and
acquires information in a financial record of an institution or
information contained in a financial record of an individual64,
the person will have committed a misdemeanor for the first
offense65 and a felony for subsequent offenses66. A person
intentionally accessing a government computer without
authorization which affects the government's use of that
computer67 will have committed a misdemeanor for the first
offense68 and a felony for the second offense.69 Accessing a
computer with knowledge and intent to defraud and without or
exceeding authority is a crime if the person obtains anything of
value other than use is a felony70. Accessing a federal
interest computer without authorization and either modifying
medical records or causing $1,000 or more worth of damage within
a one year period71 is punishable with up to 5 years for the
first offense72 and 10 years for any subsequent offense.73
The Act also criminalizes trafficking in passwords.74 A
person who knowingly and with intent to defraud traffics75 in
passwords or similar information may be sentenced for up to one
year for the first offense76 and up to 10 years for subsequent
offenses77 if the computer is used by or for the Government of
the United States78 or affects interstate or foreign
commerce.79
B. Criticisms
It is important to note that this statute only applies to
"Federal interest computers" as defined by this section.80 If
a computer is not this type of computer, then any of the above
mentioned crimes will not be prosecutable under this section.
Congress intentionally made the scope of the law narrow.81
This section has been criticized as not inclusive enough.82
Individual and corporate computers which do not fall into the
restrictive definition83 may not receive the protection of the
statute.
The problem of computer viruses are not addressed by
Act.84 The act does not punish those who add information into
a computer, even though this may do more harm then just accessing
information. The Congress has attempted to address this issue
under two bills85, but neither one has been enacted.
Unauthorized access where there is no theft or damage to the
system is not covered.86 For example, a person access a
computer system and looks at information contained therein, he
has not committed a punishable crime under the Act.87
Questions have also been brought up concerning many of the
undefined terms within the Act.88 Terms such as "intentionally
access" and "affects interstate commerce" are among the terms not
defined.89 The need to clarify these terms is important so
that an individual will know what action will constitute a crime.
IV. Legislation From Around The World
A. Israel Proposed Computer Law
In March 1987, the Israeli Ministry of Justice distributed a
draft of a comprehensive computer bill.90 This bill covers a
wide range of areas concerning computers91. The Act first sets
out a list of proposed definitions for computer, program,
software, information, thing and act. Each of these, while
short, are concise and attempt to give a brief but comprehensive
definition.92
Chapter 2 sets out a list of offenses which, if committed,
are punishable.93 A authorized person commits an act upon any
computer and knows that the act will prevent or cause disruption
of the proper operation is subject to seven years
imprisonment.94 A person who, without authority, commits an
act which precludes a person from using a computer system or
deprives a person of using that system is punishable by up to
seven years imprisonment.95 If a person prepares or delivers
or operates software knowing that the software will produce
faulty results and "having reasonable grounds to assume", the
person is punishable for up to seven years.96 The Act also
addresses those who supply, deliver or operates a computer with
faulty data.97
Section 5 applies to those who use a computer to attempt to
obtain some "thing"98 or with intent prevents another from
obtaining some "thing".99 A person who prevents another from
obtaining a "thing" by the use of software may also be
punished.100 A person who deprives a person of an object that
contains software, data or information and obtaining a benefit
for himself.101 All of these crimes contain a prison sentence
of five years.
A professional who relies on computer outputs that they know
which are false is also subject to punishment.102 The crime
carries a sentence of five years.103
This chapter does not apply to all computers, software data
or information.104 It only applies to those computers, data
or information which are used, designated to be used by or for
(1) the state or a corporation that is supplying service to the
public105 or (2) "business, industry, agriculture, health
services, or for scientific purposes."106
Perhaps the most novel provision of this proposed law is the
section governing the reporting of the offenses. Any person who
is in charge of another and has reason to believe that an
individual has committed an offense under the Act, he must report
this to police as soon as possible.107 If the person does not
do so, he may be imprisoned for up to one year.
B. Analysis
The Israeli computer crime bill is more comprehensive then
the America bill. By creating a law which will apply not only to
government computers, but also to those of "business, industry,
agriculture, health services or for scientific purposes,"108
the law essentially covers all computers in the country.109
By creating such broad coverage, the law will be able to make the
users of computers in Israel more secure in their knowledge that
their systems are safe. B. Analysis
The Israeli computer crime bill is more comprehensive then
the America bill. By creating a law which will apply not only to
government computers, but also to those of "business, industry,
agriculture, health services or for scientific purposes,"110
the law essentially covers all computers in the country.111
By creating such broad coverage, the law will be able to make the
users of computers in Israel more secure in their knowledge that
their systems are safe.
The most controversial provision in the act is the proposal
requiring that individuals that may know of computer crime must
report the crime or face fines themself. As Levenfeld points
out112, this will mean that employers will have to impose
internal spy rings to be able to tract down the "reasonable
suspicions" that individuals have concerning illegal activity.
Shalgi, however, believes that this is a good provision in that
it will allow computer crime to come more to the forefront so
that the crime can be more easily combatted.113
This provision is necessary for the government to understand
exactly how large of a problem computer crime is. At present,
statistics on computer crime are difficult to determine because
of the lack of reporting.114 By making all persons who would
be responsible for computer security, i.e. all persons who use
computer systems, the problem will be brought into the open and
can be addressed.
The proposed law also sets out a defense for those who
violate the law. Under 11, if a person who violates the law
makes another know that he did disrupt or alter the data, he will
not be convicted of the crime. This will allow those who perform
such acts to avoid the punishment of the law. Individuals who
wish to destroy or alter such information will have an incentive
to bring forth their mischievous acts so that when brought before
the court they could say that they took precautions so that
individuals would not rely on the information. This provision
will encourage those who do such activity to come forth without
fear of conviction.
The ability of a court to not impose a punishment on a
person is contained in section 12.115 This allows the court
to abstain from punishment if the offense is not grave and was
not committed with malice. This section, in effect, will allow
those who commit computer crime to be able to forgo punishment if
their acts were not serious. This will be beneficial to those
who are hackers in the original sense of the word,116 yet
still allow for punishment of those individuals who enter systems
to do harm to it.
The law also creates standards for how a computer may be
seized. Neither a computer, nor any part of it, may be seized
without a court order.117 Although this seems to be a good
provision in its effects on individual rights118, the section
is not focused enough. The law does not address the issue of
whether a floppy, as opposed to a hard disk, is part of a
computer. The hard disk is located inside of a computer, while
floppy disks may be removed from the computer. This law should
address this issue by stating that the floppy disk is also a part
of a computer in its definitions.119
This section also does not address what standard may be used
for the court order. Must the officer only have a reasonable
suspicion or probable cause to seize the computer? By stating
explicitly in the statute that the officer must have probable
cause to seize the computer, an overzealous police officer will
not be able to as easily seize the computer.
C. The Great Britain Computer Misuse Act
In response to computer program concerning AIDS that was
distributed to doctors in Great Britain and Europe that contained
a virus,120 Michael Colvin, a British MP introduced the
Computer Misuse Bill.121 On August 29, 1990, the Computer
Misuse Act122 came into effect.123 It was estimated that
the losses to British industry and government were one billion
pounds.124 This Act is designed to not to create a
confidential information right, but to rather protect computer
system integrity125.
Prior to enactment, the English Law Commission studied the
problem and laws regarding computer crime. It stated that there
should be three new offenses to deal with computer misuse: (1)
Unauthorized access to a computer, (2) Hacking with intent to
commit a serious crime, and (3) Intentional destruction of or
alteration to computer programs or data.126 The Computer
Misuse Act states that unauthorized access occurs if the person
is unauthorized to access the computer, he causes the computer to
perform any function with intent to gain access to a program or
data in the computer and he knows that this is the case.127
He does not have to be directed to any particular program or data
in the computer he attempted to get on or the data or program he
wishes to access.128 If a person commits unauthorized access
with the intent to commit129 or help another offense,130
the person can be sentenced on summary conviction, up to six
months in prison and a fine,131 or if convicted after
indictment, to imprisonment of up to five years, a fine or
both.132
If a person modifies computer material,133 the person is
subject to a fine of up to 5 years, an unlimited fine or
both.134 The person must knowingly modify a program without
authorization and must have done so with the intent to impair the
operation of the computer, to prevent or hinder access, or impair
the operation of the program or resulting data.135 The
modification does not have to be permanent.136 A modification
may be done by either altering, erasing or adding onto a program
or data. By stating modification broadly, the act attempts to
combat the placing of viruses, worms and logic bombs on
computers.137
The Act also extends the scope of jurisdiction.138 A
person does not have to actually be in Great Britain at the
commission of the crime. The crime itself must have some
relation to Great Britain.139 The link must be
"significant".140
D. Analysis
As opposed to the other statutes, the Computer Misuse Act
does not attempt to define computer. This was done because of
the fear that any definition given for a computer may become out
of date in a short period of time.141 Program and data are
also not defined within the Act.
Great Britain's courts are granted large jurisdiction. The
act allows for anyone who attempt to commit a crime under the act
to be punished in Great Britain. The act, although setting out
that the link must be significant,142 does not attempt to
define this word. By this omission, the Great Britain's courts
can expand this to any act that occurs in a foreign country that
uses a British computer for even a short period of time. The
defining of the word would clear up some misconceptions that may
result from the act.
Of interest to note, the Act would not punish a person who
distributes disks tat contain viruses on them. Although the
drafter of the bill said that this was his goal, the law ignores
this possibility. An amendment should be added to the law which
will punish those who damage data even if they do not access the
system.
E. Ghana
In response to the belief that their existing laws were not
adequate, a draft law was proposed by the Ghana Law Reform
Commission.143 The bill is rather simple as opposed to the
other laws. It has definitions for access, computer, computer
network, computer program and data.144 To commit computer
related fraud, the person must have an intent to defraud and
either alters, damages destroys data or program stored in or used
by the computer or obtains information to his own advantage or to
the disadvantage of another or uses a computer commits and
offense.145 The Act Also sets out alternatives for some
sections that may be adopted. The alternative states that any
person who obtains access to a computer program or data and
attempts to erase or alter the program or data with intent to
help his own interests or damage other person's interest commits
a crime.146
Damaging computer data occurs if any person, by any means,
without authority, willfully does damage to data commits a
crime.147 The crime of unauthorized use of a computer is
simply defined as anyone who knowingly without authority commits
an offence.148 Similarly, unauthorized access is anyone who
knowingly gains access to a computer, network or any part there
of, without authority to do so.149 The Ghana law also creates
a crime for the knowingly and dishonestly introduction of false
data and the omission to introduce, record or store data.150
An authorized person who willfully or intentionally allows
information to get into the hands of an unauthorized person and
that person uses the information to his advantage also commits a
crime.151
The penalties for the crimes are similar to those of the
Great Britain law.152 On summary convictions, a jail term may
be given of up to two years or the statutory maximum fine or
both.153 On conviction on indictment, a prison term of no
more then ten years or an unlimited fine, or both may be
given.154
The jurisdiction that the Ghana courts have in accord with
this jurisdiction is as large as their British counterpart.155
The courts can hear any case if the accused person was in Ghana
at the time of the act.156 Also, if the program or data was
stored in or used with a computer or computer network in Ghana
the person may be tried under the law.157
F. Analysis
The Ghana proposed Computer Crime Law is in accord with the
United States, Great Britain and the proposed Israeli laws. By
setting out definitions for the various terms used in the
law158, the law clearly defines which acts may be subject to
prosecution under the law. Although simple, the definitions
attempt to capture within the law's grasp the various different
acts which could be done with a computer that should be outlawed.
The most original section of the act concerns the newly
created crime of omission to introduce, record or store
data.159 This section, however, will end up punishing those
who work in corporations that are at the lowest level skill-wise.
The government should, if the law is enacted, force companies to
give each employee a sufficient amount of training on a computer
so that the person will be able to act in accordance with the
law. The act does provide a safeguard by making the mens rea of
the crime "negligently or dishonestly"160
The act also sets out a crime for an individual who allows
information to get into the hands of another.161 As opposed
to the other laws, this section specifically address the problem
of where an authorized individual gives information to an
outsider. By specifically regulating this behavior, anyone who
wishes to act according will know that the act is illegal.
The crime of computer-related fraud is defined
broadly.162 This law effectively makes any type of fraud
committed either with a computer or information within a computer
a crime. The law adequately addresses the problems that might
occur with a computer in fraud. A broad definition, however, may
still let some act seem as though they are not covered since the
act is not specific in the area of what constitutes a crime.
Most significantly, the act does not state which types of
computers are covered by the act.163 By not giving a limit on
which computers are covered, the act extends its jurisdiction to
all "computer"164 and "computer network"165 in the country.
If the definition of computer changes, due in part to advance
technology, the law may have to change this section.
V. Proposed Solutions
Computer Crime laws have come a long way in addressing the
problem of computer crime.166 The ability to regulate the
activity will decrease the amount of crime that is committed.
Those who use the computers of the world, however, must not rely
totally on there respective governments to combat this
problem.167
The best way to combat computer crime is to not let it occur
at all. Many computer systems have not been given enough
security by their system managers.168 It is possible to have
a totally secure computer system169, but it is impractical and
slows the free flow of information.170 By creating laws that
will protect the integrity of computer systems while also
allowing for the ability of our best and brightest to develop and
learn about computer systems will the nation be able to keep our
technological lead in the world.
In order to combat the problem of unauthorized access, users
of computer systems must be taught to respect each others privacy
within the various systems. Creating an standard of ethics for
those who are users of computers will be the best way since it
will hold the users to standards that must be met. Although some
organizations have attempted to promogate standards regarding the
ethical use of computer systems171 no one standard has
emerged. Proposed rules of ethics should balance the need of
individuals to be able to learn and discover about the various
types of computer systems, while at the same time allowing for
those who use those systems to be secure in the knowledge that
the information stored on the computer will not be read by those
other then person who should have access to it.
If computer crime laws are enacted, industries that use
computers should not use the new laws as a replacement for using
adequate security measures.172 Individuals or corporations
that use computer have several ways to protect themselves from
unauthorized access. If the computer can be accessed by a modem,
the computer can have a dial back feature placed on the phone
line so that one a computer is accessed, the computer will then
call back to make sure that the call is coming from a line which
is supposed to access the computer.173 The proper use of
passwords174 are also an effective way to address the problem
of unauthorized access. A recent study has shown that out of 100
passwords files, approximately 30 percent were guessed by either
using the account name or a variation of it.175 A program
has recently been developed that will not allow a user to select
an obvious password.176 Encryption programs, similar to the
program used on Unix operating system, can scramble a password in
a non reversible manner so that if the encrypted password falls
into the hands of an individual who is not supposed to access the
system, the person will not be able to get into the system.
These systems can also be used so that if a hacker does get into
a computer system and attempts to get information, the
information will not be readable.177
A problem that must be address is the lack of laws
concerning copyright protection of computer programs in foreign
countries. The Pakistan Brain178 was written to discourage
copying of a program without authorization. By creating pirating
penalties a reason for the creation of computer viruses will be
removed and less viruses will be created.179
Many in the field argue that computer programs should not be
copyrighted.180 Copyright protection should not be afforded
to computer programs since they are only mathematical
equations.181 Copyright protection should be given to the
maker of a computer programmer only for a short period of
time.182
A novel concept which will both satisfy the computer hackers
quest for knowledge through examining computer systems and
protect the integrity of computer systems is to create a computer
systems for the use of hackers alone.183 This computer would
not be connected to other computer systems, but can be accessed
through a modem.184 If created, accounts would be given to
all interested computer enthusiasts. Those participating will
not be prosecuted for exploring unauthorized areas of the
system.185 Since other computer systems will not be
accessible through this system, any activity on this system will
not endanger the information on other systems.186 By allowing
this to be done, a major problem will be solved, the inability to
afford to buy a mainframe system, while a person will still be
able to learn about different types of systems.
If any laws are to be made, they should make "knowing"187
or "intentionally"188 unauthorized access into a computer a
crime. By making the intent of the crime be knowing, it will
allow those who accidently connect to a computer system that they
think is theirs but is not to be excused from punishment.
The law must also be done in a way that will allow it to be
enforced across national boundaries. A computer hacker can
access computers from across the world without ever leaving his
home country.189 If these laws can only be enforced within
the home country, then a person can, in theory, go into a country
of whose computers that he would never want to access and access
into other computers without fear of punishment.190
An international convention should be convened to address
this problem. Since the problem is of international concern and
the crimes do occur across the boarders of countries, by setting
standards by the international community concerning the conduct
of computer users, the hodgepodge of computer crime laws will be
eradicated in favor of a common international standard. As the
boundaries in Western Europe disappear in anticipation of 1992,
international access is sure to accelerate.
Colleges, Universities and high schools must institute
programs designed to address proper computer use.191 Although
not all computer users are not trained in school, teaching the
ethical use of computers will allow users to understand the need
for security on systems. These programs will also show users
that computer crime is dangerous to society.192 Problems
concerning computer crime should be publicized so as not to
mystify the crime.193
The United States and other countries must create more
Computer Emergency Response Teams (CERT). These teams are to
coordinate community responses to emergency situations,
coordinate responsibility for fixing hole in computer systems and
serve as a focal point for discussions concerning computer
systems.194 These groups regularly post notices concerning
computer viruses or other dangers in the Internet computer
system. The scope of these groups should be expanded so they may
be a focal point of the needs and desires of those who use
computers. If they are used to gather information as a clearing
house type operation, the spread of information concerning
computer systems and problems with the systems will be more
adequately addressed.
IV. Conclusion
Computer crime is a growing problem. With the advent of the
computer and a more computer literate public, crimes committed by
computers will increase. To effectively address the problem,
laws must be created to outlaw activity which is designed to
further illegitimate ends. These laws have moved in the right
direction concerning what should be outlaws so as to balance the
needs of computer users against those of the computer owners. To
enforce these laws, governments must realize that the problem of
computer crime is not only of local concern.
Educational programs and standards of ethics must be created
from within the computer users community. Corporations which use
computers must educate their employees to reduce the fear that
one might have when addressing a computer security issue.
Copyright laws must be strengthened in countries that either do
not have or have weak copyright laws so that the need to create
viruses to protect an individual's or corporation's work will no
longer be necessary.
To satisfy users curiosity with computers, a non-secure
computer system should be created. This system will allow those
who wish to explore a system in order to understand the system
may. Those individuals can do so without the fear of
prosecution.
Only by directly addressing the causes of computer crime and
drafting standards and laws to address the unique area will the
problem of computer crime be adequately addressed. Light must be
shined on the area so individuals will realize that fear of the
machines is not justified. Only by doing so may we enter the
21st century realizing the full potential of computers.
Appendix A
Ghana Computer Crime Law (Proposed)
Computer Crime Law
Computer Crime Law
In pursuance of the Provisional National Defense Council
(Establishment) Proclamation 1981, this Law is hereby made:
1. Any person who, with intent to defraud,
(a) alters, damages, destroys or otherwise manipulates data
or program stored in or used in connection with a computer, or
(b) obtains by any means, information stored in a computer
and uses it to his advantage or to another person's advantage to
the disadvantage of any other person, or
(c) uses a computer
commits an offense.
Charge: Computer-related fraud.
ALTERNATIVE:
(1) A person commits an offense if that person obtains
access to a computer program or data, whether stored in
or used in connection with a computer or to a part of
such program or data to erase or otherwise alter the
program or data with the intention-
1. (a) of procuring an advantage for himself or
another person: or
(b) of damaging another person's interests.
2. Any person who, by any means, without authority, wilfully
destroys, damages, injures, alters or renders ineffective
data stored in or used in connection with a computer commits
an offense.
Charge: Damaging Computer data.
3. Any person who, without authority, knowingly uses a computer
commits and offense.
Charge: Unauthorized use of a computer.
4. Any person who, without authority, knowingly gains access to
a computer, computer network, or any part thereof commits an
offense.
Charge: Unauthorized access to a computer.
5. Any person who, knowingly and dishonestly introduces,
records or stores, or causes to be recorded, stored or
introduced into a computer or computer network by any means,
false or misleading information as data commits an offense.
Charge: Insertion of false information as data.
ALTERNATIVE:
(5) A person commits an offense if, not having authority to
obtain access to a computer program or data, whether
stored in or used in connection with a computer, or to
a part of such program or data, he obtains such
unauthorized access and damages another person's
interests by recklessly adding to, erasing or otherwise
altering the program or the data.
6. Any person under a contractual or other duty to introduce,
record or store authorised data into a computer network, who
negligently or dishonestly fails to introduce, record or
store, commits an offense.
Charge: Omission to introduce, record or store data.
ALTERNATIVE
(6) Any person under a contractual or other duty to
introduce, record or store data into a computer or
computer network who negligently or dishonestly fails
to introduce, record or store, commits an offense.
7. Any authorised person who willfully or intentionally allows
information from a computer to get into the hands of an
unauthorised person who uses such information to his
advantage commits an offense.
Charge: Allowing unauthorised person to use computer data.
8. A person guilty of an offense under this Law shall be
liable:-
(a) on summary conviction, to imprisonment for a term not
exceeding two years or to a fine not exceeding the
statutory maximum or both; or
(b) on conviction on indictment, to imprisonment for a term
not exceeding ten years or to an unlimited fine, or
both.
9. A court in Ghana shall have jurisdiction to entertain
proceedings for an offense under this Law, if at the time
the offense was committed:-
(a) the accused was in Ghana; or
(b) the program or the data in relation to which the
offence was committed was stored in or used with a
or used with
computer or computer network in Ghana.
computer network in Ghana.
10. In this Law, unless the context otherwise requires:-
"access" includes to log unto, instruct, store data or
programs in, retrieve data or programs from, or otherwise
communicate with a computer, or gain access to (whether
directly or with the aid of any device) any data or program.
"computer" includes any device which is capable of
performing logical, arithmetical, classifactory, mnemonic,
storage or other like functions by means of optical,
electronic or magnetic signals.
"Computer network" includes the interconnection of two or
more computers, whether geographically separated or in close
proximity or the interconnection of communication systems
with a computer through terminals, whether remote or local.
"Computer program" includes an instruction or statement or
series of instructions or statements capable of causing a
computer to indicate, perform, or achieve any function.
"data" includes a representation in any form whether
tangible or intangible that is capable of being stored in or
retrieved by a computer.
ENDNOTES
ENDNOTES
1. Financial Times Limited (London) April, 1990.
2. See, infra, endnote 36 and accompanying text.
infra
3. Stoll, The Cuckoo's Egg (1990). [hereinafter Stoll].
The Cuckoo's Egg
4. Lyons, 13 Are Charged in Theft of Data from Computers, New
York Times, August 17, 1990, B2, col. 3.
5. Although there is no set definition of a computer
publication, it is created and published solely on a computer.
Peretti, Computer Publications and the First Amendment (1990)
(available at Princeton University FTP site and The American
University Journal of International Law and Policy Office).
6. Dorothy Denning, The United States v. Craig Neidorf
(available at The American University Journal of International
Law and Policy office).
7. Schares, A German Hackers' Club that Promotes Creative
Chaos, Business Week, Aug. 1, 1988, 71.
8. Barlow, Crime and Puzzlement: In advance of the Law on the
Electronic Frontier, Whole Earth Review, Sept. 22, 1990, 44.
9. Kopetman, Computer Gave Them Bum Rap, Los Angeles Times,
Los Angeles Times
Jan. 10, 1991, at B1, col. 2.
10. See, J. Thomas McEwen, Dedicated Computer Crime Units (19--)
See,
(stating how important computers have become to society). In
1978 there were 5,000 desktop computers in the United States. S.
Rep. No. 432, 99th Cong., 2d Sess. 2, reprinted in, 1986 U.S.
reprinted in
Code Cong. & Admin. News 2479, 2479. By 1986, this number had
increased to about 5 million. Id.
Id.
11. See, S. 2476, Floor Statement by Senator Patrick Leahy.
12. See, Stoll at ___ (stating that all countries, except
Albania, are connected via computer systems).
13. McEwen, Dedicated Computer Crime Units 1 (19--). Another
_______________________________
definition used is the definition of computer crime was "any
illegal act for which knowledge of computer technology is
essential for successful investigation and prosecution". Parker,
Computer Crime: Criminal Justice Resource Manual, (1989).
_________________________________________________
14. Conly, Organizing for Computer Crime Investigation and
Prosecution, 6-7 (19--).
15. For instance, the estimated cost of the Internet Worm, a
computer program created by Robert Morris, Jr. which shut down
the Internet computer system, varies from $97,000,000 (John
McAfee, Chairman, Computer Virus Industry Association) to
$100,000 (Clifford Stoll's low bound estimate). Commitment to
Security, 34 (1989). It is difficult to determine exactly the
cost of such crime because it is difficult to determine what
should be included. The estimated downtime of a computer due to
such activity could be used to determine the cost. This may be
flawed, however, since it will not take into account how much of
the down time actually would have been used. Electronic Mail
Letter from Richard Stallman to Brian J. Peretti (Dec. 3, 1990)
(concerning computer crime).
16. Commitment to Security, 34. The average facility,
consisting of 1,224 microcomputers, 96 minicomputers and 10
mainframe computers, lost $109,000, 365 personnel hours and 26
hours computer time loss per year. Id.
Id.
17. Id. at 23. 6 percent of incidents resulted in prosecutions.
Id.
Id.
Id.
18. Id.
Id.
19. Only 1.5 percent of respondents to a National Center for
Computer Crime Data used Anti-virus products in 1985. By 1988
this figure rose to 22 percent. By 1991, 53 percent of the
respondents stated that they would be using anti-virus software
by 1991. According to a Price Waterhouse survey in Great
Britain, in 1985 26 percent installations spent nothing on
security. Authers, Crime as a Business Risk- Security/ A
Crime as a Business Risk- Security/ A
Management as Well as a Technical Problem, Financial Times
Management as Well as a Technical Problem
(London), November 7, 1990. By 1990 this figure had shrunk to 4
percent and is expected to decline to 0 by 1995. Id. The amount
Id.
spent on security for new systems has increased from 5 percent in
1985 to 9 percent by 1990. Id.
Id.
In Japan, less than 10 percent of groups that rely heavily
on computers have taken measures to prevent virus attacks.
Computer Users Fail to Protected Against Viruses. Although Japan
Computer Users Fail to Protected Against Viruses.
does not have a computer crime law, there is a movement to make
such a law. Computer Body Calls for Jail Sentences for Hackers,
Computer Body Calls for Jail Sentences for Hackers
Kyodo News Service, Nov. 15, 1990 (available from the Nexis
library). The Japan Information Processing Development
Association has stated that the new law should make the crime
punishable of either one year of hard labor or a fine. Id.
20. The terms was first applied in 1984. Commitment to Security,
34 (1989).
21. Ring, Computer Viruses; Once Revered as Hackers, Technopaths
Threaten Security of Computer-Dependant Society, Computergram,
July 7, 1989. Some of these viruses are extremely small, e.g.
Tiny, which is 163 bytes, may be the smallest. Friday 13th Virus
Alert, The Times (London), July 12, 1990.
22. Graggs, Foreign Virus Strains Emerge as Latest Threat to
Foreign Virus Strains Emerge as Latest Threat to
U.S. PCs, Infoworld, Feb. 4, 1991, 18. Viruses have appeared
U.S. PCs
from Bulgaria, Germany, Australia, China and Taiwan. Id. Some new
Id.
viruses include Armageddon, from Greece which attacks through
modems and then dials to a talking clock in Crete, Liberty, from
Indonesia, Bulgaria 50, which is thought to have come from a
"laboratory" in Sofia, Victor, thought to originate in the
U.S.S.R., the Joker, from Poland, which tells the user that the
computer needs a hamburger, and Saturday the 14th, presumed to
have been developed in South Africa, which destroys a computer's
file allocation table. Id.
Some viruses also carry a message when they are activated.
A virus that is though to have been developed by students at
Wellington, New Zealand, tells the user that they have been
"stoned" and requests that marijuana should be legalized. Id.
Id.
Approximately 80 or 90 of the 300 viruses counted for the
IBM personal computer originated in Bulgaria according to Morton
Swimmer of Germany's Hamburg University Virus Test Center.
23. A report in La Liberation, a French newspaper, stated that
La Liberation
computer viruses could be planted in French EXOCET missiles to
misguide them when fired. La Liberation, Jan. 10, 1991,
reprinted in Klaus Brunnstein, Risks-Forum, vol. 10, iss. 78,
reprinted in
Jan. 22 1991 (available at American Journal of International Law
and Policy Office).
24. A "trojan horse" is a program that does not seem to be
infected, however, when used in a computer, the virus is then
transferred the uninfected machine. On trojan horse destroyed
168,000 files in Texas. Commitment to Security, 34 (1989).
25. Ring, Computer Viruses; Once Revered as Hackers, Technopaths
Computer Viruses; Once Revered as Hackers, Technopaths
Threaten Security of Computer-Dependent Society, ComputerGram,
Threaten Security of Computer-Dependent Society
July 7, 1989.
26. Highland, One Wild Computer "Worm" Really Isn't a Federal
One Wild Computer "Worm" Really Isn't a Federal
Case, Newsday, Jan. 23, 1990, 51.
Case
27. Stoll, at 346. The amount of computers that were actually
infected by the worm is still the subject of debate. Mr. Stoll
estimates that 2,000 computers where infected, while the most
commonly cited number is 6,000. Commitment to Security, 34
(1989). The 6,000 estimate was based on an Massachusetts
Institute of Technology estimate that 10 percent of the machines
at the school were infected and was then inferred to the total
number of machines across the country that were affected.
General Accounting Office, Computer Security: Virus Highlights
Need for Improved Internet Management, 17 (1989). This number
may be inaccurate because not all locations had the same amount
of vulnerable machines. Id.
Id.
28. For the first eight months of 1988, there were 800
incidents concerning computer viruses. Commitment to Security,
34. The Computer Virus Industry Association reported that 96
percent of these reported infections were incorrectly identified
as viruses. Id.
Id.
29. Robinson, Virus Protection for Network Users, Washington
Post, Washington Business, p.44, Feb. 11, 1991.
30. Ross, Hacking Away at the Counterculture, 3 (1990)
(available at the American University Journal of International
Law and Policy). On Saturday Night Live, during the news update
segment, Dennis Miller stated, in comparing a computer viruses to
the AIDS virus, "Remember, when you connect with another
computer, you're connecting to every computer that computer has
ever been connected to." Id.
Id.
31. Id. at 8-9.
Id.
32. Computer Virus Legislation, Hearing on H.R. 55 and H.R. 287
before the Subcomm. on Criminal Justice of the House Comm. on the
Judiciary, 100th Cong., 1st Sess. 49 (1989) (statement of Marc
Rotenberg, Director, Computer Professionals for Social
Responsibility). In Israel, Hebrew University used a computer
virus to detect and destroy a virus that would have destroyed
data files. Id.
Id.
33. Computergram International, October 14, 1990.
34.
35. Watts, Fears of Computer Virus Attack from East Europe grow,
Fears of Computer Virus Attack from East Europe grow
The Independent, November 24, 1990, p.6. On a trip to Bulgaria,
a British computer consultant returned with 100 viruses that do
not exist in the West. Id.
Id.
36. Id.
37. McGourty, When a Hacker Cracks the Code, The Daily Telegraph
When a Hacker Cracks the Code
(London), October 22, 1990, p. 31.
38. The equipment would cost about 50 (British) pounds. Id.
Id.
39. Id. A British company, has stated that they have developed
Id.
a glass that will reduce this problem. Tieman, Spy-Proof Glass
to Beat the Hackers, The (London) Times, Jan 17, 1991.
A more recent problem concerns the ability of computer
hackers to access into fax machines and either change or reroute
information from the machine. Becket, Espionage fears mounting as
Espionage fears mounting as
hackers tap into faxes, The Daily Telegraph (London), December 1,
hackers tap into faxes
1990, p. 23. This problem can be circumvented by the use of
encryption devices or passwords on the machine. Id.
Id.
40. Stoll at 9. The word itself originally had two meanings.
People originally called themselves hackers were software wizards
who thoroughly knew computer systems. Id. In U.S. v. Riggs, 739
U.S. v. Riggs
F. Supp. 414, 423 (N.D. Ill. 1990) the court defined hackers as
"individuals involved with the unauthorized access of computer
systems by various means." The New Hacker's Dictionary defines
hackers as "A person who enjoys learning the details of
programming systems and how to stretch their capabilities, as
opposed to most users who prefer to learn only the minimum
necessary." New Hacker's Dictionary, to be published Spring,
1991.
Hacker has also been used in a non-evil sense with the word
"cracker" taking the disreputable part of the word. In this
light, hacker means "computer enthusiasts who `take delight in
experimenting with system hardware, software and communication
systems." and cracker meaning "a hacker who specializes in
gaining illegal access to a system." One Wild Computer `Worm'
One Wild Computer `Worm'
Really Isn't a Federal Case, Newsday, January 23, 1990, p.51.
Really Isn't a Federal Case
The typical hacker has been described as "a juvenile with a home
computer who uses computerized bulletin board systems for a
variety of illegal purposes. Conly, Organizing for Computer
Crime Investigation and Prosecution, 8 (19--).
41. Sulski, How to Thwart Potential Saboteur, Chicago Tribune,
How to Thwart Potential Saboteur
November 18, 1990, p.18.
42. Computerworld, December 3, 1990, p. 122. Kryptik, a hacker
group, was stated as having planned to plant a virus in a
telephone network on December 5, 1990. Id. It is unclear,
Id.
however, if the virus actually was planted. Id.
Id.
43. Sulski, How to Thwart Potential Saboteur, Chicago Tribune,
How to Thwart Potential Saboteur
November 18, 1990, p.18. Computer security experts state that
the risk of having hacker break into your system is less than
being burglarized or having a power outage due to lightning. Id.
Id.
Errant opinion poll results have also been blamed on the work of
hackers. Holdsworth, Hackers May Have Attacked TV Poll
Hackers May Have Attacked TV Poll
Computers-MP, Press Association Newsfile, May 4, 1990.
Computers-MP
44. Stoll, 312.
45. Id. This view is also shared by the editors of 2600, The
Id.
Hackers Quarterly. It is also held by these persons that a
service is done to the computing community because those who
break in to computer systems show the operators that their system
is not strong enough and that it should be made stronger.
46. Stoll, at 354.
47. Mr. Stoll's computer was broken into by an Australian
hacker who said he did so to show that Mr. Stoll's security was
not good and that hackers are good because they show where
security problems are in computer networks. Id. at 353-54. He
Id.
rejected such arguments. Id.
Id.
48. Director, Computer Professionals for Social Responsibility
49. Computer Virus Legislation, Hearing on H.R. 55 and H.R. 287
before the Subcomm. on Criminal Justice of the House Comm. on the
Judiciary, 100th Cong., 1st Sess. 26-27 (1989) (statement of Marc
Rotenberg, Director, Computer Professionals for Social
Responsibility). The Aldus peace virus, which displayed a message
calling for peace and then disappeared without damaging the
system itself, is an example of a virus which he believes should
be protected. Id.
Id.
50. Commitment to Security, 34.
51. Stoll, 349.
52. "I can never understand why people think it is all right to
run out of computer paper but not all right to be infected with a
virus. The disruption is the same and it takes about the same
amount of time to put matters right." Cane, Hygiene See Off
Hygiene See Off
Computer Viruses, Financial Times (London) October 14, 1989,
Computer Viruses
Section I, p. 24.
53. 18 U.S.C. 1030 (1988).
54. Ala. Code 13A-8-100 et.seq. (1990); Alaska Stat.
Ala. Code Alaska Stat.
11.46.200(a)(3), 11.46.484(a)(5), 11.46.740, 11.46.985, 11.46.990
(1990); Ariz. Rev. Stat. Ann. 13-2301(E), 13-2316 (1990); Cal.
Ariz. Rev. Stat. Ann. Cal.
Penal Code 502 (West 1990); Colo. Rev. Stat. 18-5.5-101 et.
Penal Code Colo. Rev. Stat.
seq. (1990); Conn. Gen. Stat 53a-250 et. seq., 52-570b (1990);
Conn. Gen. Stat
Del. Code Ann. tit. 11, 931 et seq. (1990); Fla. Stat.
Del. Code Ann. Fla. Stat.
815.01 et seq. (1990); Ga. Code Ann. 16-9-90 et seq (1990);
Ga. Code Ann.
Haw. Rev. Stat. 708-890 et seq. (1990); Idaho Code 18-2201,
Haw. Rev. Stat. Idaho Code
2202 (1990); Ill. Ann. Stat. 15-1, 16-9 (1990); Ind. Code
Ill. Ann. Stat Ind. Code
35-43-1-4, 35-43-2-3 (1990); Iowa Code 716A.1 et. seq.
Iowa Code
(1990); Kan. Stat. Ann. 21-3755 (1990); Ky. Rev. Stat. Ann.
Kan. Stat. Ann. Ky. Rev. Stat. Ann.
434.840 et. seq. (1990); La. Rev. Stat. Ann. 14(D) 71.1 et
La. Rev. Stat. Ann
seq. (1990); Me. Rev. Stat. Ann. chap. 15, tit. 17-A, 357
Me. Rev. Stat. Ann.
(1990); Md. Crim. Law Code Ann. Article 27 45A, 146 (1990);
Md. Crim. Law Code Ann.
Mass. Gen. L. ch 266, 30 (1990) see infra; Mich. Comp. Laws
Mass. Gen. L. Mich. Comp. Laws
28.529(1) et seq. (1990); Minn. Stat. 609.87 et seq. (1990);
Minn. Stat.
Miss. Code Ann. 97-45-1 et seq (1990); Mo. Rev. Stat. 569.093
Miss. Code Ann. Mo. Rev. Stat.
et seq. (1990); Mont. Code Ann. 45-2-101, 45-6-310,45-6-311
Mont. Code Ann.
(1990); Neb. Rev. Stat. art. 13(p), 28-1343 et seq (1990); Nev.
Neb. Rev. Stat. Nev.
Rev. Stat. 205.473 et seq. (1990); N.H. Rev. Stat. Ann.
Rev. Stat. N.H. Rev. Stat. Ann.
638.16 et seq. (1990); N.J. Rev. Stat. 2C:20-1, 2C:20-23 et.
N.J. Rev. Stat.
seq., 2A:38A-1 et seq. (1990); N.M. Stat. Ann. 30-16A-1 et
N.M. Stat. Ann.
seq. (1990); N.Y. Penal Law 155.00, 156.00 et seq, 165.15(10),
N.Y. Penal Law
170.00, 175.00 (1990); N.C. Gen. Stat. 14-453 et seq (1990);
N.C. Gen. Stat.
N.D. Cent. Code 12.1-06.1.01(3), 12.1-06.1-08 (1990); Ohio Rev.
N.D. Cent. Code Ohio Rev.
Code Ann. 2901.01, 2913.01, 1913.04, 1913.81 (Anderson 1990);
Code Ann.
Okla. Stat. tit. 21, 1951 et seq. (1990); Or. Rev. Stat.
Okla. Stat Or. Rev. Stat.
164.125, 164.377 (1990); Pa. Cons. Stat. 1933 (1990); R.I.
Pa. Cons. Stat. R.I.
Gen. Laws 11-52-1 et seq (1990); S.C. Code Ann. 16-16-10 et
Gen. Laws S.C. Code Ann.
seq (Law. Co-op 1990); S.D. Codified Laws Ann. 43-43B-1 et seq.
S.D. Codified Laws Ann.
(1990); Tenn. Code Ann. 39-3-1401 et seq (1990); Texas Code
Tenn. Code Ann. Texas Code
Ann. tit 7 33.01 et seq. (Vernon 1990); 19 Utah Laws 76-6-
Ann. Utah Laws
701 et seq.; Va. Code Ann. 18.2-152.1 et seq. (1990); Wash.
Va. Code Ann. Wash.
Rev. Code Ann. 9A.48.100, 9A.52.010, 9A.52.110 et seq. (1990);
Rev. Code Ann.
Wis. Stat. 943.70 (1990); Wyo. Stat. 6-3-501 et seq. (1990).
Wis. Stat. Wyo. Stat.
55. Parker, Computer Crime: Criminal Justice Resource Manual,
129 (1979).
56. McEwen, Dedicated Computer Crime Units, 60 (1989). These
other laws include embezzlement, larceny, fraud, wire fraud and
mail fraud. Id. at 60.
___
57. Pub. L. No. 98-473, 2102(a), 98 Stat. 1837, 2190 (codified
at 18 U.S.C. 1030).
58. S. Rep. No. 432, 99th Cong., 2d Sess., 1986 U.S. 2,
reprinted in, 1986 Cong. & Admin. News 2479, 2479.
reprinted in
59. Pub. L. No. 99-474, 2, 100 Stat. 1213 (amending 18 U.S.C.
1030).
60. 18 U.S.C. 1030(b).
61. 18 U.S.C. 1030(a)(1). The person must act knowingly to
access a computer either without authorization or exceeding the
authorization given and obtain information with the intent or
reason to believe that the information will either injure the
United States of American or give an advantage to a foreign
nation. As seen by the placement of this section, it is clear
that the Congress was particularity aware of the dangers that
computer might have to the national security of the United
States. This section parallels 18 U.S.C. 793, the federal
espionage statute.
62. 1030(c)(1)(A).
63. 1030(c)(1)(B).
64. As defined by the Fair Credit Reporting Act, 15 U.S.C. 1681
et seq.
65. 1030(c)(2)(A).
66. 1030(c)(2)(B). The penalty is up to 10 years in prison.
67. 18 U.S.C. 1030(a)(2).
68. 18 U.S.C. 1030(c)(2)(B).
69. 18 U.S.C. 1030(c)(2)(B).
70. The punishments that may be handed out are up to 5 years for
the first offense and 10 years for any subsequent offense.
71. 18 U.S.C. 1030(a)(5).
72. 18 U.S.C. 1030(c)(3)(A).
73. 18 U.S.C. 1030(c)(3)(B).
74. 18 U.S.C. 1030(a)(6).
75. As defined by 18 U.S.C. 1029.
76. 18 U.S.C. 1030(c)(2)(A).
77. 18 U.S.C. 1030(c)(2)(B).
78. 18 U.S.C. 1030(a)(6)(B).
79. 18 U.S.C. 1030(a)(6)(B).
80. These computers include computers used exclusively for the
United States government or a financial institution or if not
exclusively by the government one which the conduct of the
computer affects the government's or the institution's operation,
18 U.S.C. 1030(e)(2)(A), the computer is one of two or more
computers that commit the offense, 18 U.S.C. 1030(e)(2)(A).
Financial institution is defined in 18 U.S.C. 1030(e)(4) and
includes and institution whose deposits are insured by the
Federal Deposit Insurance Corporation, 1030(e)(4)(A), the Federal
Reserve or one of its members, 1030(e)(4)(B), a credit union
insured by the National Credit Union Administration,
1030(e)(4)(C), a Federal home loan bank system member,
1030(e)(4)(D), institutions under the Farm Credit Act of 1971,
1030(e)(4)(F), a broker-dealer registered pursuant to 15 of the
Securities Exchange Act of 1934, 1030(e)(4)(F), or a Securities
Investor Protection Corporation, 1030(e)(4)(G).
81. S. Rep. No. 432, 99th Cong., 2d Sess. 4, reprinted in, 1986
reprinted in
U.S. Code Cong. & Admin. News 2479, 2481.
82. Note, Computer Crime and The Computer Fraud and Abuse Act of
1986, X Computer/Law Journal 71, 79, (1990).
83. 18 U.S.C. 1030 (e)(2) states:
As used in this section-
(2) The term "Federal interest computer" means a computer-
(A) exclusively for the use of a financial institution
or the United States Government, or, in the case of a computer
not exclusively for such use, used by or for a financial
institution or the United States Government and the conduct
constituting the offense affects the use of the financial
institution's operation or the Government's operation of such
computer; or
(B) which is one of two or more computer used in the
committing the offense, not all of which are located in the same
state.
84. "[T]here is not statute specifically addressing viruses."
135 Cong. Rec. E2124 (daily ed. June 14, 1989) (letter of Rep.
Cong. Rec. E2124
Herger (quoting FBI Director William Sessions)).
85. H.R. 287 and H.R. 55.
86. "Existing criminal statues are not specific on the question
of whether unauthorized access is a crime where no theft or
damage occurs . . ." 135 Cong. Rec. E2124 (daily ed. June 14,
Cong. Rec.
1989) (letter of Rep. Herger (quoting FBI Director William
Sessions)).
87. Prosecution could occur under a trespass law. It may not be
applicable, however, since trespass is a property based crime and
courts have not recognized information in the same manner as real
property.
88. Note, Computer Crime and The Computer Fraud and Abuse Act of
1986, X Computer/Law Journal 71, 80 (1990).
89. Id.
Id.
90. Shalgi, Computer-ware: Protection and Evidence, An Israeli
Computer-ware: Protection and Evidence, An Israeli
Draft Bill, IX Computer/Law J. 299, 299 (1989) [hereinafter
Draft Bill Computer/Law J.
Shalgi]. This proposed bill has not progressed much since it was
proposed and is at the stage prior to an official "bill". Letter
from Barry Levenfeld to Brian J. Peretti (December 13, 1990)
(concerning Israel's legislature progress on the comprehensive
computer law). This paper will use the Shalgi English
translation of the law.
91. Chapter 2 concerns Offenses and Accessing Computers, Chapter
3, Damages, Chapter 4, Rights of Software Creators and Chapter 5,
Evidence. Levenfeld, Israel Considers Comprehensive Computer Law,
Israel Considers Comprehensive Computer Law,
Int'l Computer L Advisor 4 (March 1988). The topics covered in
Int'l Computer L Advisor
Chapters 2 through 5 are beyond the scope of this paper.
92.
93. Shagli, at 311.
94. Chapter 2, 2, Shagli at 311.
95. Chapter 2, 3(a), Shagli at 311. An employee is exempt if
he commits this act when it was due to a strike concerning a
labor dispute. Chapter 2, 3(b), Shagli at 311.
96. Chapter 2, 4(a).
97. Chapter 2, 4(b), Shagli at 311.
98. As defined by Chapter 1, 1.
99. Chapter 2, 5, Shagli at 311.
100. Chapter 2, 6, Shagli at 312.
101. Chapter 2, 7, Shagli at 312.
102. Chapter 2, 9, Shagli at 312.
103. Id.
Id.
104. Chapter 2, 10, Shagli at 312.
105. By not stating that this also applies to individuals or
others (non-corporations) who are attempting to supply services
to the public, some important services that may be offered to the
public may not be done. Levenfeld, 8, translates the word
corporation as entities which may solve the problem.
106. Shalgi, 312. Levenfeld, 5, states that since this section
is so broad the only possible areas that are not covered are
personal and academic uses.
107. Chapter 2, 14, Shagli at 313.
108. Section 5.
109. Levenfeld, 4-5. Perhaps the only computers not covered
would be those used for personal or academic uses exclusively.
Id. at 5.
Id.
110. Section 5.
111. Levenfeld, 4-5. Perhaps the only computers not covered
would be those used for personal or academic uses exclusively.
Id. at 5.
Id.
112. Levenfeld at 4.
113. Shalgi, 305.
114. See, Computers at Risk, Safe Computing in the Information
Age, 36 (1991) (discussing the need for a repository to gather
computer crime information).
115. Chapter 2, 12, Shagli at 313.
116. New Hacker's Dictionary.
117. Chapter 2, 13, Shagli at 313. The law states that if the
owner of the computer is not given in his presence, the order is
only good for twenty-four hours. Id.
Id.
118. Shagli, at 304. Under Israeli law, an object that may be
proof of an offense may be seized without a court order. Id. The
Id.
law will bring the seizure of computers in accord with the United
States Constitution's sixth Amendment.
119. Chapter 1, 1, Shagli at 310.
120. Alexander, Suspect Arrested in AIDS Disk Fraud Case,
Suspect Arrested in AIDS Disk Fraud Case
Computerworld, Feb. 5, 1990, 8.
121. Colvin, Lock up the Keyboard Criminal, Telecommunications
PLC (England), June 1990.
122. Computer Misuse Act, 1990, ch. 18.
123. In the five years prior to the adoption of the Act, there
were 270 cases of computer misuse in Britain of which only six
were brought to court and only 3 resulting convictions. Fagan,
Technology: EC urged to strengthen laws on computer crime, The
Technology: EC urged to strengthen laws on computer crime
Independent (London), February 13, 1990, p. 19.
124. Id.
Id.
125. Davies, Cracking down on the computer hackers, Fin. Times
Cracking down on the computer hackers
(London), October 4, 1990.
126. Law Commission No. 186, Cm 819.
127. Computer Misuse Act, 1990, ch. 18, 1.
128. The penalty for this type of behavior is up to six months in
prison, 2000 pounds or both.
129. Computer Misuse Act, 1990, ch. 18, 2(1)(a).
130. Computer Misuse Act, 1990, ch. 18, 2(1)(b).
131. Computer Misuse Act, 1990, ch. 18, 2(5)(a).
132. Computer Misuse Act, 1990, ch. 18, 2(5)(b).
133. Computer Misuse Act, 1990, ch. 18, 3(1).
134. Computer Misuse Act, 1990, ch. 18, 3(7).
135. Computer Misuse Act, 1990, ch. 18, 3(2).
136. Computer Misuse Act, 1990, ch. 18, 3(5).
137. Id. Colvin, Lock up the Keyboard Criminal ,
Id.
Telecommunications PLC (England), June 1990.
138. Computer Misuse Act, 1990, ch. 18, 4.
139. Computer Misuse Act, 1990, ch. 18, 4(1).
140. 5(2) states that a significant link under 1 can be (a) the
person was in Great Britain at the time in which he caused the
computer to act in a certain way or (b) the computer he attempted
to get access to was in Great Britain. 5(3) states that a
significant link under 3 can be (a) that the person was Great
Britain at the time when he did the act or (b) the modification
took place in Great Britain. However, this may not an exhaustive
list.
141. Davies, Cracking down on the computer hackers, Fin. Times
Cracking down on the computer hackers
(London), October 4, 1990.
142. Computer Misuse Act, 1990, ch. 18, 5.
143. Although proposed on February 14, 1989, the proposed bill
has not yet become law.
144. Appendix A, 10.
145. Appendix A, 1.
146. Appendix A, 1, alternative.
147. Appendix A, 2.
148. Appendix A, 3.
149. Appendix A, 4.
150. Appendix A, 5.
151. Appendix A, 7.
152. The Ghana Law Reform Commission states that they created
their proposed law from the Scottish Law Commission and the Law
Reform Commission of Tasmania, Australia reports on computer
crime.
153. Appendix A, 9(a).
154. Appendix A, 8(b).
155. See, infra, endnote __ and accompanying text.
infra
156. Appendix A, 9(a).
157. Appendix A, 9(b).
158. Appendix A, 10.
159. Appendix A, 6.
160. Id.
Id.
161. Appendix A, 7.
162. Appendix A, 1.
163. Appendix A, 10.
164. Id.
Id.
165. Id.
Id.
166. The first computer crime law in the United States was
enacted in 1979.
167. S. Rep. No. 432, 99th Cong., 2d Sess. 3, reprinted in 1986
reprinted in
U.S. Code Cong. & Admin. News 2479, 2481.
168. By increasing security, the ease with which one can enter
the system will become more difficult. Some systems, believing
that if such unauthorized access does occur that no sensitive
information will be stolen, opt to have less security then other
systems. In actuality, by one system not having enough security,
the entire network can be put at danger when a mischievous user
wishes to break into a users account which may be accessed by
that system. See Stoll, 353-54 (stating an Australian hacker
broke into Mr. Stoll's computer account because a connected
computer's system manager did not wish to have a high level of
security.
169. Stoll, 32. Many military computers and sensitive
scientific computers operate in a secure environment. This is
created by not allowing the computer system to have any telephone
links to the outside world (i.e. outside of the building.
170. By having a secure system, information at the computer site
can only be removed by a person walking into the computer center,
copying the information and then walking out with it. This is
both burdensome (it is much easier to access the computer from
one's home or office) and cumbersome (since a person will have to
walk around with reels of data that will later be put back into
the system.
171. Computer Virus Legislation, Hearing on H.R. 55 and H.R. 287
before the Subcomm. on Criminal Justice of the House Comm. on the
Judiciary, 100th Cong., 1st Sess. 44, n. 27 (1989) (statement of
Marc Rotenberg, Director, Computer Professionals for Social
Responsibility).
172. Colvin, Lock up the Keyboard Criminal, Telecommunications
Lock up the Keyboard Criminal
PLC (England), June 1990, p. 38. Michael Colvin, the author of
Great Britain's Computer Misuse Act stated that the passage of
the bill should not be looked at that the computer owner should
not have security measures on their computers. Id. The bill, he
Id.
states, was made only to compliment, not substitute, the users
security measures. Id. In West Germany, the severity of the
Id.
punishment for hacking depends on the effort that was required to
commit the offense. Fagan, Technology: EC urged to Strengthen
Technology: EC urged to Strengthen
Laws on Computer Crime, The Independent, Feb. 13, 1990, 19.
Laws on Computer Crime
173. McGourty, When a hacker cracks the code, The Daily
When a hacker cracks the code
Telegraph, October 22, 1990, p. 31.
174. A Password is a word that is either given to the user by
the system or selected by the user to prevent others from
accessing his computer or account within the computer. This
words, groups of letters or symbols are supposed to be kept
secret so as to not let other who are not authorized to access
the system have access to it.
175. Donn Seeley, A Tour of the Worm, Department of Computer
_____________________
Science, University of Utah, Nov. 1988, reprinted in General
reprinted in
Accounting Office, Computer Security: Virus Highlights Need for
Improved Internet Management, 20 (1989).
176. Authers, Armed with a secret weapon, Financial (London)
Times, Feb. 5, 1991, Section I, 16.
177. Id.
178. For a discussion of this virus, see, Branscomb, Rogue
see Rogue
Computer Programs and Computer Rogues: Tailoring the Punishment
Computer Programs and Computer Rogues: Tailoring the Punishment
to Fit the Crime, 16 Rutgers Computer & Tech. L.J. 1, 14-16
to Fit the Crime _______________________________
(1990) (discussing the applicability of state and federal law to
computer viruses).
179. Jim Thomas, publisher of the Computer Underground digest
argues that computer pirates actually buy more programs then the
average computer program buyer. Letter from Jim Thomas to Brian
J. Peretti ( (discussing computer pirating of software)
180. See, GNU Manifesto (available at American University Journal
of International Law and Policy). See also, Stallman, GNU EMACS
See also,
General Public License, (Feb. 11, 1988) (available at American
University Journal of International Law and Policy).
181. The GNU Manifesto (available at the American University
Journal of International Law and Policy).
182. The author proposes that such copyright protection last for
only two years. By granting the creator such protection for a
short period of time, he will be able to recover the expenses
that he put into the writing of the program.
If this type of protection is granted, it should be
understood that the creator of the program has a copyright to the
sourcecode of the program for that period. If he updates the
program after the two year period, the updated code will be
protected, but the original code will not be granted the
protection. In this manner, an author cannot attempt to give
copyright protection to a program after the copyright has
expired.
183. Electronic letter from Brian J. Peretti to Dorothy Denning
(Nov. 13, 1990) (concerning computer crime).
184. This will be a semi-secure system.
185. The system, of course, will have a system manager who will
create the accounts for the users. His account will be off
limits to those who wish to use the system. At the same time,
individuals will be encouraged to attempt to break into the
manager's account and tell him how it was done in order to
improve security for this and other systems.
186. The problem still exists that information learned through
the use of this system may allow those who use the system to
break into other computer systems. This problem can be corrected
by having the system manager and the users communicate problems
with the system so that they may be corrected on other systems.
187. United States v. United States Gypsum Co., 438 U.S. 422, 425
(1978).
188. S. Rep. No. 432, 99th Cong., 2d Sess. 6, reprinted in 1986
reprinted in
U.S. Code Cong. & Admin. News 2479, 2484.
189. Stoll, The Cuckoo's Egg.
190. The countries which a person can go to could be any country
in the world, except Albania, since they are the only country
whose computers are not connected to outside computers. Stoll.
191. A school in Red Bank, New Jersey, has instituted a "computer
responsibility training". Weintraub, Teaching Computer Ethics in
Teaching Computer Ethics in
the Schools, The School Administrator 8, 9 (apr. 1986).
the Schools, ________________________
192. S. Rep. No. 432, 99th Cong., 2d Sess. 3, reprinted in 1986
reprinted in
U.S. Code Cong. & Admin. News 2479, 2481.
193. Electronic Mail Letter from Rop Gonggrijp to Brian J.
Peretti (Jan. 25, 1991) (concerning computer viruses). "We have
to watch that we keep telling people how virusses work, because
that is the only solution to the problem: mystifying the whole
thing ans just hunting down "computer terrorists" is useless and
(as proven in the US and Germany) leads to a questionable style
of government in the field of information technology..." Id.
Id.
194. General Accounting Office, Computer Security: Virus
Highlights Need for Improved Internet Management, 25 (1989).
Hello, my name is Jack Sparrow. I'm a 50 year old self-employed Pirate from the Caribbean.