Bills Digest No. 48 2001-02
Cybercrime Bill 2001
WARNING:
This Digest was prepared for debate. It reflects the legislation as
introduced and does not canvass subsequent amendments. This Digest
does not have any official legal status. Other sources should be
consulted to determine the subsequent official status of the
Bill.
CONTENTS
Passage History
Purpose
Background
Main Provisions
Concluding Comments
Endnotes
Contact Officer & Copyright Details
Cybercrime Bill 2001
Date Introduced: 27 June 2001
House: House of Representatives
Portfolio: Justice and Customs
Commencement: On a day to fixed by proclamation
or six months after Royal Assent, whichever is the earlier.
To update existing Commonwealth provisions on
computer-related crime.
Origins of the Cybercrime Bill
2001
The main Commonwealth offence provisions on
computer-related crime are currently found in Part VIA of the
Crimes Act 1914. These are largely based on the
recommendations of the 1988 Gibbs report.(1) They have
not been substantially amended since coming into force in 1989.
Computer-related search and seizure provisions were added in 1994
and again have remained largely unchanged since then.
In January 2000 the Model Criminal Code Officers
Committee (MCCOC)(2) released a discussion paper
Chapter 4: Damage and Computer Offences followed by a
report of the same name in January 2001 (the Chapter 4
report)(3). The Chapter 4 report is one of a series
addressing particular aspects of Australian criminal law with the
purpose of achieving national consistency of approach along the
Criminal Code model. It contains a 'model' Cybercrime Bill,
complete with definitions and offences.
According to the second reading speech, the
offences contained in Cybercrime Bill 2001 (the Bill) are based on
the Chapter 4 report. Interestingly, the report's approach is
itself significantly influenced by the UK Computer Misuse Act
1990:(4)
That is a consequence, in the main, of the fact
that the Committee was asked by the Standing Committee of
Attorneys-General to base its proposals for reform of the law of
theft and fraud in Chapter 3, Theft, Fraud, Bribery and Related
Offences (1995), on the provisions of the UK Theft
Act 1968. The Theft Act, together with the
Criminal Damage Act 1971 and the Computer Misuse
Act 1990 comprise a complementary scheme of legislation, with
interlocking parts...in view of the interdependence of these
schemes of legislation, the Committee concluded that Computer
Misuse Act 1990 provided an appropriate basis for the reform
of Australian law...[although the] Committee's proposals go beyond
the scope of the United Kingdom Act in certain respects [such as in
so-called] preparatory offences and the offence of unauthorised
access etc with intent to commit a serious offence.
However, in addition to the Computer Misuse
Act 1990, the Chapter 4 report also takes account of more
recent events such as the Council of Europe draft Cybercrime
convention.
NSW has already enacted the Chapter 4 report.
The Crimes Amendment (Computer Offences) Act 2001 was
passed by the NSW Parliament in April and received Royal Assent in
June. That Act corresponds very closely with the proposed offences
in the Chapter 4 report. According to a media release by the
Commonwealth Minister for Justice and Customs, all Australian
jurisdictions 'reconfirmed their commitment to giving priority to
developing updated computer offences' at the most recent meeting of
Australian Attorneys-General.(5)
The Structure of the Bill
The operative sections of the Bill are grouped
into two schedules.
Schedule 1 creates a number of offences to
replace those currently under Part VIA of the Crimes Act
1914. The main offences are:(6)
-
- Unauthorised access, modification or impairment to commit a
serious offence
-
- Unauthorised modification of data to cause impairment
-
- Unauthorised impairment of electronic communication
-
- Unauthorised access to or modification of restricted data
-
- Unauthorised impairment of data held in a computer disk, credit
card or other data storage device
-
- Possession of data with intent to commit a computer offence,
and
-
- Production, supply or obtaining of data with intent to commit a
computer offence.
Schedule 2 revises existing powers under the
Crimes Act 1914 and Customs Act 1901 to search
and seize electronically stored data.
Commonwealth jurisdiction over
cybercrime
The Commonwealth has no direct constitutional
power over computer-related offences. It can of course legislate
with respect to Commonwealth facilities, property or activities and
so actions involving Commonwealth computers and data may be
regulated. However, potentially the widest constitutional power is
that under section 51(v) - 'postal, telegraphic, telephonic, and
other like services'. The High Court has previously ruled that this
power extends to post-1900 forms of mass electronic communication
such radio and television(7) and there seems no to
reason to doubt that it would cover contemporary forms of
telecommunications such as the internet. A number of the Bill's
offence provisions provide for Commonwealth jurisdiction where a
'telecommunications service' is involved. The Bill defines
'telecommunications services'(8) as:
A service for carrying communications by means
of guided or unguided electromagnetic energy or both.
Some submissions to the Senate
committee(9) inquiring into the Bill contended that this
would include situations where computers were linked by a simple
'in-house' cable network. The Attorney-General's Department were of
a contrary view, apparently because such a network would not
constitute a 'service', although they did not provide any legal
authority for this other than saying that their position was based
on legal advice received. In any case, possible constitutional
uncertainty about the prosecution of an alleged offence involving
only an in-house network (and no other Commonwealth jurisdictional
'hooks') could be avoided by having the offence prosecuted under
the state law. Of course this presupposes the State in whose
territory the offence to place has passed the Chapter 4
legislation.(10)
Schedule 1 - Computer Offences
Item 1 is a consequential
amendment to subsection 25A(4) of the Australian Security
Intelligence Organisation Act 1979. It is required as the
computer-related offences currently found in Part VIA of the
Crimes Act 1914 will be replaced by the insertion of new
Part 10.7 of the Criminal Code Act 1995.
Item 2 repeals Part VIA of the
Crimes Act 1914.
Item 3 amends the definition of
what may constitute a physical element(11) under the
subsection 4.1(1) of the Criminal Code Act 1995 (the
criminal code). This clarifies that circumstances that 'arise as a
result of conduct'(12) can be considered to be a
physical element of an offence.
Item 4 inserts new Part
10.7 (Divisions 476-478) into the Criminal Code.
Division 476 - Preliminary
New section 476.1 defines a
number of technical terms such 'access to data held in a computer',
'Commonwealth computer' etc. These terms, with some minor changes,
reflect the recommendations of the Chapter 4 report. Some
submissions expressed concern about the about the breadth of some
definitions in new sections 476.1 and
476.2. For example, one submission(13)
suggested that definitions of the concepts 'access or modify' and
'impairment' could be amended to reduce the possibility that
innocuous activity or minor transgressions could fall with the
criminal scope of the Bill.(14)
New section 476.2 defines what
is meant by the terms 'unauthorised access, modification or
impairment'. These terms are key elements of offences under
new sections 477.1-478.2.
Of particular importance in new section
476.2 is subsection 476.2(2) which
provides that any such access, modification or impairment is not
unauthorised merely because it is done for a purpose other than
that for which a person is entitled. The Explanatory
Memorandum to the Bill comments that:(15)
...for example, if a Commonwealth employee is
authorised to access certain computer data so he or she can perform
her duties but instead accesses that data for the purpose of
defrauding the Commonwealth, that access does not become
unauthorised [and so does not fall within the meaning of 476.2]
The Chapter 4 report addressed this matter in
some detail:(16)
Should individuals who are authorised for one
purpose be guilty of an offence under this Part if they act for
another, ulterior purpose? Liability should certainly be imposed if
the original authorisation was obtained by deception as to the
offender's purposes. It does not follow, however, that liability
should be imposed when authorisation was obtained without fraud and
the defendant misuses the authorisation(17) [although]
the issue is clearly contentious...It should be noted, at the
outset, that the issue is unlikely to arise in the offences which
prohibit unauthorised modification of data and unauthorised
impairment of electronic communications. When breach of those
provisions is charged, the issue is whether some particular
modification or instance of impairment is authorised...there is an
undoubted need for one or more specialised offences which would
deal with misuse of authorised access to particular categories of
data...[however]... Legislation which imposes criminal penalties
for obtaining confidential information, sale or publication of that
information cannot be restricted to instances where the offender
happened to acquire the information by operating a computer.
New subsection 476.2(3)
provides that a person is considered to have caused any
unauthorised access, modification or impairment if their conduct
'substantially contributes to' the access, modification or
impairment.(18)
New section 476.3 provides that
criminal code 'Category A' geographical jurisdiction(19)
will apply to the new computer offences created by the Bill. As a
result of the application of Category A jurisdiction, the offences
would extend to situations where the conduct constituting the
offence occurs wholly or partly in Australia or on board an
Australian ship or aircraft, or where the result of the
conduct constituting the offence occurs wholly or partly in
Australia or on board an Australian ship or aircraft, or the person
committing the offence is an Australian citizen or an Australian
company. Thus an Australian citizen operating in a country where
computer hacking is not an offence, who hacks into a computer
system in a third country would face potential criminal liability
under the Bill.(20)
Further jurisdiction is available under
new section 476.3 for so-called ancillary offences
committed outside Australia. For example, this would apply where a
persons outside Australia conspire to commit a Part 10.7 offence
and subsequently that offence occurs in Australia or on an
Australian ship or aircraft.
New section 476.4 provides for
the concurrent operation of Commonwealth, State and Territory laws.
Thus State or Territory computer law may be used to regulate to
computer-related actions in those relatively few instances where
they fall beyond the Commonwealth constitutional power. However,
State or Territory computer law cannot be used where an action
falls under the scope of new section 476.5.
New section 476.5 gives
immunity from civil and criminal liability for staff or agents of
the Australian Secret Intelligence Service (ASIS) and the Defence
Signals Directorate (DSD) for computer-related acts which are done
'in the proper performance of a function of the agency'. These acts
may be done either inside or outside Australia, although in the
former case the act must be directly related to the overseas
activities of the agency. What constitutes 'proper performance of a
function' is not defined. The concept does appear in the
Intelligence Services Bill 2001, although again it is not defined.
Both Bills are also silent on how it might be determined whether a
person's actions constituted proper performance of an agency
function. This is important issue given the severe criminal
penalties under the Bill. Readers should refer to the Digest on the
Intelligence Services Bill 2001(21) for more discussion
on the issue.
Division 477 - Serious computer
offences
New section 477.1 deals with
unauthorised access, modification or impairment with intent to
commit a 'serious offence'. A serious offence is defined as one
that is punishable by imprisonment for five years or more,
including life sentences. New section 477.1
actually creates two offences. The first is where the unauthorised
access, modification or impairment is by means of a
'telecommunications service' - in this case the serious offence can
be either a Commonwealth, State or Territory offence. The second
offence applies where no telecommunications service is involved,
and in this case the serious offence must be one under Commonwealth
law. This latter restriction is because the lack of a
telecommunications service element removes the Commonwealth's
ability to legislate under section 51(v) of the Constitution.
New section 477.1 would make it
an offence to cause any unauthorised access to data held in a
computer, any unauthorised modification of data held in a computer
or any unauthorised impairment of electronic communications to or
from a computer, knowing the access, modification or impairment is
unauthorised and with the intention of committing or facilitating
the commission of a serious offence. The relevant fault elements
under the Criminal Code for this offence are intention to
do the act which causes unauthorised access, modification or
impairment, but only recklessness as to whether the act
will cause that access, modification or impairment.
Recklessness is defined by section 5.4 of the Criminal Code
as:
A person is reckless with respect to a result
if:
(a) he or she is aware of a substantial risk
that the result will occur, and
(b) having regard to the circumstances known to
him or her, it is unjustifiable to take the risk.
New section 477.1 also provides
that it is not necessary to prove that the defendant knew the
offence he or she was intending to commit was an offence against
the law of the Commonwealth, a State or a Territory and/or that the
offence falls within the definition of serious offence. This
approach is consistent with other criminal code offences such as
burglary. In addition, the intended serious offence does not have
to be committed or completed in order for a new section 477.1
offence to occur, nor is the fact that it was actually impossible
for it to have been committed or completed a bar to conviction.
However, an attempt to commit a new section 477.1 offence
is not itself an offence.
The penalty for committing a new section
477.1 offence is not to exceed the penalty for the serious
offence.
New section 477.2 makes it an
offence, subject to Commonwealth constitutional power, for a person
to cause any unauthorised modification of data held in a computer,
where the person knows that the modification is unauthorised, and
intends by that modification to impair access to, or the
reliability(22), security or operation of, any data held
in a computer or is reckless as to any such impairment. One or more
of the following circumstances must exist so as to confer
Commonwealth constitutional power: the modification or data
affected must involve a telecommunications service, or Commonwealth
computer, or data held on behalf of the Commonwealth: new
paragraph 477.2(1)(d). New subsection
477.2(2) applies absolute liability to the circumstances
listed in 477.2(1)(d), meaning that the prosecution does not have
to show that, for example, the accused knew the data in question
was held in a Commonwealth computer. This also means there is no
defence of mistake of fact - thus a person could not plead that
they thought the data impaired related to a private computer
network when in fact it involved Commonwealth computers or
data.
In a similar way to 477.1, a person may be
guilty of a 477.2 offence if their actions do not actually result
in any impairment. According to the Chapter 4 report, there are
three broad situations that the offence is likely to
cover:(23)
-
- a person with limited authorisation impairing data by engaging
in an unauthorised operation on data
-
- a hacker who obtains unauthorised access over the Internet and
modifies data and causes impairment, and
-
- a person who circulates(24) a disk containing a
computer worm or virus which infects data.
The Explanatory Memorandum to the Bill
comments:(25)
The proposed offence is limited to instances
where a person modifying computer data intends to impair data or is
reckless as to causing impairment. The existing offence contains no
such limitation and merely requires that the person modify the data
intentionally and without authority or lawful excuse (Crimes Act,
paragraphs 76C(a) and 76E(a)). The existing offence is too broad
and vague for a maximum 10 year penalty, as it extends to the
harmless use of another person's computer without that person's
permission.
The penalty for committing a new section
477.2 offence is up to 10 years imprisonment.
New section 477.3 makes it an
offence, subject to Commonwealth constitutional power, for a person
to cause any unauthorised impairment of electronic communication to
or from a computer, where the person knows the impairment is
unauthorised, and either intends to impair electronic communication
or is reckless as to any such impairment. In relation to
new section 477.3, constitutional power would only
be conferred where the electronic communication that is impaired
occurs by means of a telecommunication service or is to or from a
Commonwealth computer. As for 477.2, absolute liability would apply
to these Commonwealth jurisdictional connections.
'Impairment of electronic communication to or
from a computer' is defined in new section 476.1
as including:
(a) the prevention of any such communication;
or
(b) the impairment of any such communication on
an electronic link or network used by the computer;
but does not include a mere interception of any
such communication.
Commenting on new section
477.3, the Explanatory Memorandum to the Bill
states:(26)
This proposed offence is designed to target
tactics such as 'denial of service attacks', where an e-mail
address or web site is inundated with a large volume of unwanted
messages thus overloading the computer system and disrupting,
impeding or preventing its functioning. The proposed offence would
extend to situations where a person impairs a computer 'server',
'router' or other computerised component of the telecommunications
system that relays or directs the passage of electronic
communications from one computer to another.
The existing offence of interfering with,
interrupting or obstructing the lawful use of a computer (Crimes
Act, paragraph 76E(b)) applies to conduct that impairs the ability
of a computer to send or receive communications. However, it does
not clearly cover actions that interfere with the passage of
electronic communications to or from computers, for example, by
altering addresses, re-routing messages or interfering with the
capacity of the telecommunications system to transmit those
communications. The proposed offence would cover this conduct.
The proposed offence would only apply to
unauthorised impairment. Consequently, the offence would
not apply, for example, to a refusal by an Internet Service
Provider (ISP) to carry certain types of electronic communications
traffic on its network if such a refusal is pursuant to a
contractual arrangement or an agreement between the ISP and users
of the service. Furthermore, this offence, like the other proposed
offences, applies only to acts and not to omissions.(27)
Therefore, a strike by telecommunications maintenance workers that
resulted in impairment of electronic communication, for instance,
would not constitute the commission of this offence.
The penalty for committing a 477.3 offence is up
to 10 years imprisonment.
Division 478 - Other computer
offences
New section 478.1 makes it an
offence, subject to Commonwealth constitutional power, for a person
to cause any unauthorised access to, or modification of, restricted
data. Restricted data is defined to mean 'data held on a computer
to which access is restricted by an access control system
associated with a function of the computer' An obvious example is a
password. In relation to new section 478.1,
constitutional power would only be conferred where the access to,
or modification of, is caused by a telecommunications service, or
the data must be held in a Commonwealth computer, or held elsewhere
on behalf of the Commonwealth. As for new sections
477.1-3 offences, absolute liability applies to these
Commonwealth jurisdictional connections.
Recommendation 2 of the Senate committee report
suggests the definition of restricted data be amended to clarify
that the restricted access applies to the data not the computer
system.(28) The recommendation seems a sound one.
The penalty for committing a 478.1 offence is up
to 2 years imprisonment.
New section 478.2 makes it an
offence for a person to cause any unauthorised impairment of the
reliability, security or operation of any data held on a
Commonwealth computer disk, Commonwealth credit card or other
Commonwealth device used to store data by electronic means, where
the person intends to cause the impairment and knows that the
impairment is unauthorised. It is sufficient that the Commonwealth
leases the disk / credit card / devices rather it owning them
outright. Again, absolute liability applies to the Commonwealth
jurisdictional connections.
The penalty for committing a new section
478.2 offence is up to 2 years imprisonment.
New section 478.3 makes it an
offence for a person to have possession or control of data with the
intention of committing or facilitating the commission of a
Division 477 offence (ie offences under 477.1-477.3).
The offence provisions of new sections
478.3 and 478.4 implement Article 6 of
the draft Council of Europe Convention on Cybercrime. There is no
comparable offence existing under the current Crimes Act
1914. Commenting on new section 478.3, the
Explanatory Memorandum to the Bill
states:(29)
This offence is designed to cover persons who
possess programs or technology designed to hack into other people's
computer systems or impair data or electronic communication. For
example, a person will commit the offence if the person possesses a
program which will enable him or her to launch a 'denial of service
attack' against a Commonwealth Department's computer system and
intends to use the program for that purpose. It would also be an
offence for a person to possess a disk containing a computer virus
that the person intends to release over the Internet in order to
impair data in infected computers. In both instances, the person
would also commit the offence if he or she intends to provide the
program to another person for the purpose of enabling the other
person to impair electronic communication or computer data.
It is notable that 'possession or control' is
defined as including having control of data in a computer that is
in the possession of another person, whether that computer is
inside or outside of Australia. The Explanatory Memorandum
does not provide any information about what situations this would
cover. However, it is understood that it would be applicable if a
person could remotely access data located say on the hard drive of
another computer and this access could be used to manipulate or use
the data with the intention of committing or facilitating a
Division 477 offence.
The fact that it was actually impossible for a
Division 477 offence to have been committed is not a bar to
conviction under new section 478.3. However, an
attempt to commit a new section 478.3
offence is not itself an offence.
The penalty for committing a new section
478.3 offence is up to 3 years imprisonment.
New section 478.4 makes it an
offence for a person to produce, supply or obtain data with the
intention that data be used by that person or another person for
committing or facilitating a Division 477 offence. Data can either
be recorded electronically (eg in a computer or data storage device
such as a disc) or can be in the form of a document 'in which the
data is recorded'. According to Explanatory Memorandum to
the Bill 'this offence is primarily targeted at those who devise,
propagate or publish programs which are intended for use in the
commission of an offence'.(30)
The fact that it was actually impossible for a
Division 477 offence to have been committed is not a bar to
conviction under new section 478.4. However, an
attempt to commit a new section 478.4
offence is not itself an offence.
The penalty for committing a new section
478.4 offence is up to 3 years imprisonment.
Item 5 amends note 2 of
subsection 109(5) of the Education Services for Overseas
Students Act 2000. Section 109 deals with unauthorised access
to student information. The amendment simply substitutes a
reference to the new Part 10-7 of the Criminal Code Act
1995 (ie the provisions inserted by item 4)
for the Crimes Act 1914 provisions that are
proposed to be repealed by item 2.
Item 6 amends subsection 5D(5)
of the Telecommunications Act 1997. Section 5D deals with
obtaining warrants authorising interception of telecommunications.
The amendment is for a similar purpose as item
5.
Schedule 2 - Law enforcement powers
relating to electronically stored data
Items 1-13 amend various
sections of Part 1AA of the Crimes Act 1914. Part 1AA
governs the issue and use of search warrants. In general, Part 1AA
allows magistrates and authorised Justices of the Peace to issue
search warrants if they are satisfied that evidential material may
be at a nominated premises at any time within 72 hours of issuing
the warrant.(31) Warrants authorise the seizure of
things nominated in the warrant, but other evidential material may
also be seized if an officer believes that this is necessary to
prevent its concealment, loss, destruction etc.
Items 1-4 incorporate a range
of definitions into the Part 1AA. With one minor, but curious
exception, these match various definitions created by new
section 476.1 in item 4 of
schedule 1. The exception is that item
3 - the definition of data storage device - does not
include the words '(for example, a disk or file server)' that its
counterpart in Schedule 1 does. The Explanatory Memorandum
incorrectly states that the two definitions are
'matches'.(32) Presumably the omitted words in
item 3 are a drafting oversight, although of only
minor importance.
Item 5 deals with a situation
where a search warrant has been issued but it is unclear at first
instance whether a thing falls within the scope of the warrant or
is otherwise be able to be seized as evidence. Item
5 provides that a thing (such as a computer or data
storage device) may be moved from the search premises to another
place for examination or processing, where either it is
'significantly more practicable'(33) than examining or
processing the thing at the search premises and where 'there are
reasonable grounds to believe...[it]...contains or constitutes
evidential material' or the occupier consents in writing
to the move. As for the existing subsection 3K(3), there is a
statutory right for the occupier or their representative to be
present during the examining or processing. Under item
7, the thing may be removed for up to 72 hours, although
this can be extended for an unlimited period by a magistrate or
other authorised person if they believe on reasonable grounds that
more time is required to complete the examination /
processing.(34) The occupier has a right of being heard
in such an extension application. This 'right to be heard' is
common in Commonwealth legislation. For example, it is found in
subsection 3L(8) of the Crimes Act 1914, which relates to
securing electronic equipment until an expert is available to
examine it.
Item 8 amends existing
subsection 3L(1) to clarify that electronic
equipment on the search premises may be operated by an officer to
find data that is present at another location, eg on other
computers linked through a network. He or she must believe on
reasonable grounds that the data may contain evidential material
and that the equipment may be operated without damaging it. Such
material may be downloaded on to a data storage device and taken
from the premises without the occupier's permission providing that
the data storage device was brought to the premises as part of the
search exercise. This provision has attracted significant comment
during the committee inquiry.(35) However, it is notable
that the Attorney-General's Department suggested in evidence before
the committee that remote accessing of evidential material was
already implicitly permitted under section 3L(1) and that item 8
was intended to 'make the law clearer'.(36) Section
3L(1) states:
The executing officer or a constable assisting
may operate electronic equipment at the premises to see whether
evidential material is accessible by doing so if he or she believes
on reasonable grounds that the operation of the equipment can be
carried out without damage to the equipment.
If Attorney-General's Department view is
correct, item 8 actually incrementally tightens
the law by requiring the executing officer must believe on
reasonable grounds that data to be remotely accessed might
constitute evidential material. However, an executing officer would
not be required to notify the operators / owners of computers not
on search premises if data held on those computers is accessed
under warrant.
Another issue that was raised in relation to
item 8, but also relevant to items 12, 24
and 28, was privacy concerns about the data and other
information collected from the operation of computers during
searches. This was mainly prompted by the wide range of information
that may have been collected but subsequently found not to be
evidential material. The submission from the Office of the Federal
Privacy Commissioner suggested that, for example, personal
information that is not evidential material be destroyed within
three months unless this time is extended by a senior
officer.(37) In oral evidence to the Senate committee,
officials from the Attorney General's Department
commented:(38)
There are various safeguards to protect the
privacy of information, which is gathered under a search warrant.
Australian Federal Police officers are bound by the information
privacy principles in the Privacy Act 1988 and are subject
to a maximum penalty of two years imprisonment under the secrecy
provisions in the Australian Federal Police Act
1979 for any improper recording or disclosure of information.
The AFP has said that they will review their guidelines on
recording, disclosure and storage of information in light of the
new offences and investigation powers. Consultation about those
guidelines is occurring with the Federal Privacy Commissioner. The
vigour with which that was being pursued was quite evident
immediately after the last hearing. While I do not have anything to
give you today, I am very certain that those responsible for
considering this legislation will require a progress report or some
evidence of progress on that. As soon as we can do that we will
give it to you.
In addressing this, recommendation 3 of the
Senate committee report stated:
The Committee recommends that
the Bill be amended to provide for the destruction of all personal
information collected by law enforcement agencies, which is not
relevant to an investigation, after a period of 3 months but
subject to this time frame being extended on the authorisation of a
senior officer.
Items 9-11 make minor
amendments to various parts of section 3L consequential on
item 8.
Item 12 inserts new
section 3LA which would enable an officer to apply to a
magistrate for an order requiring a specified person to provide any
reasonable assistance or information to enable an officer to
access, copy or convert data. Before granting the order, the
magistrate would have to be satisfied (i) of the existence of
reasonable grounds to suspect a computer on search premises
contains evidence of an offence, or such evidence is accessible
from the computer; (ii) that person(s) named in the order is
reasonably suspected of committing the offence specified in the
search warrant, or is the owner of the computer or computer system
to be accessed, or a current employee of the owner; and (iii) that
the person specified in the order has knowledge of the computer or
system or measures applied to protect the computer or system.
The maximum penalty for non-compliance with the
order would be 6 months imprisonment.
This provision attracted significant criticism
on the grounds that a person failing to comply with an order
because, for example, they had forgotten the information necessary
to grant the access sought by the executing officer, might have to
prove that they had truly forgotten it to escape prosecution. It
has been suggested that the new section 3LA
include provisions about how a person could demonstrate that they
cannot comply with a new section 3LA order for
valid reasons and thus not be subject to potential prosecution.
Recommendation 4 of the Senate inquiry suggested that paragraph
3LA(2)(c) be amended to ensure that the magistrate issuing the
assistance order be satisfied that a person the subject of the
order must have 'relevant knowledge' of the computer, its network,
or the data security system, rather just 'knowledge' of these
matters.(39)
Another issue was whether this assistance order
could be seen as possibly compelling a 'form of
self-incrimination'. The Attorney-General's Department rejected
this view, commenting that:(40)
I do not think I have ever brought forward a
piece of legislation here without someone saying that the right to
self-incrimination is being threatened in some way or another. The
point is that it does not affect the privilege against
self-incrimination. The privilege arises where a person is required
to produce certain documents or answer questions and entitles the
person to refuse to produce those documents or answer the questions
on the grounds that it would incriminate them. An 'assistance
order' is different in that it does not require a person to produce
particular data; it only requires the person to provide information
necessary to enable a law enforcement officer to get access to the
computer. Once they have got access to the computer, the officer
still has to search for it and find it.
An assistance order typically takes the form
where, as part of a search of premises under the power of a
warrant, certain persons on the premises are required by the
relevant legislation to provide the executing officers 'with all
reasonable facilities and assistance for the exercise of their
powers'.(41) Again typically this obligation does not
extend to providing any documents requested by the officer if this
would tend to incriminate the person the subject(42) of
the request. Note that the privilege against self-incrimination -
which is common law concept - can be nullified if the relevant
legislation specifically requires that documents be provided or if
there is some reasonably clear intent in the legislation for the
privilege not to apply.
Under the common law, it is clear that a person
cannot refuse access to premises (so as to prevent search and
seizure of documents) by executing officers under the privilege
against self-incrimination. The privilege does allow a person to
decline to reveal the whereabouts of documents. Unfortunately,
there does not seem to be any obvious case law directly on the
point of what degree of assistance a person must provide to access
documents. New subsection 201A(2) provides that an
order requiring a person to provide access to computer data can
only be granted if the magistrate has reasonable grounds for
suspecting that evidential material is held in a computer or
accessible from it. Although not absolutely beyond doubt, the best
view of section 201A orders are that they are not
inconsistent with the common law privilege against
self-incrimination.
Item 13 is an amendment
consequential on item 12.
Items 14-30 amend various
aspects of the Customs Act 1901, particularly the powers
of Customs officers acting pursuant to a search warrant under
sections 200-202, which are very similar to those of police
officers under the Crimes Act. The main amendments mirror those by
made by items 5,7, 8 and 12 of
Schedule 2.
Item 21 is identical to that in
item 5.
Item 23 is identical to that in
item 7.
Item 24 is identical to that in
item 8.
Item 28 is identical to that in
item 12.
Item 31 provides that the
changes made by Schedule 2 only apply to warrants
issued after the comment of the schedule.
The existing computer-related crime provisions
in the Crimes Act 1914 certainly need updating. The
passage of the Bill, if amended by the generally sound
recommendations of the Senate committee, will create an appropriate
range of offences to match the growth in computer use and crime
since Part VIA of the Crimes Act 1914 came into effect
over ten years ago.
Some submissions to the Senate committee raised
concerns that some legitimate activities, such as the operations of
persons working in the security computer industry who use tools
similar to those employed by so-called 'hackers', may face some
risk of falling within the technical definitions of some of the
Bill's offences.(43) Fairly similar views have been
expressed by the Australian Democrats.(44) The ALP has
also been critical of what it sees as a lack of consultation with
the information technology industry in the development of the Bill,
although it appears to concede that this criticism does not apply
to the Model Criminal Code Officers Committee process in drafting
the Chapter 4 report.(45) While perhaps the majority of
the various concerns expressed in the submissions seem to be
adequately dealt with by the responses of the Attorney-General's
Department, the relative newness of some the Bill's technical
provisions would seem to justify the Australian Democrats
recommendation in the Senate inquiry report that:
....the legislation be amended to enable a
review of the use and application of the extended investigation
powers and new offences 18 months after the commencement of the
legislation.(46)
-
- Review of Commonwealth Criminal Law: Interim Report on
Computer Crime, Attorney General's Department, November 1988.
- The committee members consist of officials from all
Commonwealth, State and Territory jurisdictions and is chaired by a
justice of the NSW Supreme Court.
- Report on Chapter 4 - Damage and computer offences and
amendment to chapter 2: jurisdiction, Model Criminal Code
Officers Committee of the standing Committee of Attorney's General.
January 2001.
- Chapter 4 report, p. 89.
- 'United efforts against Cybercrime' Media release
Senator the Hon Chris Ellison, 25 July 2001
- This code of prohibitions is supplemented by the sabotage
offences of Part 4.3, which impose severe penalties for conduct
which is intended to cause major damage or major disruption to
government facilities and public infrastructure. These offences,
which were developed from international proposals for
anti-terrorism legislation, extend across the saboteur's
destructive gamut, from bombs to computer viruses.
- See Jones v Commonwealth (1965) 112 CLR 206.
- The term is not used in the Chapter 4 report.
- Senate Legal and Constitutional Legislation Committee Report on
the Cybercrime Bill tabled 21 August 2001. The report of the
committee can be viewed at
http://www.aph.gov.au/senate/committee/legcon_ctte/cybercrimebill01/cybercrime_bill01.pdf
- See new section 476.4, which allows the concurrent operation of
State or Territory law.
- A physical element is one of the things that must be proved in
order for a prosecution to be successful. Serious crimes also
require a mental element to be proved.
- Under Part 2.2 of the Criminal Code, conduct is defined as
meaning 'an act, an omission to perform an act or a state of
affairs'.
- Alex Steel, Submission no. 17 to the Senate Legal and
Constitutional Legislation Committee Inquiry into the Cybercrime
Bill.
- Ibid, p. 2. These and a range of related concerns were
addressed by the Attorney-General's Department in submission no.
20A to the Senate committee inquiry. The Committee appeared to be
satisfied with the Department's assurances that the offences
contained appropriate fault elements and would not apply to
innocuous activities: Report on the Cybercrime Bill, pp. 14-15.
- Explanatory Memorandum, p. 6.
- At pp. 141-47.
- The committee noted that it had taken a similar position in
relation to its 1995 Theft, Fraud Bribery and related Offences
report: '[we take] the view that entry pursuant to permission
should not be trespassory, even though accompanied by the intention
to steal or commit another offence.' Chapter 4 report, p. 141.
- The concept of 'substantially contributes' is found elsewhere
in the Criminal Code, although only a few places such as section
146.2 'causing harm to Commonwealth public officials'.
- See section 15.1 of the Criminal Code.
- This example is taken from p 7 of the Explanatory
Memorandum.
- Bills Digest No.11, 2001-02 http://www.aph.gov.au/library/pubs/bd/2001-02/02bd011.pdf
- Concerns about the meaning of 'reliability' were also expressed
in Senate submissions: submission no. 17, op cit, p. 3.
- See p. 163.
- See section 11.3 of the Criminal Code - Innocent agency.
Essentially the person circulating the disk to another, knowing
that it will result in the unauthorised data modification, is
procuring an innocent party to cause the modification and thus
themselves guilty of the offence.
- At p. 9.
- At p. 10.
- This is because of the operation of section 4.3 of the Criminal
Code, which deals with omissions in the context the Code's Part 2
'principles of criminal responsibility'.
- Report on the Cybercrime Bill, p. 19.
- At p. 12.
- Explanatory Memorandum, p. 13.
- The exact requirements for issuing of a warrant are detailed in
section 3E of the Crimes Act 1914.
- Explanatory Memorandum, p. 14.
- Regard must be had to timeliness and cost of processing or
examining the thing at another place rather than on site and to the
availability of expert assistance.
- Senate inquiry recommendation 5 and 6 also relate to the issue
of extension of examination time.
- See for example, submission by the Communications Law Centre
(submission no. 3), pp. 2-3.
- Senate inquiry hearing transcripts, p. 25.
- Submission no.11 p. 1.
- Senate inquiry hearing transcripts, p. 39.
- Although in any prosecution against a person for failure to
comply with a new section 3LA order, if that
person claimed that they did not have the necessary knowledge to
comply, the prosecution would carry the burden of proving that the
person did in fact have the necessary knowledge.
- Senate inquiry hearing transcripts, p. 40.
- For example, section 53 of the Fuel Quality Standards Act
2000.
- Note that the common law privilege against self-incrimination
does not apply to companies: Environmental Protection Authority
v Caltex Refining (1993) 178 CLR 477. Thus an employee could
not claim the privilege if a document incriminated the company (or
indeed another person) rather than themselves.
- See for example, submission no.4 (2600 Australia), section 4a
and 6j.
- Senator Brian Greig 'A clumsy step in the right direction'
Canberra Times 30 July 2001
- Report on the Cybercrime Bill, p. 33.
- Ibid, p. 43.
Angus Martyn
10 September 2001
Bills Digest Service
Information and Research Services
This paper has been prepared for general distribution to
Senators and Members of the Australian Parliament. While great care
is taken to ensure that the paper is accurate and balanced, the
paper is written using information publicly available at the time
of production. The views expressed are those of the author and
should not be attributed to the Information and Research Services
(IRS). Advice on legislation or legal policy issues contained in
this paper is provided for use in parliamentary debate and for
related parliamentary purposes. This paper is not professional
legal opinion. Readers are reminded that the paper is not an
official parliamentary or Australian government document.
IRS staff are available to discuss the paper's contents with
Senators and Members
and their staff but not with members of the public.
ISSN 1328-8091
© Commonwealth of Australia 2000
Except to the extent of the uses permitted under the
Copyright Act 1968, no part of this publication may be
reproduced or transmitted in any form or by any means, including
information storage and retrieval systems, without the prior
written consent of the Parliamentary Library, other than by Members
of the Australian Parliament in the course of their official
duties.
Published by the Department of the Parliamentary Library,
2001.
Back to top