1. Introduction 1.1 Need for action 2. Definition and Classification of Computer Crime
2.2 Classification of Computer Crime 2.2.1 Optional list 3. Extent of Crime and losses involved - worldwide 4. Perpetrators of Computer Crime 5. Vulnerability of Computer Systems to Crime 6. Computer Crime Legislation - International Development 6.2 Computer Crime Legislation Worldwide 7. Computer related Crime in India 7.1 Status 7.2 Strategy for Prevention of Computer Crime 7.3 Issues concerning classification of Computer Crime 7.4 Security Guidelines/Manual 7.5 Procedural Law 8. Conclusion 9. Acknowledgement 10. References 11. Classification table of Computer Crimes countrywise
2.1 Definition
6.1 International Development
12. Summary of Computer Crime Laws in various countries
Summary
The rapid development of computer telecommunication and other technology has led to the growth of new forms of transnational crime, especially computer related crime. Computer-related crime has virtually no boundaries and does or may affect every country in this world.
The report seeks to be a working document, discusses the phenomenon of computer- related crime, nature and classification of computer related crime. The report summarises the work done in the area of computer-related crim~ internationally, the acts/amendments enacted by several countries and discusses the need for promotional programme to create the awareness and enactment of necessary legislation in the country for the prevention of computer related crime. The report also identifies other source of information to which anyone interested may refer to obtain detailed information.
Given the complex and volatile world of computers and telecom, even though this report presents a grim and ominous view of the field, the reality of being better safe than sorry has to be realised. Back to Index
1. Introduction
Information technology today is encompassing all walks of life allover the world. The technological developments in the concept of computing, network and software engineering have helped in transition from paper to paperless transactions and Bi-media (text and data) to multimedia. Today, speed, efficiency, and accuracy in information exchange have become key tools for boosting innovations, creativity and increasing productivity. Activities as diverse as banking, healthcare, education, manufacturing, retailing, entertainment and mass media have come to depend on the ability to generate, access, store and transmit information. Computers are not only used extensively to perform the industrial and economic functions of society but are also used to perform many functions upon which human life is dependent. Medical treatment, air traffic control, industrial contolled and national security are few examples. Even a small glitch in the operation of the systems can put human lives in danger. Computers are also used to store confidential data of a political, social, economic or personal nature. Society's dependence on computer systems, therefore, has a profound human dependence.
The new technology has brought a great deal of benefits to Govt., business and research & development and to citizen himself. Its positive impact should not be measured only in terms of time and money. The ever-expanding world of information technology has, however, a different side. Computer systems offer some new and highly sophisticated opportunities for law breaking and the potential to commit traditional types of crimes in non- traditional ways.1.1 Need for Action
Today, large processing and storage capacity is available on desktop systems both at the level of main system memory RAM (Random Access Memory) as well as secondary level (Hard Disc). The Central Processing Unit can process millions of instructions per second. Large data and computer files can be stored atld manipulated in any desired manner. These systems can be networked and logged into any other system anywhere in the globe to access data, programme or data file.
Dataquest USA reported recently that an estimated 82 million computers worldwide will be linked to the Internet by the end of 1998 -up an astounding 71 per cent in just one year. It further predicts that the figure will triple to 268 million in the next four years.
The trans-national expansion of large scale computer networks and the ability to manipulate content including images from remote login and access to systems through regular telephone lines increases the vulnerability of these systems and the opportunity for misuse or criminal activity. The potential extent of computer crime is as broad as the extent of the international communication system. The consequence of computer crime may, therefore, have serious economic impact on social as well as human fabric of the society.
Laws, criminal justice systems and international cooperation have not kept pace with technological changes. Only a few countries in Western Europe and Organisation for Economic Cooperation & Development (OECD) have drafted laws to address the problem. However, none of the countries has resolved all the issues concerning legal, enforcement alld prevention of problems arising out of technological change- Computer crime is anew form of trans-national crime and its effective addressing requires concerted international cooperation. This can only happen, however, if there is a common framework for understanding what the problem is and what solution there may be. It is predicted that within the next decade, it will be necessary for developing nations to experience significant technological growth in order to become economically self-sufficient and more competitive in world market. We have also made out plan to set up National Information Infrastructure (NIl) in the country. The use of Internet in the country is growing and it is expected that there will be about two million Internet users in the country by the turn of the century .A beginning has also been made in the use Electronic Commerce (EC) and Electronic Data Interchange (EDI) by number of agencies in the country. The EC and ED! would involve communication of information pertaining to trade, finance and would result in transaction between private and public sector, in both domestic and international communities. It is expected that by the turn of the century , there will be signij1cant growth in the use of ED! both in the country and around the world. The success and growth ofEC and EDI, however, would depend upon how the issues concerning legal (such as tampering with data, message etc.), security and performance of hardware, software and communication are resolved. Therefore, as dependence on computer technology grows in the country , it is important to plan for security, examine the issues and promote crime prevention programmes on a national level. Adequate laws in this regard need to be framed and enacted.
The objective of this report is to summarise the work done in the area of computer related crime internationally, the acts/amendments enacted by several countries and discuss need for promotional progranlme to create the awareness and enactment of necessary legislation in the country for the prevention of computer related crime.
2. Definition and Classification of Computer Crime
2.1 Definition
2.2 Classification of Computer Crime
Classification of Computer Crime, Classification of Computer related crime as defined by OECD and expanded by Council of Europe is as under :
a) Computer-related fraud
The input, alteration, erasure or suppression of computer data or computer
programs, or other interference with the course of data processing that influences the result of data processing, thereby causing economic or possessory loss of
property of another person with the intent of procuring an unlawful economic gain for himself or for another person (alternative draft : with the intent to unlawfully deprive that person of his property).
b) Computer forgery
The input, alteration, erasure or suppression of computer data or computer
programs, or other interference with the course of data processing in a manner or under such conditions which would, according to national law , constitute an
offence of forgery if it had been committed with respect to traditional object of such an offence.
c) Damage to computer data or computer programs
The erasure, damaging, deterioration or suppression of computer data or computer programs without right.
d) Computer sabotage
The input, alteration, erasure or suppression of computer data or computer
programs, or interference with computer systems, with the intent to hinder the functioning of a computer or a telecommunications system.
e) Unauthorisedaccess
The access without right to a computer system or network by infringing security measures.
f) Unauthorised interception
The interception, made without right and by technical means, of communications to, from and within a computer system or network.
g) Unauthorised reproduction of a protected computer program
The reproduction, distribution or communication to the public witllout right of a computer program which is protected by law.
h) Unauthorised reproduction of a topography
The reproduction without right of a topography, protected by law, of a semiconductor product, or the commercial exploitation or the importation for that purpose, without right, of a topography or of a semiconductor product manufactured by using the topography.
2.2.1 Optional list
a) Alteration of computer data or computer programs
The alteration of computer data or computer programs without right.
b) Computer espionage
The acquisition by improper means or the disclosure, transfer or use of a trade or commercial secret without right or any other legal justification, with intent either to cause economic loss to the person entitled to the secret or to obtain an unlawful economic advantage for oneself or a third person.
c) Unauthorised use of a computer
The use of a computer system or network without right, that either :
i) is made with the acceptance of a significant risk of loss being caused to the person entitled to use the system or harm to the system or its functioning; or
ii) is made with the intent to cause loss to the person entitled to use the system or harm to the system or its functioning; or
iii) causes loss to the person entitled to use the system or harm to the system or its functioning.
d) Unauthorised use of a protected computer program
The use without right of a computer program which is protected by law and which has been reproduced without right, with the intent, either to procure an unlawful economic gain for oneself or for another person, or to cause harm to the holder of the right.
3. Extent of Crime and losses involved - worldwide
Opinions on the extent of computer crime differ widely. Media reports on spectacular cases and estimates of undetected ones, suggest a large amount of offences with high financial losses. Computer crime is largely a phenomenon reported in the industrialised countries particularly in USA and Western countries. However, the cases are also increasingly being reported from other parts of the world. United States is having world's largest installed base of computers and also have largest Internet users, it is the scene of most computer crime. According to US Justice Deptt. even the most conservative estimates suggest that both the number of incidents and dollar losses are staggering. As per their estimates reported in media, computer crime account as much as loss of US$ 10 billion a year in the United State alone. In the United Kingdom, the British Banking Association has estimated the cost of computer crime at US$ 8 billion a year .According to a study conducted by European Commission (EEC),investigations in Germany, few years ago, indicated losses from computer manipulation between 15,00,000 and 20,00,000 DM, which in some cases were even higher in the following years. In Sweden, the above mentioned study revealed an average amount of about 10,00,000 SEK for computer related embezzlement. This amount does not include the cost of computer espionage, which cannot be easily measured in dollars. The White House Office of Science and Technology (as reported by Los Angeles Times Syndicate, Asia Features) has estimated overall losses to US businesses from foreign economic espionage at nearly US$ 100 billion a year- EEC study showed that in Germany 4112 cases of computer crimes were reported to the police during 1995. About 60 per cent of these cases were considered by the Police to be case of computer crime under Penal Code. In Sweden a total of 452 cases were reported pertaining to computer related embezzlements. Austria reported 67 relevant cases until the end of 1995. France reported 1500 computer crime cases which were considered to be "intentional" and 929 cases were reported by Japan. In a survey in 1994, conducted by an agency of UK Government, 21% of the 385 firms covered stated that they had been victims of computer fraud in the course of past five years. A Computer Security Institution in USA, in a survey of 326 comp(mies, financial institutions and Govt. agencies, found that 75 per cent reported large monetary losses, but only 17 per cent of computer crimes were reported to law enforcement agencies. In another survey of 428 information specialists with Fortune 500 Companies, the Computer Security Institution found that only 42 per cent of these reported unauthorised penetration. Most of the computer crime cases reported or verifiable pertains to falsification of data, misuse of automatic cash dispensers, data alteration, data espionage and unauthorised access to computer . Majority of the cases, however, pertains to those reported by banks, financial institutions and insurance companies. Input manipulation, that is, 1'eeding the computer with incorrect data and, to a lesser extent, by programm{~ manipulation and other interferences have been generally the modus operandi identified in most of the computer related crime. However, the number of verifiable computer crime, apart from cases of illegal programme copying and the misuse of automatic cash dispenses is not very high. Difficulties of detection and evidence, together with a lack of knowledge on the part of investigating authorities in the computer data processing and telecommunication sector, are one reason for such low number of verifiable computer crime cases. Another, and may be more important one, is the reluctance of victims (for example banks, insurance companies and other financial organisations) to report incidents or divulge any related information due mainly to a fear of losing goodwill through adverse publicity.4. Perpetrators of Computer Crime
5. Vulnerability of Computer Systems to Crime
Computer systems are particularly vulnerable to computer crimes because of a number of factors. The more significant of these are analysed below.
i) Density of information and processes
Today the storage technology allows a storage of data to the extent of few giga bytes on a desktop computer and large amount of data (terra byte) on such system facilitating billions of characters on-line, Memory management technique allows independent process to be supported con-currently within a single operating system. The memory capacity on a personal computer which was in the range of few mega bytes few years ago is in the range of more than lOO MB on a desktop computer and can be expanded to as high as 512 MB. The large disk capacity and the memory, capacity facilitates centralisation of large information and its processing. This
provides an attractive target for infiltrator for attacking functions or information
assets of an organisation as data files can be combined to produce new information.
ii) Open Connectivity
Today systems which are available in the market have an open operating environment and open interfaces facilitating support for local, remote, interactive aJld in real time user mode. Any system anywhere in the globe can be connected both in terminal emulation mode or file transfer mode to any other system in the globe, Internet is one of the classic example. When information systems are implemented on such open systems, it is quite possible that there are errors in software implementation which is fully exploited by connecting the system and taking advantage of the system complexity.
iii) Electronic Technology
Computer data can be incidentally changed or erased with minimum chances of detection, e.g., virus or logic bomb. Anybody can easily modify the files and then cover the evidence of the offence. Data can be duplicated on floppies/1apes without any audit trails. By wire tapping, the computer can be intercepted or false commands may be generated to change the data and the files. Cases have been reported where electromagnetic radiations emitted by the computer have been intercepted to capture the data, delete or manipulate and program files without physically logging on to the system. Moreover, all hardware is susceptible to failure through aging, physical diameter and environmental change. These factors result in a problem of reliability, environmental dependency and vulnerability to interference and interception.
iv) Human factors
Employees represent the greatest threat in terms of computer crime. It is not uncommon in many EDP centres for computer programmers, computer operator, hardware technicians and other staff members to have extraordinary privilege in relation to access of key data and system resources in their organisations, A consequence of this situation is the probability that such individuals aJ'e frequently exposed to temptation,
v) System accessibility
Most of the time it is a goal to provide the maximum computer accessibility to large number of users. Two kind of computer crime that exploit remote access are use of fraudulent identification and access codes to access the system resources and the unauthorised use of an unattended terminal, logged on by anauthorised person. Unrestricted access privileges are often granted rather than allowing only the privileges necessary to perform an intended function. For example, a transaction oriented system permitting read only or inquiry only access offers a greater degree of protection than a system offering full programming capability. The exposure provided through increasingly easy access to electronic data and system resources is an important contributor to the vulnerability of modern computer systems.
6. Computer Crime Legislation -International Development
6.1 International Development
The issue of computer related crime were discussed for the first time in 1976 by the 12th Conference of Directors by of Criminological Research Institutes within Council of Europe. Following this Conference, the Select Committee of Council of Europe on Economic Crime studied economic crime in general and drafted recommendation No. R(81)12 on economic crime. This recommendation was adopted by Committee of Ministers of Council of Europe in June 1981. It defines economic crime offences by enumeration.
a) Modernisation of national criminal laws and procedures, including measures to
i) Ensure that existing offences and laws concerning investigative powers and admissibility of evidence in judicial proceedings adequately apply and, if necessary , make appropriate changes;
ii) In the absence of laws that adequately apply, create offences and investigative and evidentiary procedures, where necessary, to deal with this novel and sophisticated form of criminal activity;
iii) Provide for the forfeiture or restriction of illegally acquired assets resulting from the commission of computer -related crimes;
b) Improvement of computer security and prevention measures, taking into account the problems related to the protection of privacy, the respect for human rights and fundamental freedoms and any regulatory mechanisms pertaining to computer usage;
c) Adoption of measures to sensitize the public, the judiciary and law enforcement agencies to the problem and the importance of preventing computer-related CrImes;
d) Adoption of adequate training measures for judges, officials allil agencies responsible for the prevention, investigation, prosecution and adjudication of economic and computer-related crimes;
e) Elaboration, in collaboration with interested organisations, of rules of ethics in the use of computers and the teaching of these rules as part of the curriculum and training in informatics;
f) Adoption of policies for the victims of computer-related crimes which are consistent with the United Nations Declaration of Basic Principles of Justice for Victims of Crime and Abuse of Power, including the restitution of illegally
obtained assets, and measures to encourage victims to report such crimes to the appropriate authorities."
6.2 Computer -Crime Legislation Worldwide
To meet the challenge posed by new kinds of crime made possible by computer technology including telecommunication, many of the countries, l,lfgely
industrialised and some of those which are moving towards industrialisation have in the past ten years reviewed their respective domestic criminal laws from the point of adaptation, further development and supplementation so as to prevent
computer related crime. A number of countries have already introduced more or less extensive amendments by adding new statutes in their substantive criminal
law. These are USA, Austria, Denmark, France Germany, Greece, Finland, Italy, Turkey, Sweden, Switzerland, Australia, Canada and Japan. United States have
made numerous amendments to the law of federal and constituent level. Countries like Spain, Portugal, UK, Malaysia and Singapore have made isolated
supplements by enacting new Acts to prevent computer -related crimes.
6.3 Computer related crimes and punishment for committing such offences covered in the Computer Crime Act Amendments/Supplementation in the domestic laws enacted by different countries in the world are summarised in the table attached. None of the country has fully resolved all the issues such as legal, enforcement and prevention of crime. The legislation/amendments enacted by different countries covers only few of the classified computer-related crime/ offences.
6.4 The punishment ranges imprisonment upto one year to upto 10 years
depending upon the offence. Unauthorised access to computer/dat,t/program has been classified as computer crime/offence by almost all the countries who have enacted new act or modified the existing domestic criminal laws. Heavy
punishment along with fine have been imposed for some of the offences like unauthorised use of computer, alteration of data/program interfaced with computer etc.
6.5 The salient features of the Act as enacted by different countries are discussed below.
6.6 One of the reasons for not covering all the computer related crimes as classified by OECD in the Acts by the various countries is that.the investigation of computer crime as well as general investigations in a computerised environment create new computer specific problems such as evidence, testifying witnesses, legality of gathering, storing and linking personal data. In most of the computer crime cases it is still unclear as to what is an effective investigation to verify the different computer related crimes/offences. It is also unclear as to what extent civil liberties of citizens must be protected against the storage of personal data in police files by law. In addition, there are specific legal problems related to admissibility of computer data in a trial process. The laws so far enacted also do not clarify the jurisdiction. Such issues, it is hoped, will serve as a basis for future work on computer related crime and once resolved will help establish an adequate criminal system in the data processing area.
7. Computer related crime in India
7.1 Status
The subject of computer related crime is comparatively new in the country .The computerisation in the country though started 25 years ago, the proliferation and penetration of computers in the country particularly in the service sector is still very low as compared to world standard. The density of personal computers in the country is only 1.8 per 1000 persons as against world average of25 per 1000 persons. As per the IDC report, today only 40 per cent of the computers in the country are connected on LAN .
7.2 Strategy for Prevention of Computer Crime
The subject of computer related crime in light of the proliferation of the computer technology assumes greater importance. It is required to develop strategies for the suppression of these computer offences. The strategies may include the following
-Stipulating the offences which constitute computer crime.
-Identify the domestic criminal law for possible amendments and supplementation to meet the requirement of prevention of computer related crime.
-Effective prosecution, inter alia, by possible adopting the existing criminal procedure law and related provisions.
-Improving international collaboration. . The new enactment of laws should bear the imprint of close link and direct reference to existing penal provisions.
Considering the transformational natureofcomputer-related crime; it is desireable to adapt the guidelines and classification suggested by OECD with nessecary ammendment.
7.3 Issues concerning classification of Computer Crime
7.4 Security Guidelines/Manual
In addition to use of laws as a preventive measure, it is necessary to develop concepts/guidelines and manual for computer security and implement the guidelines in a serious manner at all levels and within different types of entities and organisations. Such guidelines/manual are fundamentally important and hold greater prospects of success than to enact new laws for protection. The guidelines/manual should detail out the procedures and evolve selt--regulating code of conduct or possible introduction of an obligation on the part of the enterprise to provide, in their annual accounts, information on the reliability of the
data processing. While preparing the guidelines/manual, historical traditions should be reviewed and kept in mind.
7.5 Procedural Law
The guidelines and the procedures have to be evolved, for instance, to the
application of the provision on search and seizure to the access, recording and
storing new data, on wire tapping to the interception of telecommunication. The opinion and adoption of the procedure for the investigation of computer crime is almost essential and should necessarily follow atly enactment or new law or
supplementation of existing law. The guidelines should include such aspects as search of the premises, powers of seizure, the duty of witnesses to hand-over witnesses as well as legality of gathering, storing and linking personal data.
8. Conclusion
The conclusion may, therefore, be drawn that computer-related crime is areal, at
least in respect of certain offences, expanding phenomenon, even though some of the statistics are probably not reliable. Furthermore, a steady increase in number of cases is expected. As of now the growth rate in number of computer crime
cases reported worldwide is in between 12-15 per cent. The time has clearly come for our country to put in hand a series of preventive measures in the field of
security or of instructions in computer ethics, and to respond to this by forming appropriate guidelines and legislation.
9. Acknowledgement
The authors are thankful to Shri Prafulla Kumar, Joint Director, IT Group, Deptt. Of Electronics, for compiling the acts/ammendments enacted in the area of computer-related crime by different countries in the world.
References
1. Computer-related crime, Recommendation No. R(89)9 on Cbmputer-related crime and final report of European Committee on Crime problems, Strasbourg, 1990
2. Brisloe W.G. Research Paper on Computer Misuse, Hobart, TaSmatlia, 1984
3. Department of Justice, Response of the Govt. of Canada to the" Report of Parliament Sub-Committee on Computer Crime, Ottawa, 1983
4. McKnight, Gerald, Computer Crime, London, 1993
5. Bequai, August Computer Crime, Massachusetts, 1994
6. Parker Donn B. "Computer Abuse Research Update", Computer and Law Journal, Vol. 2(1980), p.275
7. Computer Misuse Act 1990, UK
8. First International Conference on Computer Crime Byous, 19th-20t.h April, 1995
9. The Statutes of the Republic of Singapore Computer Misuse Act, 1994
10. Computer Crime and Data Protection Legislation, Canada, 1995
11. "The Penal Code" of Japan
12. Review of the German Law -Computer Crime
13. Offences Relating to Computers -Computer Crime Legislation, Australia
14. International Review of Criminal Policy Nos. 43 & 44, 1994, United Nations
15. OECD -Computer- Related Crime, Analysis of Legal Policy (Paris, 1986)
16. Evidence Act, Malaysia
17. Hong Kong ORDINANCE No.23 of 1993