§ Miss Emma NicholsonI beg to move amendment No. 12, in page 11, line 44, after 'computer', insert
'or by any other means.'I have suggested to my hon. and learned Friend the Minister outside the Chamber that as clause 3 creates the offence of the unauthorised modification of computer material, clauses 3(6) and 17(6) may create a loophole that my hon. and learned Friend and my hon. Friend the Member for Romsey and Waterside may care to consider.The question is of the back-up of computer data, normally in a secure location separate from the main system. I wonder whether the fact that the material is held at a separate location, away from the main computer, may mean that it will not be covered by the legislation—so that if someone physically attacks the back-up data, by exposing it to magnetism, for example, that action will not constitute an offence.
§ Mr. ColvinMy hon. Friend has explained that the amendment's purpose is to bring damage to computer data storage media that are not held in any computer, and achieved other than under normal conditions of operation, 1335 within the meaning of the clause 3 offence. My hon. Friend is right in thinking that the offence does not extend to such conduct, but I do not believe that it should.
I know what my hon. Friend has in mind and appreciate how damage could occur and that the consequences of such behaviour could be serious—particularly if a data storage medium was exposed to a magnet or if someone scraped his fingernails across a floppy disk, which could seriously inconvenience the data user. If the original material had not been backed up, the loss would be doubly serious. However, I do not accept that such conduct, remote as it would be from the computer itself, threatens the integrity of the computer in the same way as the conduct that is the subject of clause 3. Such an activity is more akin to criminal damage. Given my response, I hope that my hon. Friend is persuaded not to pursue her amendment.
§ Miss Emma NicholsonIn view of my hon. Friend's remarks, I beg to ask leave to withdraw the amendment.
§ Amendment, by leave withdrawn.
§ Miss Emma NicholsonI beg to move amendment No. 19, in page 12, line 11, after 'program,' add—
'(11) Reference to evidence obtained from the contents of a computer, in this Act, shall be admissible as evidence, albeit that the computer has been the subject of unauthorised access.'.This amendment raises a new point, centring on the admissibility of evidence. Some computers have a means of policing themselves to the extent that they can produce logs of unauthorised activities. However, if such logs are produced as crucial evidence in criminal proceedings, there could be problems, because section 69(1) of the Police and Criminal Evidence Act 1984 requires the production of a certificate stating, among other things,that there are no reasonable grounds for believing that the statement"—for that, read computer log,is inaccurate because of improper use of the computer.It may be argued that because the computer has been accessed by an unauthorised use, that renders evidence produced by the computer tainted. Under the Bill, it will be for the prosecution to show reasonable grounds for believing that the evidence produced has not been affected by the unauthorised access to the computer. There could be all kinds of evidential problems in that respect, so I commend amendment No. 19, which would make such evidence gained admissible in court.
§ Mr. ColvinThe effect of amendment No. 19 is to provide that even though there may have been unauthorised access, a computer-generated record should be admissible as evidence. In view of my earlier explanation about PACE I do not believe that that is necessary or desirable. The fact that unauthorised access has occurred would not render inadmissible any evidence produced by an affected computer. It would be up to the prosecution to show, if necessary, that access did not materially affect the evidence.
There seem to be some misconceptions about the operation of the PACE provision. Computer printouts used in computer misuse cases would usually be provided to show the internal state of a computer and how it was interfered with. That evidence would support any oral testimony given by the person responsible for running and 1336 monitoring the computer. In such cases, it would not fall within section 69 of PACE. However, if the printouts were used as direct evidence, they would fall within section 69 of PACE. That is right, as it provides the safeguard that if computer records alone are relied upon, they are reliable.
We should bear it in mind that computers are not predictable or wholly reliable. In criminal cases a person's liberty is at stake. In most cases computer-generated evidence would probably be only a small element in the case provided by the prosecution. Evidence is likely to come from a number of sources and could include the results of monitoring equipment with expert testimony from a licensed telecommunications operator, as well as material evidence such as notebooks.
No amendment covering this subject should be dealt with in the relatively narrow context of such offences. If any amendment to the Police and Criminal Evidence Act is justified it should apply to the criminal law as a whole, and should be considered in the context of the 1984 Act. On that basis, I hope that I have persuaded my hon. Friend the Member for Torridge and Devon, West to withdraw her amendment.
§ Miss Emma NicholsonI hope that the complexity of these matters, has become clear to the hon. Member for Birmingham, Hodge Hill (Mr. Davis), who earlier laughingly complained that we would have to spend an hour and a half discussing the Bill—that was only halfway through the morning. He complained that he had to listen to me and I apologised. The complexity of the matter shows that we need considerably longer than the short time allowed for debate this morning.
§ Mr. Terry DavisIt is always a pleasure to listen to the hon. Lady's arguments, and Opposition Members have paid close attention to her arguments in Committee and on Report. I was not seeking to inhibit or constrain the hon. Lady from advancing arguments for subsequent amendments. I stayed to listen to them. I was suggesting that her interventions in the speech of the hon. Member for Walthamstow (Mr. Summerson) were perhaps unnecessary and that we could have had even longer to listen to her arguments for these important and interesting amendments, had she not helped to waste time—in the interests of the Government Whips and the Privy Council—which also put in jeopardy other meritorious Bills on the Order Paper.
§ Miss NicholsonI accept gracefully the hon. Gentleman's comments. It is difficult to bring a Bill of such complexity to the House as a private Member's Bill.
I congratulate my hon. Friend the Member for Romsey and Waterside (Mr. Colvin) on his outstandingly good work. For once, I am persuaded to withdraw my amendment. I beg to ask leave to withdraw the amendment.
§ Amendment, by leave, withdrawn.
§ Order for Third Reading read.
1.18 pm§ Mr. ColvinI beg to move, That the Bill be now read the Third time.
This is a particularly important measure and I am pleased that hon. Members have seen fit to approach it in a critical but welcoming manner. The consultations which 1337 I have had with interested parties have convinced me that there is a great deal of misuse of computers and computer systems, although it is not possible to quote any substantiated figure. The increased dependence that modern society places on information technology suggests that misuse is destined to become more widespread in the future.
You may have read the press reports on Wednesday, Mr. Deputy Speaker, about a hacker who is alleged to have gained access to the computer of several academic institutions. His actions caused damage amounting to £25,000. I cannot comment on that case; it is sub judice. However, I draw attention to a case in the United States—that of Mr. Robert Morris. In 1988, he released what became known as the Internet worm. That program infiltrated and paralysed several thousand computers in the United States. It filled then with useless data and consequently overloaded them. Mr. Morris is due to be sentenced shortly, having been convicted of
intentionally and without authorisation gaining access to federal computers, preventing the authorised use of the machines and causing a loss of at least $1,000.The loss that he caused was very much greater than that. The maximum penalty that he faces in the United States is five years in prison and a fine of $250,000. That is not dissimilar to the penalties that he would face if he had been convicted under the Bill. Those are just two examples of the havoc that hackers can cause.I was extremely fortunate during the passage of the Bill to have the benefit of an excellent report published by the Law Commission. The Bill is based on that report. I diverge from the commission's recommendations in only minor respects, simply to reflect the further discussion that the report stimulated. The Bill's underlying policy remains very much in line with the commission's recommendations. That is a great compliment to the enormous amount of work that was done by the commission, under the guidance of Mr. Richard Buxton, QC, in producing its report and to the fact that it was able to reflect accurately the needs of computer users.
The Bill was considered in Standing Committee for three weeks. During that time the members of the Committee had the opportunity to deliberate on a wide range of issues. Without the process, the Bill would not be in such good shape and I should not be so confident as I am now of its ability to withstand close scrutiny in the courts. The courteousness and helpfulness of hon. Members in Committee played no small part in that process.
Legislation alone cannot be the answer to stopping the misuse of computers. It is important that users recognise the need to protect their systems against intrusion. During the relatively short period—about four months—that I have been interested in the subject since I was successful in the ballot for private Members' Bills, I have attended 12 conferences and seminars on computers and computer systems. It is significant that 10 out of the 12 concentrated on computer security. The industry takes the problem very much to heart. Proceedings on the Bill have to some extent focused attention on the problem. I am pleased that the Department of Trade and Industry is running a three-year awareness campaign to bring home that point. Practical security and this legislation complement each other admirably.
I take this opportunity to thank all those who have helped the Bill to reach its current stage of preparedness, 1338 including the representatives of the many organisations, companies and individuals outside the House who have helped me to iron out any deficiencies prior to and after the Bill's introduction. In particular, I thank the representatives of the Confederation of British Industry and the CBI computer users group, and also the small group of legal and technical experts who gave me a great deal of advice and help during the various stages of the Bill's progress through the House.
The House has taken the opportunity to signal the fact that computer misuse runs contrary to the public interest. I feel satisfied that we now have an appropriate vehicle with which actively to discourage that behaviour and to prosecute those who attempt to defy the law.
§ Mr. CohenI congratulate the hon. Member for Romsey and Waterside (Mr. Colvin), who has done a good job with his Bill. He has been meticulous in answering the points raised at various stages, including today. The Bill makes hacking a crime and makes it clear that it is not an acceptable practice, a view shared across the House. The point about it being remote burglary is also relevant.
However, it contains flaws, which I tried to make clear during our debates on the Bill. There is a danger that it will lead to criminal law being brought to bear in consumer electronics, just because of the presence of computer-like functions. That could lead to some farcical prosecutions, although I hope that it does not.
The Bill has extended penalties more than the Law Commission originally proposed. Possible computer misuse by the security services was an issue that I raised today and about which I am still concerned. The matter of the public interest defence not having proper weight was also discussed, and that could bring problems in future. Another flaw is that computer owners have not had a duty placed on them or been encouraged to ensure that they have proper security measures. The advice of the Data Protection Registrar has not been fully followed in relation to that.
The two biggest flaws are that the Bill does not define or give guidance about what a computer is. It is left to the police and the judiciary to interpret, which could lead to funny decisions. The search-and-seizure power could also be abused. I appreciate that that at least has been dealt with today in a spirit of compromise by the hon. Member for Romsey and Waterside, who accepted the amendment which provided that only a circuit judge can authorise such warrants, and I am pleased about that.
There are some flaws but, in all, I think that the hon. Gentleman has done well. The flaws mean that the House will have to improve the measure at some time, but we shall first have to see how it works. I suspect that it will not be the last legislation on computers. I congratulate the hon. Gentleman on the Bill.
§ Mr. Ian BruceI wish to emphasise the importance of the legislation and thank those who have been particularly active on it. When I was first approached by various companies and the Telecommunications Managers Association, for which I work on parliamentary matters, I was surprised that people put such emphasis on the problems of hacking and other computer misuse.
1339 My hon. Friend the Member for Romsey and Waterside (Mr. Colvin) had previously had no experience of computers, but he has become a computer misuse expert within a short period. It is wonderful to see how he has taken a complicated subject and understood it so well. In Committee that understanding was passed back in such a way that even those of us involved in the computer industry were able to understand it better. He is to be congratulated on the work that he has done.
Two other people stand out in our consideration of the Bill. First, my hon. Friend the Member for Torridge and Devon, West (Miss Nicholson) was instrumental in emphasising to the House just how important the subject of computer misuse has become. Secondly, I appreciate that, when the hon. Member for Leyton (Mr. Cohen) is praised by deepest Dorset, it may damage his street credibility, but these are heartfelt and sincere remarks.
My hon. Friend the Member for Torridge and Devon, West has constantly asked whether the Bill is tough enough to be effective and to catch those who must be caught by the legislation, whereas the hon. Member for Leyton has asked whether it will catch too many people, and those whom it is not supposed to catch. Those two conflicting views constantly being put in Committee led to us considering the Bill carefully. It is much better for those two conflicting forces. Those hon. Members may not appreciate the extent of their influence on the Department's recommendations or on my hon. Friend the Member for Romsey and Waterside.
When considering civil liberties—I appreciate that the hon. Member for Leyton is keen on that issue—we must protect the civil liberties of the computer user. Someone's confidential data and information kept on a computer should not be accessed by hackers, who use it mischieviously. That is an important civil rights issue.
The Bill is good and goes as far as we should without testing how it acts in practice. I commend it to the House.
§ Mr. Terry DavisThe hon. Member for Dorset, South (Mr. Bruce) is right to say that in the Bill we have tried to balance the civil rights of people to enjoy privacy of information and communications and those of people to ensure that they are not harassed and that the Bill or similar powers are not abused. Hon. Members have been conscious of the need to strike a balance. Whether we struck the right balance will be for others to decide later.
I entirely agree with the hon. Gentleman's description of our objectives. There have been differences between, on the one extreme, the hon. Member for Torridge and Devon, West (Miss Nicholson) and, on the other, my hon. Friend the Member for Leyton (Mr. Cohen) but there has been much unanimity. Hon. Members have tried to strike that balance.
I associate myself with the congratulations already expressed to the hon. Member for Romsey and Waterside (Mr. Colvin), not only on his initiative in introducing the Bill but on his clear and impressive grasp of the technical issues involved. I have learnt much from listening to him.
I congratulate the hon. Member for Romsey and Waterside for a different reason. The Bill will become an Act of Parliament. He deserves to bring it to that stage of success because of how he conducted it in Committee. He 1340 was courteous and listened to both extremes. If he was unable to answer objections or to carry hon. Members with him he was willing to compromise to achieve a Bill that is acceptable to as many people as possible. He deserves to be congratulated on how he conducted the Bill. Some other hon. Members could learn from his example; I have learnt much from him.
§ Mr. WoodI, too, should like to congratulate my hon. Friends the Members for Romsey and Waterside (Mr. Colvin) and for Torridge and Devon, West (Miss Nicholson). The Bill is important to the computer industry and to large and small computer users. It is all very well saying that many of the hackers have been students who were just having fun on computer systems——[Interruption.]
Mr. Deputy SpeakerOrder. Conversations are very distracting. I hope that the hon. Member will be allowed to continue his speech uninterrupted.
§ Mr. WoodStudents may have had their fun at times, but they have caused enormous costs for major computer system providers. That fun must stop, and the legislation will help to stop it.
Malicious abuse of computer systems has caused major problems and enormous costs for big computer users. We have not had a system of law capable of satisfactorily dealing with these matters. This legislation will he a major step forward in helping to catch some of the wrongdoers. There will inevitably need to be developments in legislation to cover computer use.
§ Miss Emma NicholsonWhen my hon. Friend the Member for Dorset, South (Mr. Bruce) talked about the input into the debate of various hon. Members, it almost sounded as though we were having a classic debate between the shire counties and inner-city areas. The movement among Conservative Members has come from Dorset, Devon, Hampshire and other shire counties and among Opposition Members from city areas, led by the hon. Member for Leyton (Mr. Cohen).
I pay a warm tribute to my hon. Friend the Member for Romsey and Waterside (Mr. Colvin) for his clarity of thought. He recognised that new criminals were still operating within the old framework of anti-social activity and that rapid action and new legislation were required to encompass their wickedness. I have immensely enjoyed working with my hon. Friend on the Bill. All of those who have backed his efforts and the Bill have found it a valuable, enjoyable experience. It has been a pleasure to watch my hon. Friend forge ahead and to put to the House and Committee the crucial points that needed to be covered.
I should like to leave my hon. Friend the Member for Romsey and Waterside and the other sponsors with the thought that Shakespeare, among his many other qualities, must have been computer-literate. He talked about the worm in the bud and said that if the worm was not detected and stopped, it would destroy the rose. The Bill's effectiveness will rest on detecting the worm. Without the ability either to prise apart the petals through powers of search or to listen in through monitoring, the police will 1341 have a tough job. Shakespeare was computer-literate too, and that is why we may have to look again at our friend the worm.
§ Mr. Douglas HoggI congratulate the Bill's sponsors and commend the Bill to the House.
§ Question put and agreed to.
§ Bill read the Third time, and passed.