How is "unauthorized" access determined under the Computer Misuse Act?

Question

Regarding the Computer Misuse Act as a whole, but in particular Section 1:-

(1)A person is guilty of an offence if—

(a)he causes a computer to perform any function with intent to secure access to any program or data held in any computer [F1, or to enable any such access to be secured] ;

(b)the access he intends to secure [F2, or to enable to be secured,] is unauthorised; and

(c)he knows at the time when he causes the computer to perform the function that that is the case.

How is it determined whether or not access is "unauthorised"?

In particular, computer software is notorious for erroneously allowing access to secure functions, perhaps because of an error in coding, or negligence.

Consider, for example, the following scenarios:-

Alice goes to Bob's blog. She reads an article written by Bob. The article links to images '1.jpg', '2.jpg', '3.jpg'. Impressed with Bob's photography, Alice performs a URL manipulation attack writes "bob.com/4.jpg" in the address bar in her browser. '4.jpg' is, of course, one of Bob's racy selfies that he didn't intend Alice to see.

Is Alice's access "unauthorised"?

Alice posts the link on her feed.me social media account with the caption "lolz check out this photo that Bob totally doesn't want you to see", and Charlie clicks it.

Is Charlie's access "unauthorised"?

Bob, furious, goes to Charlie's feed.me page and performs a SQL injection attack¹ and replaces Bob's profile picture with some embarrassing far-right propaganda.

Is Bob's access "unauthorised"?

• In each case, the owners of the data did not intend that the access be allowed.

• In each case, due to negligence, the access was explicitly allowed.

¹I don't think it's particularly important to know precisely what a SQL Injection attack is, though if you're interested you can find an example here on stackoverflow. My question is more of a general one regarding how "authorisation" is determined, and my scenarios are for illustrative purposes rather than specific ones. Suffice it to say that from a technical perspective, SQL injection differs from URL manipulation only in terms of sophistication. In both cases, an attacker modifies data sent to a server in a way that grants unintended access, and importantly neither attack requires the attacker to defeat any authentication (e.g. guess passwords).

Similar cases have ended up being investigated by the police e.g. http://www.bbc.co.uk/news/uk-england-norfolk-17780084

Is there any mechanism for determining whether access is "authorised" or "unauthorised"? Does it depend on the intent of the owner of the data, or on the actual behavior of the computer system? Do all of my example scenarios represent "unauthorised" access, and thus differ only by the intent of the attacker?

Have any cases similar to the Norfolk City incident gone before a court?

Answer 1

Is there any mechanism for determining whether access is "authorised" or "unauthorised"?

From the Computer Misuse Act s17:

(5) Access of any kind by any person to any program or data held in a computer is unauthorised if—
(a) he is not himself entitled to control access of the kind in question to the program or data; and
(b) he does not have consent to access by him of the kind in question to the program or data from any person who is so entitled but this subsection is subject to section 10.

(8) An act done in relation to a computer is unauthorised if the person doing the act (or causing it to be done)—
(a) is not himself a person who has responsibility for the computer and is entitled to determine whether the act may be done; and
(b) does not have consent to the act from any such person. In this subsection “act” includes a series of acts.

This probably doesn't quite answer your question.

Does it depend on the intent of the owner of the data, or on the actual behavior [sic] of the computer system?

In criminal law, unless a statute directs otherwise, the mens rea (guilty mind) is a necessary element. This means that the perpetrator must have intent to commit the crime.

However, knowledge that the act, or consequence of the act, is criminal is not necessary - rather, the knowledge of the act or its consequences is sufficient.

Do all of my example scenarios represent "unauthorised" access, and thus differ only by the intent of the attacker?

Yes. However:

• Ignorance of the criminality of an act has been successful as a defence to charges where the act is done in good faith. One might therefore assume that Charlie is likely to raise a successful defence on the balance of probabilities.

• DPP v Lennon is a case where an ex-employee of a company caused approximately 5 million emails to be sent to a company's servers, with the intent of hindering their operations. However it was raised as a defence that he could not know that the actions were unauthorised, as the purpose of an email server is to accept emails. At [14], Keene LJ makes this observation (my emphasis):

  The critical issue is that of "consent" as that word is used in section 17(8) of the Act. I, for my part, see a clear distinction between the receipt of emails which the recipient merely does not want but which do not overwhelm or otherwise harm the server, and the receipt of bulk emails which do overwhelm it. It may be that the recipient is to be taken to have consented to the receipt of the former if he does not configure the server so as to exclude them. But in my judgment he does not consent to receiving emails sent in a quantity and at a speed which are likely to overwhelm the server. Such consent is not to be implied from the fact that the server has an open as opposed to a restricted configuration.

  At [9], Jack J states:

  the owner of a computer which is able to receive emails is ordinarily to be taken as consenting to the sending of emails to the computer. His consent is to be implied from his conduct in relation to the computer. Some analogy can be drawn with consent by a householder to members of the public to walk up the path to his door when they have a legitimate reason for doing so, and also with the use of a private letter box. But that implied consent given by a computer owner is not without limit. The point can be illustrated by the same analogies. The householder does not consent to a burglar coming up his path. Nor does he consent to having his letter box choked with rubbish. That second example seems to me to be very much to the point here.

  I am of the opinion - and while I haven't found anything to the contrary, please remember it's my opinion only - that the first example of Jack J's is on point here.

  Unfortunately, the law does not give a clear answer - and it probably never will precisely define the boundaries of authorisation. The very fact that you ask about it and provided certain examples indicates that you know that there is a difference between what has happened.

Answer 2

The questioner asked "Does it depend on the intent of the owner of the data, or on the actual behavior of the computer system?"

It depends on the intent of the owner of the data, or at least the alleged offender's belief about that intent.

If it depended on the actual behaviour of the computer system then it would be impossible for anyone to ever commit the offence.

As an analogy, the actual behaviour of my door is to allow someone with either lock picking skills and tools, or a sledge hammer, to enter my home. That doesn't mean no-one could be guilty of a burglary.

Answer 3

There have been various court decisions going either way.

In a recent case, a woman was employed by a store, and one of her tasks was to print lottery tickets, hand them offer to customers, and receive cash for the tickets (say one dollar per ticket). But she also printed lots of tickets, up to a thousand per day, and just put them into her own pocket without paying for them. She was found out, and taken to court for theft and unauthorised access to a computer.

She was found guilty of the theft, but not guilty of the unauthorised access to a computer. The court found that she was indeed authorised to access the computer to print out the lottery tickets. Even though she intended to abuse the authorisation, the authorisation was still there. By printing out the tickets she only did what she was authorised to do. The fact that she then committed a crime didn't change the authorisation.

There had been cases where prosecutors added "unauthorised access" charges in various criminal cases. IMO that's the same as charging someone who drives his car to another home to commit a murder with "driving without license", claiming that someone who has a license to drive a car doesn't have a license to drive a car to get to the place where they want to commit a murder. Two completely unrelated things.