Computer as target

Abstract

Introduction We turn now to consider the first distinct category of cybercrimes: those offences where a computer is itself the target. Such offences are colloquially referred to as ‘hacking’, and cover a broad range of conduct arising from an equally broad range of motivations. Given the ubiquitous presence of computers in modern life, and the dependency of modern commerce on computer networks, such offences have potentially serious consequences. We are not here concerned with those offences where a computer is physically taken or damaged. Although some surveys include offences such as theft of a computer within the definition of cybercrime, such conduct falls comfortably within the scope of existing property offences. Rather, our focus is on ‘[o]ffences against the confidentiality, integrity and availability of computer data and systems’. In essence, the conduct which these offences seek to address is: 1. the gaining of unauthorised access to a computer or computer system; 2. causing unauthorised damage or impairment to computer data or the operation of a computer or computer system; or 3. the unauthorised interception of computer data. Such conduct ranges from the technically sophisticated to the decidedly low-tech. For example, twenty-one year old Gareth Crosskey convinced Facebook staff to change the password of actress Selena Gomez's account by pretending to be her stepfather. At the other end of the spectrum, high-profile attacks by groups such as ‘Anonymous’ have well and truly brought hacking to the attention of the public and governments. While the sophisticated hacker is a very real threat, some surveys indicate that insiders are often just as likely as outsiders to be the source of cyberattacks. Any criminal law response must be capable of responding to this broad spectrum of offending conduct. The history and phenomenon of ‘hacking’ has been extensively discussed elsewhere. For our purposes it will suffice to provide an outline of the key forms of conduct which potentially fall within this class of offence. At the outset it must be acknowledged that these categories are neither mutually exclusive nor fixed. One of the great challenges of drafting cybercrime laws is ensuring that they can adapt to a broad range of overlapping and constantly evolving threats. Nonetheless, the three main categories of conduct are: 1. unauthorised access to computers or computer systems; 2. malicious software; and 3. DoS attacks.