Regarding the Computer Misuse Act as a whole, but in particular Section 1:-
(1)A person is guilty of an offence if—
(a)he causes a computer to perform any function with intent to secure access to any program or data held in any computer [F1, or to enable any such access to be secured] ;
(b)the access he intends to secure [F2, or to enable to be secured,] is unauthorised; and
(c)he knows at the time when he causes the computer to perform the function that that is the case.
How is it determined whether or not access is "unauthorised"?
In particular, computer software is notorious for erroneously allowing access to secure functions, perhaps because of an error in coding, or negligence.
Consider, for example, the following scenarios:-
Alice goes to Bob's blog. She reads an article written by Bob. The article links to images '1.jpg', '2.jpg', '3.jpg'. Impressed with Bob's photography, Alice
performs a URL manipulation attackwrites "bob.com/4.jpg" in the address bar in her browser. '4.jpg' is, of course, one of Bob's racy selfies that he didn't intend Alice to see.
Is Alice's access "unauthorised"?
Alice posts the link on her feed.me social media account with the caption "lolz check out this photo that Bob totally doesn't want you to see", and Charlie clicks it.
Is Charlie's access "unauthorised"?
Bob, furious, goes to Charlie's feed.me page and performs a SQL injection attack¹ and replaces Bob's profile picture with some embarrassing far-right propaganda.
Is Bob's access "unauthorised"?
In each case, the owners of the data did not intend that the access be allowed.
In each case, due to negligence, the access was explicitly allowed.
¹I don't think it's particularly important to know precisely what a SQL Injection attack is, though if you're interested you can find an example here on stackoverflow. My question is more of a general one regarding how "authorisation" is determined, and my scenarios are for illustrative purposes rather than specific ones. Suffice it to say that from a technical perspective, SQL injection differs from URL manipulation only in terms of sophistication. In both cases, an attacker modifies data sent to a server in a way that grants unintended access, and importantly neither attack requires the attacker to defeat any authentication (e.g. guess passwords).
Similar cases have ended up being investigated by the police e.g. http://www.bbc.co.uk/news/uk-england-norfolk-17780084
Is there any mechanism for determining whether access is "authorised" or "unauthorised"? Does it depend on the intent of the owner of the data, or on the actual behavior of the computer system? Do all of my example scenarios represent "unauthorised" access, and thus differ only by the intent of the attacker?
Have any cases similar to the Norfolk City incident gone before a court?