www.jbm.net/board_content.asp?bdtype=news&bdidx=2554&gP -
[Cached Version]
Published on: 12/16/2006
Last Visited: 4/1/2007
Security expert Peter Sommer is concerned by the conviction.
"Nobody thought he was doing anything significant or malicious, and there was a strong argument that the police should have given him a slap on the wrists and not prosecuted," said Sommer, senior research fellow at the London School of Economics' Information Systems Integrity Group.
Under Section 1 of the Computer Misuse Act, 1990, any unauthorised access to a computer site can be considered a crime, if the person accessing the system knows that he is not authorised to access the site.
As the Act says, "a person is guilty of an offence if: he causes a computer to perform any function with intent to secure access to any program or data held in any computer and the access he intends to secure is unauthorised and he knows at the time when he causes the computer to perform the function that that is the case."
In making his decision, district judge Mr Q. Purdy said that the court would have to take into account Cuthbert's previous conduct when deciding whether he was guilty.
...
Sommer backed up this point.
"The major problem was that he gave them an overly complex explanation which turned out not to be true, and involved them in a lot more work.That's probably why the judge didn't give him a conditional discharge, which was open to him," Sommer told ZDNet UK.
Sommer is now digesting the implications of the judge's ruling.
"There are a number of long term issues," said Sommer."We've now got a very strict interpretation on how Section 1 works and how it might be interpreted in terms of an attempt.Some of the tests you might instinctively want to run to see if a site is valid may fall foul of a strict interpretation."
Sommer added that there are also public policy implications.
...
The police need the help of penetration testers and this won't help," Sommer said.
A computer consultant has been convicted of gaining unauthorised access to a Web site collecting donations for victims of last year's tsunami, even though the judge hearing the case accepted that he meant to cause no harm.