CRIMES AMENDMENT BILL NO 6 NOW LAW

From www.internetnz.net.nz

After receiving royal assent on Monday 7 July, the Crimes Amendment Bill No 6 comes into force as The Crimes Amendment Act 2003. This act, amending the 1961 Crimes Act, may potentially affect many internet users and providers. It has been commonly known as the anti-hacking bill.

Internet users should be aware that unauthorised access to computer systems is now a specific criminal offence, as is damaging said systems or possessing software for the purpose of committing a crime.

How much of a change this will mean from current law is unknown. R. vs Garrett and R. vs Misic in 2001 both have led to convictions for similar actions as now covered in the new sections of the Crimes Act. It is probable though that Police will be more likely to lay charges when activities of this sort now occur.

ISPs will want to note that they should now have an enhanced ability to have the Police take action against NZ based attempts at password stealing or denial of service attacks.

ISPs will also want to note the exemption which applies to them for using interception devices. This is relatively narrow and specific.

Also of note is that the Act does not criminalise, for example, ISP staff mis-using their enhanced access, preferring to leave this to internal disciplinary procedures.

It is not clear whether the power of law enforcement agencies to conduct remote searches of computer systems exists or not. The Select Committee declined to exclude this power as requested by the Privacy Commissioner, saying the purpose was to preserve existing powers, and they do not feel it gives law enforcement agencies additional powers. The issue of police search powers is being reviewed by the Law Commission.

Another controversial issue was whether the SIS and GCSB would be able to use keyword searching and filtering, which is regarded as more invasive than other forms of monitoring due to its indiscriminate nature. The Select Committee considered the requirements for explicit warrants were adequate to deal with this, even if others disagreed.

NEW CRIMES

The four new crimes, now part of the Crimes Act, are:

Accessing computer system for dishonest purpose (obtaining advantage or benefit or causing loss to another person) maximum seven years imprisonment for this crime, or maximum five years for accessing with this intent, even if not successful.

Damaging or interfering with computer system maximum ten years where damage or interference is likely to be life threatening, and maximum seven years otherwise. The statute definition is damages, deletes adds to, modifies, or otherwise interferes with or impairs any data or software in any computer system; or causes any of the above, or causes any computer system to fail or deny service to authorised users.

Making, selling, or distributing or possessing software for committing crime has a maximum two year term.

Making, selling or distributing applies to software which would enable another person to access a computer system without authorisation with the sole or principal purpose to be to commit a crime, or if they hold it out as being useful to commit a crime (regardless of any other legitimate use).

Possession of software is only a crime when the software would enable you to access a computer system without authorisation AND that you intend to use that software to commit a crime.

Accessing computer system without authorisation has a maximum two year term and applies to anyone who intentionally accesses, directly or indirectly, knowing that you are not authorised to access that computer system, or is reckless as to whether or not you are authorised.

This crime does not apply to people who are authorised to access a computer system if they access that system for a purpose other than the one for which that person was given access.

Law enforcement agencies, the SIS and GCSB with appropriate warrants are also exempt from this section.

INTERCEPTION DEVICES

The existing ban on listening devices has been extended to include any interception device.

One is now liable to imprisonment for a term not exceeding 2 years if you intentionally intercept any private communication by means of an interception device. Also liable for up to two years for disclosure of the communication or even disclosing the existence of it.

The definition of a interception device is any electronic, mechanical, electromagnetic, optical or electro-optical instrument, apparatus, equipment, or other device that is used or is capable of being used to intercept a private communication.

One can be exempt if operated by a person engaged in providing an Internet or other communication service to the public if -

1. the interception is carried out by an employee of the person providing an Internet or other communication service to the public in the course of that person's duties; and
2. the interception is carried out for the purpose of maintaining that Internet or other communication service; and
3. the interception is necessary for the purpose of maintaining the Internet or other communication service; and
4. the interception is only used for the purpose of maintaining the Internet or other communication service.