U.K. prepares for amended computer crime law

U.K. prosecutors have received guidance on interpreting amendments to a computer crime law that introduce stronger penalties for computer hacking.

A six-page document published on Monday by the Crown Prosecution Service (CPS) gives prosecutors pointers for handling offenses under soon-to-change provisions of the Computer Misuse Act (CMA) of 1990.

The amendments were passed into law in November 2006 but have not yet come into force. The changes are designed to strengthen the government's ability to prosecute and punish hackers, and increase penalties for accessing systems without authorization.

Computer security professionals have expressed concern about the drafting of the changes, however.

The most-discussed change, contained in Section 3A of the CMA, makes it illegal for someone to create an application that is "likely" to be used for hacking. But the precise definition of "likely" has prompted fears the law could potentially target those undertaking activities such as penetration testing.

According to the CPS document, prosecutors should look at what an application does and who its creator thought would use it. Conditions to consider would be whether the hacking tool was given to a "closed and vetted list of IT security professionals or was posted openly," CPS said.

Prosecutors should also find out whether the tool has a legitimate purpose, if it has a large installation base and whether it's commercially sold.

Some applications will "have a dual use, and prosecutors need to ascertain that the subject has a criminal intent," CPS said. Possession of a program is not enough to prosecute, it said.

Computer security researchers "might find some comfort in this guidance" since criminal intent must be demonstrated, said Struan Robertson, senior associate with law firm Pinsent Masons.

The guidance is generally acceptable, wrote Richard Clayton, a computer scientist at the University of Cambridge, on his blog. But using the criterion of whether a hacking program is available for sale ignores the fact that much software is free, Clayton said.

On another issue, the document also clarifies what constitutes unauthorized access to a computer, a crime under Section 1 of the amended CMA. The defendant must know that the intended access wasn't permitted, and prosecutors must show that the person intended to improperly access information from the computer.