Planned new computer hacking laws need greater clarification, say UK lawmakers

Out-Law News | 23 Oct 2014 | 2:34 pm | 2 min. read

The wording of draft UK laws that would introduce new criminal penalties for computer hacking and a stiffer punishment regime have been criticised as being too vague.

The UK parliament's Joint Committee on Human Rights (JCHR) criticised the latest proposals for new computer misuse laws that are contained in the Serious Crime Bill.

The Bill as currently drafted would introduce new offences relating to computer hacking that causes damage to the environment or any country's economy or national security. For some offences under the Bill, life imprisonment is a possible punishment.

The JCHR said further explanation of what would constitute a criminal offence under the Bill is required before it becomes law.

"We do not doubt the need to ensure that the criminal law provides adequate protection against cyber-attacks on critical infrastructure," the JCHR said in a report published late last week. "We doubt, however, whether the concepts of 'damage to the environment', 'damage to the economy' or 'damage to national security' are sufficiently certain in their meaning to justify their inclusion as an ingredient of a criminal offence carrying maximum sentences of 14 years and life imprisonment."

"The broad and vague definition of the new offence of computer misuse appears to be without precedent, and the Bill therefore appears to cross a significant line by using these unsatisfactory concepts in the definition of a serious criminal offence carrying a lengthy sentence. We recommend that the Bill be amended to remove these particular elements of the new computer hacking offence," it said.

According to the JCHR's report, the government admitted that "there is a tension between defining this offence sufficiently broadly to catch the various types of serious harm that might result from unauthorised acts in relation to a computer while providing legal certainty as to the scope of criminal liability".

The Serious Crime Bill (90-page / 382KB PDF), currently subject to scrutiny in the House of Lords, would, among other things and if introduced as currently drafted, amend the existing Computer Misuse Act and introduce potentially stiffer penalties for computer hacking than can currently be imposed.

Under the Bill, hacking into a computer, in the knowledge that such action is unauthorised, and causing, or creating a significant risk of, "serious damage of a material kind" would be a criminal offence if the act is committed intentionally or recklessly.

Where an individual has been found to have committed a computer misuse offence "as a result of an act causing or creating a significant risk of … loss to human life [or] human illness or injury", that person could be imprisoned for life and/or fined, according to the proposals. For less serious computer hacking crimes, culprits could be jailed for up to 14 years and/or fined, according to the plans.

'Damage of a material kind' would constitute damage to human welfare, the environment, or any country's economy or national security, according to the latest amendments passed at report stage in the House of Lords last week.

Computer hacking that causes "loss to human life, human illness or injury; disruption of a supply of money, food, water, energy or fuel; disruption of a system of communication; disruption of facilities for transport; or disruption of services relating to health", even if indirectly, would constitute an act that causes damage to human welfare, according to the proposals.

The House of Lords is scheduled to further debate the Serious Crime Bill on 28 October.

Under the Computer Misuse Act that currently applies, the maximum punishment that can be imposed for the most serious computer hacking offences is a 10 year jail sentence and/or a fine.