UK Plans To Bring In Life Sentences For 'Serious Cyberattacks'
from the because-terrorism dept
At the official State Opening of the UK Parliament, the Queen makes a speech in which she lays out what the UK government hopes to achieve in the new legislative session. It's one of the quainter British ceremonies -- BuzzFeed has a good summary of just how quaint -- but the one-line statements of intent can mask some very far-reaching plans. This year, for example, the Queen's Speech contained the following item :A serious crime Bill will be brought forward to tackle child neglect, disrupt serious organised crime and strengthen powers to seize the proceeds of crime.The Guardian has more details of one particular measure the serious crime Bill will contain:
Any hackers that manage to carry out "cyberattacks which result in loss of life, serious illness or injury or serious damage to national security, or a significant risk thereof" would face the full life sentence, according to the serious crime bill proposed in Wednesday's Queen's speech.Much of this is the kind of activity carried out in the form of attacks sponsored by governments outside the UK -- or, as in the case of the NSA, directly by those governments. Despite the recent grandstanding by the US when it filed criminal charges against members of the Chinese military whom it accuses of espionage, there is little hope of ever persuading the main players to hand over their citizens for trial, so the new UK law will be largely ineffectual against the most serious threats.
As well as targeting cyberterrorists, the new offence in the proposed update to the Computer Misuse Act [CMA] 1990 would also hand harsher sentences to those hackers carrying out industrial espionage, believed to be a growing menace affecting UK business.
The law would have a maximum sentence of 14 years for attacks that create "a significant risk of severe economic or environmental damage or social disruption". Currently, the section of the CMA covering such an offence carries a 10-year sentence.
But there is a real danger in the "or significant risk, thereof" part, since that gives the UK authorities huge scope to claim -- as they have in other contexts -- that some online action "risked" some terrible outcome, even though nothing actually happened. Things are made worse by the fact that there is no public interest defense or exemption for research. As the Guardian notes:
The government has also not addressed complaints over the application of current computer crime law, which some in the security industry claim actually makes the internet less safe.
What this means is that while it will fail to tackle the most serious online attacks, and chill research into security flaws, the proposed Bill will conveniently allow the UK government to target groups like Anonymous who carry out high-profile but relatively harmless actions over the Net. This section of the proposed Bill is really about the UK government bolstering its already disproportionate powers to throttle online protests by characterizing them as "serious cyberattacks", and threatening to impose life sentences on anyone involved.
This is because certain kinds of research could be deemed illegal. Experts known as penetration testers, who look for weaknesses in internet infrastructure, often carry out similar actions to real cybercriminals in their attempts to improve the security of the web, such as scanning for vulnerabilities.
But such research is punishable under British law, even if it is carried out for altruistic ends, leaving potential weaknesses unresolved, critics of the CMA said.
Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: cfaa, computer misuse act, cyberattacks, cybersecurity, hacking, sentencing, uk
Reader Comments
Subscribe: RSS
View by: Time | Thread
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
There's only one thing left to do...
Or send them rotten bananas.
[ link to this | view in chronology ]
Re: There's only one thing left to do...
[ link to this | view in chronology ]
Ah but of course. I assume they want to be in line with US where "crime pays"...for the police.
[ link to this | view in chronology ]
My new title
Ordering my new business cards right now: "Expert Penetration Tester"
I need to have t-shirts made up.
[ link to this | view in chronology ]
Re: My new title
Yea, thats what she said!
[ link to this | view in chronology ]
Re: My new title
[ link to this | view in chronology ]
Re: My new title
http://www.iacertification.org/cept_certified_expert_penetration_tester.html
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Well
There you have it. No ACTUAL harm needed. Just a "significant risk."
How soon do you think it'll be applied to people like Snodwn, Manning, et al?
"Leaking information regarding anti-terror efforts (mass surveillance) has the significant risk of jeopardizing the lives of operatives and citizens! LIFE."
[ link to this | view in chronology ]
Re: Well
[ link to this | view in chronology ]
Re: Well
Start censoring your thoughts folks, or big brother will get you
And they lived happilly ever after
[ link to this | view in chronology ]
NSA
I await with interest the extradition requests for NSA operatives to be sent to the UK for trial...
[ link to this | view in chronology ]
Exception
[ link to this | view in chronology ]
Re: Exception
[ link to this | view in chronology ]
Re: Exception
[ link to this | view in chronology ]
So while the general public is wide open to cybercriminals without any method to cure the intrusions, the spying agencies are setup pretty cozy.
[ link to this | view in chronology ]
Laws are for the little people
One can bet that this doesn't apply to the City bankers who robbed us all blind, despite the "serious" label. This bill is all about keeping the unwashed masses in their place.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
"... or a significant risk thereof"
How would it feel to spend the rest of your life in prison for a harmless prank that didn't injure anyone, didn't damage any property, and didn't harm national security -- just because the government argues that it "might have"?
This will in effect give the government immense power to charge anyone with anything, basically making up laws on the fly, and charging people with crimes that never happened, but simply "might have."
[ link to this | view in chronology ]
Re: "... or a significant risk thereof"
Next time, he'll get a life sentence.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
The Snowden Clause
Ah, that must be the Snowden Clause. So if anyone defects from GCHQ with a bunch of documents, they can throw the book at her.
[ link to this | view in chronology ]
Re: The Snowden Clause
By throwing in 'damage to national security', they can threaten any whistleblower with a life sentence for publishing any leaked documents, making exposing government abuse of power or illegal actions carried out by them a more serious crime than accidentally killing someone or crashing the economy.
[ link to this | view in chronology ]
Re: Re: The Snowden Clause
[ link to this | view in chronology ]
Re: Re: Re: The Snowden Clause
[ link to this | view in chronology ]
Translation: Damage the UK's reputation
That said, I wonder how vague the term "cybercrime" is. Then again, it's the UK, so it's going to be very vague.
[ link to this | view in chronology ]
"You, writing those emails commenting on our politics, pose a risk to national security"
"Nice" that they will add civil/criminal forfeiture to this. Never to late to get some good stuff from the people.
[ link to this | view in chronology ]
[ link to this | view in chronology ]