Naked Law

Digital Economy Bill due soon

Proposals for new legislation to combat internet piracy are expected be announced at the State Opening of Parliament. It will be interesting to see how the government’s thinking has evolved since the Digital Britain report suggested that those who illegally download films and music may have their internet connections slowed.

You may recall that in August, Lord Mandelson upped the ante by voicing his opinion that people who illegally download films and music should have their internet connection cut off and possibly incur a fine of up to £50,000.

Whilst Lord Mandelson’s comments have not been unanimously supported some luminaries of the music world, including Elton John, have backed the harsher sanction. Presumably those pirates who have illegally downloaded Mr John’s songs have found that sorry seems to be the hardest word.

UK delays anti-hacking laws

The Home Office has again postponed legislation to amend the Computer Misuse Act which would in particular address the need for the criminalisation of denial of service attacks and the selling of hacking tools. The delay is caused by a fear that the changes might overlap with the Serious Crime Bill and criminalise legitimate security professionals.

Predictably, shadow home affairs spokesman James Brokenshire has criticised the delay, stating that it suggested that the UK was a “soft touch on cyber crime” and that “current Government inaction and inertia is putting us all at greater risk.”

The announcement of the delay coincides with a reminder from the US of the risks of cyber crime. Michael Chertoff, the US Homeland Security Secretary, this week compared the potential effects of cyber crime on the United States to the tragic effects of 9/11. Speaking at the RSA Conference in San Francisco he commented that "we take threats to the cyber world as seriously as we take threats to the material world".

Blog on Terror

A new anti-terror law has come into effect as of 21 June 2007 : the Electronic Commerce Directive (Terrorism Act 2006) Regulations 2007. Under these new provisions (which operate in conjunction with the Terrorism Act 2006), encouraging acts of terrorism and the dissemination of terrorist publications is an offence, including where such actions occur online. If a third party posts material which is an offence under these provisions, the police may notify a blog operator and require them to take the offending material down promptly (within two days). Failure to do so without cause could result in the Directors going to prison!

Aside from the other legal risks associated with blogging, blog hosts clearly now need to ensure they're not inadvertently encouraging terrorism. Often, going after a blog host where offences are committed online is much easier then tracking down the individual who actually committed the offence, who may try to hide behind the anonymous nature of the internet.

Spammer gets the can?

I was amazed to see that a US spammer faces up to 11 years in jail under the federal CAN-SPAM Act (as well as a $250k fine).  A prolific spammer, Adam Vitale is said to have sent around 1.2 million spam emails in just one week in 2005.  Whether or not he receives the maximum sentence is another matter, but the tough penalties under US law make our remedies in the UK (possible fines under the Privacy and Electronic Communications Regulations) look rather paltry in comparison.

Safer child’s play in cyberspace

The European Commission launched a public consultation on 12 April 2007 into ways of making online technologies such as Internet, mobile phones, game consoles and digital TV, safer for children to use. The consultation concentrates on three areas: illegal content , harmful content  and user-generated content and on-line communication. The Commision is following on from its Safer Internet plus programme, which will end in 2008 and will use the information gathered for assessing which is the best way to address online technology safety in the future.

Unlike the USA, where children are protected under the Children's Internet Protection Act and the Deleting Online Predators Act, there is no specific piece of legislation in the UK that protects minors from being targeted through online technologies. The consultation will be welcome in a number of quarters and may lead to tougher legislation across Europe to protect children.

The consultation will be open until 7 June 2007.

Love Spam

Four men have been arrested in Japan following the transmission of an alleged 5.4 billion spam e-mails over a two month period, averaging 90 million messages a day.

The representatives of popular Japanese dating company Takumi Tashuni allegedly managed to achieve this truly astounding tally of amorous e-mails by using a computer network based in China, reports Japanese English language newspaper the Daily Mainichi.

The use of infrastructure in China for such illegitimate purposes is not a new concept. Lower costs and less stringently enforced regulation of internet activity make this one of the countries of choice for illegitimate e-mail and website activities.

Government acts on DoS

Last Wednesday, after some delays along the way, the Government finally passed an Act introducing a new "denial of service" offence, punishable by up to ten years in prison.  The text of the draft bill, including the relevant wording, can be found here - see section 34 in relation to the offence for carrying out "unauthorised acts with intent to impair operation of computer".

As we have previously reported, the existing Computer Misuse Act had been widely criticised for being out of date and leaving loopholes for denial-of-service attackers to exploit, notably in the wake of the initial acquittal of David Lennon a year ago after he initiated the sending of millions of emails to an ex-employer. Though Lennon was subsequently sentenced to a two month curfew on appeal under the existing law, the Government has nonetheless pressed ahead with the change, which should address some areas of ambiguity.

The new Act also introduces an offence of "making, supplying or obtaining articles for use in computer misuse offences", which might catch for example anyone creating a virus and making it avaiable for distribution by third parties.

The DoS and Don'ts of computer misuse

Progress seems to be being made on updating the Computer Misuse Act 1990, which has existed without amendment since Apple Macs looked like this. The CMA had avoided legislative "botox" thus far, thanks mainly to the wide-reaching manner in which it was drafted. But an All Party Internet Group inquiry in 2004 called for an increase to sentences for hackers from six months to two years (thereby also making it an extraditable offence), and to make it clear that Denial of Service (DoS) attacks are unlawful.

We have mentioned previously on Naked Law the shortcomings of the CMA in tackling such DoS-type attacks, particularly as shown in the initial acquittal of David Lennon, who was said to have used the mail-bomber program Avalanche to flood the mail server of his ex-employer Domestic & General Insurance with more than 5 million emails. At trial the District Judge accepted the defence argument that each email sent was ‘authorised’ to modify the email server as that is how mail servers work, and that there was no cut-off point at which such volumes of email suddenly became unauthorised, and therefore illegal.  On appeal, this decision was overturned and the case referred back to the magistrates for sentencing.

A Computer Misuse Act (Amendment) Bill was proposed in 2005, but has since been withdrawn, with the amendments now incorporated in a Police and Justice Bill. These are currently being debated in the Lords, with much of the concern focused on proposals to make it an offence to “supply any article for use in offence.... believing that it is likely to be so used”. Fears have been raised that IT professionals who make and distribute hacking tools for legitimate purposes could risk prosecution, as they could be deemed “likely” to be used or modified for criminal purposes. As commented in the Lords, it would be like making the use of a crowbar illegal, as that could be “likely” to be used for burglaries. However the Home Office appear keen to play down such worries, and insist that only the bad guys will be caught by the legislation.

In the meantime many are saying that the real problem is not the CMA at all, but what Simon James, former head of the Computer Crime Unit at Scotland Yard, reportedly called a “woefully” under-resourced police force. Few could argue with this - as the Earl of Northesk points out, prosecutions under the CMA are currently rarer than for murder.

DoS prompts Computer Misuse Act review

We have posted several times before about the all-too-familiar deficiences in the Computer Misuse Act 1990 - but it finally looks as though there may be light at the end of the tunnel.  At the end of January, the UK Government published the Police and Justice Bill, Part 5 of which includes new provisions for dealing with computer crime, and specifically denial of service attacks.

The 15 year old Act has been subjected to criticism from reformers for many years now: its antiquated provisions seem woefully inadequate to cope with the rush to mainstream use of the worldwide web, e-mail and now wireless access. The stark deficiencies of the Act have been cast in relief by a long line of case-law – most recently and notably in November 2005, when a teenage boy launched a denial of service attack against his former employer.

The new reforms look to be far-reaching, introducing purposefully severe sentences to act as a deterrent while aspiring to tackle quickly-evolving menaces, such as denial of service. The key proposals include:

• an increase in the penalty for unauthorised access offences from six months to two years;
• an increase in the penalty for unauthorised modification of computer systems from five to ten years; and
• an attempt to make denial of service attacks illegal by making it an offence to "impair the operation of a computer".

Today, in the UK alone, attacks on IT services are estimated to cost businesses £3bn a year and reforms are badly needed.  Elsewhere, Spy Blog has posted an interesting critique of the Bill and Lilian Edwards looks in detail at the wording intended to deal with denial of service.

Did Alex publish Tew soon?

Like me, you may have had to suppress an involuntary smirk at the news that Alex Tew's deceptively simple Million Dollar Homepage idea has proved not to be so simple after all.  Mr Tew had just hit the full $1m, collected from a fascinating assortment of the great and not-so-great willing to pay $1 a pixel to appear on his website, when his site was struck by a denial-of-service attack from blackmailers.

This raises two interesting questions: is there anything (legally) he can do about the attacks; and do the attacks make him vulnerable to actions from third parties?

In relation to the former, we have seen recently the difficulty of bringing successful prosecutions in the UK under the Computer Misuse Act for denial-of-service attacks. In any event, it appears that the culprits are based somewhere in Russia, which is likely to make tracking them down and either prosecuting or pursuing a civil action against them rather problematic.  The website is now up-and-running again, but I suspect that Mr Tew has had to splash out a wodge of his (hard-earnt?) cash on his new DDoS-prevention technology.

The flip side of the coin is that poor Alex may have left himself vulnerable to actions brought by the customers advertising on his site.  Within days of putting the site up again, he will have heard that his final customer intends to sue him for breach of contract and negligence.  Unsurprisingly, given that the final 1,000 pixels went for $38,100 on eBay, the purchaser is a bit miffed that the homepage was "extremely slow loading or completely unavailable" (as Alex puts it) for six days.

I suspect that the breach of contract claim might relate to Tew's terms on eBay, though a number of these provisions are familiar from those appearing on his own page.  In particular, these are of interest:

"The site and homepage will be online for at least 5 years (starting from the day it launched), so at least until 26th August 2010, but possibly even longer (that's the aim)" (states the homepage)

"The site and homepage will be online for a guaranteed 5 years (starting from the day it launched), so at least until 26th August 2010. However the aim is to keep the site online for decades to come" (Alex states on eBay)

"There might be occasional downtime for site maintenance but I'll try and keep these to a minimum" (both website and homepage)

Tew also claimed as part of his auction on eBay that "the site will be online for the next 5 years guaranteed".

Though it is a little late now, Alex might wish he had been a little less bold when setting out his contractual obligations, particularly when relatively large sums of money started flying about. 

The terms do not include a "force majeure" provision to exclude his liability if the site were to be offline for reasons beyond his control and there is no exclusion of liability for indirect losses or loss of profits caused by any breach of contract.  There is also no general cap purporting to limit his liability, for example to the amount paid for the pixels in question.  As the six days offline are unlikely to be convincingly described as "for site maintenance", there is little to protect Mr Tew in his site's ts and cs.

The idea of the homepage may be inspiring for those harbouring entrepreneurial ambitions, but it also serves as a reminder of why it is worth looking carefully at your terms and conditions before you start raking in the money.  Those operating a website may want to take another look at their ts and cs to make sure they do not give rise to any unnecessary exposure.