dave@utcsrgv.UUCP (Dave Sherman) (10/04/83)
The following are my comments on the proposed amendments to the
Criminal Code (Canada) regarding computer crime.
The text of the proposed amendments appears in a separate
article. I recommend reading the text before reading these comments.
There are essentially 3 crimes defined by the proposed legislation.
They are:
(1) obtaining a computer service illegally
(2) "intercepting" a "function" of a computer system
(3) destroying data (mischief)
For some reason I do not understand, using a computer system with
intent to commit (1) or (2) above is a separate crime; I would
have thought the general rules as to attempted crimes would have
been sufficient. "Using with intent" is somewhat broader, since
there needn't actually be an attempt to do anything illegal.
It would probably cover, say, the act of logging on to a system
for the purpose of trying to break in somewhere.
Crime (1) above is reasonable. Obtaining a service illegally
is often analogized to theft, although the service provider
may have lost nothing. The maximum ten-year penalty is stiff,
but in line with the maximum penalty for theft of any property
over $200, which is also 10 years. (In practice, of course,
few people will get the maximum penalty, and in most cases the
Crown will proceed by way of summary conviction, which will lead
to a maximum $500 fine and/or 6 months in jail.)
Crime (2) has me rather puzzled. The definitions are rather strange,
to say the least. It is a crime to
"intercept" a "function" of a "computer system"
by means of an "electromagnetic, acoustic, mechanical or other device".
That device is defined to be something that can be used to intercept
a function of a computer system, so by definition it includes anything
you want it to. "Intercept" includes anything which will give you
the purport or meaning of the contents, so obviously exploring with
your home terminal through a phone line is intercepting.
What about the definition of "computer system", though? This is
a beauty. It's a device which contains "computer programs" and,
pursuant to computer programs, "performs logic and control".
"Computer program" is defined as "data representing instructions or
statements that ... cause the computer system to perform a function".
And "function" include logic, control, arithmetic, communication,
storage and retrieval.
It seems to me that a LOT of things become "computer systems"
under the Criminal Code. What if I pick up your digital watch
and press the button to look at the date? Have I intercepted a
function? Will they put me away? What if I steal your calculator,
which is worth much less than $200. Is this now an indictable
offense?
It's also not clear to me that the act of snooping should itself
be subject to such severe penalties. You can scream all you want
about privacy. But look at trespassing. That doesn't carry severe
penalties at all. Even breaking into someone's house is only a
serious crime if there is intent to commit an indictable offence
(although if you break in, you have to prove the lack of such intent).
If I walk into your office and rifle through your desk, I don't
believe I can be put away for ten years. So why should the penalty
be so severe if I rifle through your disk files? Note that I am
not talking about destruction of data here. That's dealt with
via the mischief section, crime (3) in my list.
Sure, I know people are not going to get 10 years for harmless
activity. I suppose we can leave it to the courts to be reasonable.
It just makes me a little uneasy.
Both crimes (1) and (2) require the act to be done "fraudulently
and without colour of right". So if you have an honest (if mistaken)
belief that you're allowed to use a system, you're OK.
Crime (3), the mischief one, is reasonable provided the courts
are sensible with it. Obviously, you shouldn't go to jail when you
"destroy or alter data" if the data in question is a junk file
you are throwing away. But we have a similar law in relation to
property, and no-one gets arrested for throwing out the garbage,
so I guess it's OK. Again, 10 years seems high but isn't out of
line with the present legislation with respect to damaging property
(14 years if public property, 5 years if private property).
Anyone have any comments?
This draft has been out since July, and the Department of Justice
is listening.
Dave Sherman
Speaking entirely on my own and not for The Law Society of Upper Canada
Toronto
--
{cornell,decvax,ihnp4,linus,utzoo,uw-beaver}!utcsrgv!lsuc!davesmb@ulysses.UUCP (10/09/83)
There are several separate issues here that are often confused. The major questions are: (a) what are the general sorts of behavior that are to be considered criminal; (b) why don't existing laws cover the new offenses; and (c) how do we draft legal definitions that will cover the proposed offenses without being overly broad. This third point, it seems, is the hardest one to solve; we as computer scientists are in general not competent to do more than point out the technical flaws in lawyers' drafts.