Is amendment No. 6 being pressed?
Criminal Damage Bill, 1990: Committee Stage (Resumed).
Debate resumed on amendment No. 6:
In page 6, between lines 26 and 27, to insert the following new subsection:
"(2) Subsection (1), (in so far as it relates to accessing data not owned by the State), applies only to access which is capable of causing economic loss to the owner; and accordingly a person who accesses data contrary to this section shall be liable for any such economic loss.".
—(Senator Costello).
Acting Chairman (Mr. Farrell)
Senator Costello asked me to say it is being pressed. I would like to ask the Minister a question which I understand has not been dealt with. Does the Minister have the legally understood definition of "intent"? My understanding is that "intent" is different from "purpose". The word "intent" means to intend the natural and probable cause of one's action. Therefore, the apparent insistence yesterday that the case of a person playing a game on a computer to which he or she did not have authorised access was not covererd by this, is nonsense; the intent and probable consequence of playing a game on a computer is to access data and as the Bill somewhat ludicrously defines "data" as including a programme it would be useful if the Minister would clarifly this point. If my spouse uses my Banklink card — which is not a joint card — to gain access to my account to find out the balance in my account, without the bank's permission, is she guilty of a criminal offence under this misguided section? The bank is the owner of that data, not me.
Perhaps Senator Ryan has not checked the record of yesterday's debate.
I am aware of it.
I want to repeat what I said. On the previous amendment I specifically and very definitely said that section 5 was not intended to deal with hacking which causes damage to data, for example, by altering the software or the data itself. Where an unauthorised access causes damage, under section 2 that is an offence of criminal damage and the convicted person may be required to pay compensation. For the reasons given in the last amendment, sections 2 and 9 adequately deal with the question of compensation for any damage caused by unlawful access. That is what this amendment is about and it is a repetition of what we discussed yesterday under amendments Nos. 4, 5 and 8 which were taken together.
With regard to the banklink card, if Senator Ryan gives his Banklink card and Pin number to someone he is giving that person authority to access whatever information is available under that card and Pin number. The onus is on the person who owns the card and gives it to somebody else. Senator Ryan mentioned his spouse using his Banklink card. By giving her the card and his Pin number he is authorising her to access his account.
The point is that the data belongs to the bank, not to me. If I am unaware of it, then the magnificently phrased "lawful excuse" bolt hole operates. The data in my bank account is the bank's property, it is not mine to give; that is the difference.
In pursuing any indiscretions in law the principle of reasonable doubt always applies. To take the Senator's suggestion to its logical conclusion, if the case he referred to was taken to court — that is, if he gave his Banklink card and Pin number to someone else — under any interpretation, the contributory factor would be that authorisation was given because he gave his card and the reasonable doubt element would apply. I have to admit I have a Banklink card and a Pin which I rarely use. I think the intent of giving the Banklink card was, as suggested yesterday, to obtain money or a statement. Is that what the Senator is referring to? If you give your Pin number to another person you are giving that person authorised permission to access whatever data is available. I do not know what conflict the Senator sees in that process.
The Minister can go around in circles, he has eminent advice at his disposal, but whose property is the data on the bank's computer? To withdraw money means operating a programme which means accessing data from a programme. Perhaps people do not understand this; I am beginning to wonder if they do. To actually get money out of a bank means accessing a programme — keying in information to process the access. That programme is the property of the bank, it is not my property. Is the amendment effectively saying that the only reason my spouse cannot be prosecuted is that I gave her permission although, effectively, what she is doing is illegal, she is accessing data.
Amendment, by leave, withdrawn.
I move amendment No. 7:
In page 6, between lines 29 and 30, to insert the following new subsection:
"( ) A person shall not be guilty of an offence under this section by reason only of an act which is a breach of copyright.".
Under general law, a breach of copyright which does not involve intent to profit, in other words, to photocopy a book for one's own use, is a breach of copyright but it is not a criminal offence. It is a civil offence. Similarly, if I copy a computer disc which contains commercial software and I copy it for my own use, it is a civil offence, not a criminal offence.
The problem with this section is that if I operate a computer, without lawful excuse, to gain access to software that is for sale and by that I breach the copyright, I am now guilty of a criminal offence. This hair-raising section states that a person who, without lawful excuse, operates a computer with intent to gain access to data is in breach of the copyright.
For example, unless there is a site licence for a word processing package, information on my computer is licensed to me by name. If somebody else comes into my office who has permission to use my computer and gains access to a commercial piece of software licensed to me, that person would be in breach of the copyright because he would be using something licensed to me alone. If my secretary and I use the same computer, in law the software must be licensed to both of us. Under section 5, if a third party uses that computer they are in breach of copyright because that person, without lawful excuse, will be using a computer with intent to access the data and will be guilty of a criminal offence only because they breached the copyright. This is a peculiar manner in which to introduce a new concept in relation to the breach of copyright which involves no profit to the individual; this is being changed from a civil offence to a criminal offence. This amendment attempts to redress what I believe is an unintended mistake in the section.
I support the amendment. It appears this area was overlooked when the Bill was being drafted. I doubt if it is the Minister's intention that somebody who breaches copyright and copies a programme for their own use without any financial gain should be subject to criminal proceedings. That is not logical, it is bad law and does not comply with similar law in other areas.
I appreciate that in this amendment the Senator is, again, endeavouring to restrict the application of section 5 and I must differ with him for much the same reasons as before. Section 5 is aimed at deterring and criminalising hacking. The section is framed so that, as far as possible, only hackers in the accepted sense will be caught by it.
Let me remind the House that words do not always mean what one intends them to mean. First, they mean what the Judiciary say they mean and, secondly, they mean what we try to say they mean. I have heard a crossbow defined as a firearm in this House because it suited the framers of the law; under an amendment to the Firearms Act, the crossbow is defined as a firearm.
We say, as far as we can, that words mean what is intended by them but we cannot say our intention is good. I accept the Minister's intention is good and I am not suggesting there is some sort of totalitarian conspiracy going on in the Department of Justice to shut us all up. However, somebody is guilty of appallingly sloppy drafting and that appallingly sloppy drafting will make the Department of Justice and the Oireachtas look ridiculous when some sharp-eyed individual in the press or some other section of the media, in the legal profession or in the computer industry spots this and asks if we realise what we have done. There will be a huge rush then to pretend we did not mean what we actually said.
I accept the intention is to deal with people who improperly access data which may undermine security, interfere with an individual's privacy, with dealings in financial institutions, with a person's medical records and so on. We all accept that is what we would like to do. However, the argument is not about that and the Minister is hiding behind that argument; it is about whether the section, as it stands, will do that or more. This is a classic example of using a sledgehammer to crack a nut. There are other ways of dealing with this problem. For example, the section should deal with the operation of computers to gain access to data to which one has no legal right and not with the operation of computers with a view to accessing data. We will deal with that on a later section.
Under this section the only offence a person could be accused of is that of gaining access. For example, if I have lawful use of a computer belonging to a colleague, say, in the regional college and he then gains access to Wordstar, one of the word processing packages and is not a licensed user of that package under section 5 he is guilty of a criminal offence. He has gained access to data, he has used it, and is, therefore, in breach of the law. Until now the unauthorised use of commercial software was a civil offence which could be dealt with through the civil courts. It is not the copying of software that is illegal. The big white package in which discs are sealed states that the instructions should be read before opening the package and if they are not acceptable it should be returned. It specifies that it is for your use only, and it may not be supplied to other people. Multiple use of software must be authorised under a multiple use licence. Therefore, a person who gains access to software licensed to me on my computer is gaining access to data without lawful excuse, is in breach of copyright and because of the hamfisted drafting of this section is guilty of a criminal offence. That is what it means, regardless of the benevolence of the Minister's intention.
As I have already said, I am opposed to any restriction on the scope of section 5 and therefore I cannot accept the amendment.
I am accustomed to having reasonable discussion on amendments and having my queries adequately dealt with by the Minister. In standing up and repeating the same phrase over and over again the Minister is not dealing with the arguments. I have known the Minister for 20 years. I know he has good intentions and I do not want to spend the day arguing. However, I would like to know why he accepts this sloppily drafted section when there are so many holes and flaws in it.
Amendment put.
The committee divided: Tá, 16; Níl, 24.
Tá
- Cosgrave, Liam.
- Doyle, Avril.
- Harte, John.
- Hourigan, Richard V.
- Jackman, Mary.
- Kennedy, Patrick.
- McDonald, Charlie.
- Manning, Maurice.
- Neville, Daniel.
- Norris, David.
- Ó Foighil, Pól.
- O'Reilly, Joe.
- Raftery, Tom.
- Ross, Shane P.N.
- Ryan, Brendan.
- Ryan, John.
Níl
- Bohan, Eddie.
- Byrne, Hugh.
- Cullen, Martin.
- Dardis, John.
- Fallon, Sean.
- Farrell, Willie.
- Finneran, Michael.
- Fitzgerald, Tom.
- McGowan, Paddy.
- McKenna, Tony.
- Mullooly, Brian.
- O'Brien, Francis.
- Foley, Denis.
- Haughey, Seán F.
- Hussey, Thomas.
- Keogh, Helen.
- Kiely, Dan.
- Kiely, Rory.
- Lydon, Don.
- McCarthy, Seán.
- Ó Cuív, Éamon.
- O'Keeffe, Batt.
- Ormonde, Donal.
- Wright, G.V.
Tellers: Tá, Senators B. Ryan and Neville; Níl, Senators Wright and Fitzgerald.
Amendment declared lost.
Question proposed: "That section 5 stand part of the Bill."
I know what the Minister says section 5 means but let me explain the example I used last week which he eloquently said was not right. Somebody in the institution I work in goes into one of our two major micro-computer rooms with a disc in his pocket and operates a computer. Now he is not supposed to be there. He is doing nothing otherwise improper. He is going to play a game — he is a chess fanatic, he wants to practice his chess. We have a general embargo on games playing on our computers for reasons to do with the possibility of virus infection in computers. If he goes in without a lawful excuse and operates a computer, he will access the programme on the disc and he will direct the computer to run that disc, to run that programme. He does not have a lawful excuse, he is not supposed to be there and he is operating a computer with the intention of accessing the data on the disc, which is most assuredly within the State. That is a simple example and under this Bill — as far as I am concerned — he would be guilty of a criminal offence which is a ludicrous response to a minor breach of discipline.
I would like the Minister to explain to me in reasonably simple language — because I am not very bright — where I am going wrong on the section. I do not want him to tell me what he wants to do with the section, nor what we all agree about. I want him to tell me what is wrong with my thinking, if that is a criminal offence, may we have thousands of criminals running around all our third level institutions playing games, breaking the law and liable to end up in jail. Maybe that is the intention of the Bill, but I do not think it is. It is sloppy drafting. I would like to hear what is wrong with my thinking.
I support what Senator Ryan has said and go a little bit further, because Senator Ryan is addressing what would become a criminal offence under the legislation as envisaged, but there is a very wide civil liberties aspect to this. I would like to quote from the American experience in this area because, as I understand it, the legislation here is modelled very closely principally on British but also on some American models. There is a very useful and instructive article in the Scientific American of September 1991 that indicates just how this kind of legislation can be abused. I would like, with the permission of the House, to quote from it. This article relates to a man involved in making computer games and computer programmes, so there is a direct relevance to the whole question of computers.
On March 1, 1990, the US Secret Service raided the offices of Steve Jackson, an entrepreneurial publisher in Austin, Texas. Carrying a search warrant, the authorities confiscated computer hardware and software, the drafts of his about-to-be-released book and many business records of his company, Steve Jackson Games. They also seized the electronic bulletin-board system used by the publisher to communicate with customers and writers, thereby seizing all the private electronic mail on the system.
The Secret Service held some of the equipment and material for months, refusing to discuss their reasons for the raid. The publisher was forced to reconstruct his book from old manuscripts, to delay filling orders for it and to lay off half his staff. When the warrant application was finally unsealed months later, it was confirmed that the publisher was never suspected of any crime.
That seems to me to be a situation where damage was done to a company by the insensitive application of a law such as that contemplated under the present Bill. I would like to finish off by quoting another section from this article.
I do not think you can quote ad nauseam now.
The article read:
Law enforcement officers apparently became suspicious when a Steve Jackson Games employee — on his own time and on a BBS he ran from his house — made an innocuous comment about a public main protocol for transferring computer files called Kermit. In addition, officials claimed that at one time the employee had had on an electronic bulletin board a copy of Phrack, a widely disseminated electronic publication, that included information they believed to have been stolen from a Bell South computer.
Law enforcement officials interpreted these facts as unusual enough to justify not only a search and seizure at the employee's residence but also the search of Steve Jackson Games and the seizure of enough equipment to disrupt the business seriously.
Acting Chairman
I have to remind the Senator that we are on section 5. This is not a Second Stage debate.
With respect, what Senator Norris is talking about is precisely relevant to section 5. If he had raised it on Second Stage I think the Chair, legitimately, would have reminded him that it was a matter for committee Stage.
Acting Chairman
We could be here all evening quoting from different publications——
In fact, we will not because I am almost at the end of this quotation. It illustrates a particular point.
Among the items confiscated were all the hard copies and electronically stored copies of the manuscript of a rule book for a role-playing game called GURPS Cyber-Punk in which inhabitants of the so-called cyberspace invade corporate and government computer systems and steal sensitive data. Law enforcement agents regarded the book, in the words of one, as "a handbook for computer crime".
The Minister, in his speech yesterday, referred to this kind of book and actually saw it as the object of fairly deep suspicion. I will quote one final paragraph:
A basic knowledge of the kinds of computer intrusion that are technically possible would have enabled the agents to see that GURPS Cyber-Punk was nothing more than a science fiction creation and that the Kermit was simply a legal, frequently used computer programme. Unfortunately, the agents assigned to investigate computer crime did not know what — if anything — was evidence of criminal activity. Therefore, they intruded on a small business without a reasonable basis for believing that a crime had been committed and conducted a search and seizure without looking for "particular" evidence, in violation of the Fourth Amendment of the Constitution.
This is precisely the kind of difficulty this legislation may pose. I accept it was rather a lengthy quotation, I am grateful for the Chair's indulgence, but I think it makes a very important point. It goes further than what Senator Ryan was saying because it indicates that the law may be abused in a kind of trawling expedition which may clearly damage a company. I have given an instance of a case in which a business was damaged under parallel legislation. The Bill itself, and particularly this section, could inflict commercial damage.
I will try to deal with a number of the points that have been raised. First, let me say that there are three ingredients in the offence we are talking about and all of them must be present before it is committed. First, at least one computer must be used. For example, an employee could take home with him a disc containing data he was not authorised to access, and access the data by inserting the disc in his own computer. An outsider hacker will operate both his own and the target computer or computers.
Second, there must be no lawful excuse. In other words, the person operating the computer must not believe that he or she has the necessary authority or consent to do so or that he could get it retrospectively. This is provided for in section 6 (2). Third, the person must operate the computer with intent to access data. The offence will not be committed by someone who gains access to data simply because he is incompetent or careless or has not been properly informed about the limits of his authority. It will also not be committed by a person whose intention in operating a computer is, as one Senator said, to play a game on it.
Why not?
It is essential for the successful prosecution under section 5 to prove that each of the foregoing ingredients of the offence has been established beyond all reasonable doubt. Therefore, a person whose intention it is to play a game on a computer does not satisfy the key condition necessary to establish a basis for such a prosecution. That is not to say that the use of an organisation's computer by a student for such purposes may not be as serious as using it for, say, penetrating records of examination results before they are published.
The software for such games could undermine the integrity of the main computer. I also mentioned in the previous debate that there are many viruses being introduced in this way and causing serious damage not only to the computer but also to any other outside systems to which it is connected. While section 5 does not make it an offence to play games on another's computer without authority so long as that is the sole object of the operation, I do not want to minimise the possibility of unwittingly causing damage by such a practice.
To return to the amendments, I think the House will agree that any form of hacking, whether or not it is confined to non-sensitive data, should be deterred. For this reason I cannot go along with the Senator's amendments.
Section 5 is being criticised on the grounds that it is too blunt an instrument to deal with hacking. It is said that it makes no distinction between major and minor penetrations of computer systems or between access to sensitive and nonsensitive data and so on. It is also said it will cause problems in the workplace by criminalising access by employees to data which they are not authorised to access. It has even been said in the course of this debate that it will cause problems for a person sitting down to type a letter on a word processor. I think the fears about this section are exaggerated and I hope I have demonstrated that in this and in my previous replies in the course of this debate.
On Second Stage it was said that we should not have put an anti-hacking provision as in section 5 into this Bill but that, as in the UK, we should have had a separate Bill to deal with the problem. The fact is that the UK Computer Misuse Act of 1990 deals with the hacking problem in the very same way as section 5 in this Bill deals with it. The wording may be somewhat different but the ingredients of the offence are essentially those set out in section 5. The access to data must be by operation of a computer, it must be unauthorised and there must be an intent to secure access to any data held in any computer. The fact is that none of the fears expressed here by some Senators have been realised in the UK under their Computer Misuse Act, 1990. I suggest respectfully, to the House that the position is exactly the same here as it is in the experience of the UK Act.
I accept that the Minister is trying to be helpful. If somebody sits down at my computer and uses a software package that is licensed to me only to write a letter he has no lawful excuse because I cannot give him permission. Any competent professional knows the law about copyright of computer software. I cannot give him permission and he cannot believe I could give him permission. I would have to transfer the licence. The package on commercial software discs indicates that it is licensed to one person, a named individual. If I tell that person he can use my computer and he uses software that is licensed to me to write a letter, he is without lawful excuse and has used a computer to gain access to data, because data includes a programme in this case. He is in breach of this legislation.
I cannot understand how the Minister can say because he does not want it to be like that, therefore it never will be so. The language in this section is remarkably clear. It is remarkably general and excessive but it is also remarkably clear. There can be no argument about it. How could that person not be in breach of the law? He has used one computer. He had no lawful excuse and intended to gain access to data. If the Minister has not included the concept of a programme in the definition of data he might have a point, but section 2 defines data as including a programme. Computer hacking tends to be about gaining access to information, not about gaining access to programmes. What we have here is a definition of information which includes a programme. Therefore, anybody who uses my computer to gain access to software that is licensed to me alone is, without excuse, operating a computer to gain access to data. That, according to legislation, is a criminal offence. That is not computer hacking in any sense of the word.
Equally, a game is a programme, and a programme is data, according to the Bill. "Data" includes a programme, therefore it also includes a game. To play a game is to operate a computer without lawful excuse to gain access to the data which is in the programme. According to the Bill, this is an offence even if there is no question of damage occurring. The Minister has still not explained the position. Most of what Margaret Thatcher did in the area of legislation on information over the past 12 years was restrictive, repressive and secretative and I am not surprised at the wording of the British legislation. She was not particularly keen on the freedom of the individual. She did her best to make sure the press lined up firmly behind her, by looking after her friends as they bought up more and more of the newspapers. Let the Minister not quote to me Margaret Thatcher's legislation about access to information. If you substitute the word "printing press" for "computer" and think about it, you can see what is involved.
Essentially this Bill says you have to think twice about using a computer. It becomes quite ludicrous in section 6 (2) (b) under which a person is entitled to consent to or authorise access to the data concerned. Surely we can think of a better way of saying that an individual has the right to use a computer as he is entitled to do with software he is entitled to use, other than to say that it is a criminal offence unless he has a lawful excuse, unless he actually gives himself consent. Given the definition of "data" as including a programme, I invite the Minister to explain why it is not a breach of this section to run a computer, without permission, to access a programme.
I support what Senator Ryan has said. I referred yesterday to the question of the definition of data as including programme, but it was rather brushed aside. I can almost predict what the Minister will say: there are three requirements for the commission of an offence. This has been the standard response. One of the difficulties the Minister faces is that the legal instruments have not caught up with a very rapidly changing technology. We are using a 19th or early 20th century concept of law which is suitable for dealing with tangible things in terms of information exchange and technology, such as a letter or a telegram, but we are not dealing with such things at the moment. We are dealing with an extremely complex system where sometimes even the source or control of the information may be unclear at the point of the terminal.
May I quote one paragraph from an article entitled "Common Law for the Electronic Frontier" by Anne W. Branscomb in the Scientific American, which indicates very clearly and succinctly the source of the difficulties in this kind of legislation. Dr. Branscomb is a communications lawyer at the Harvard University. Under the heading, “Programme on Information Resources Policy” she says:
The ease with which electronic impulses can be manipulated, modified and erased is hostile to a deliberate legal system that arose in an era of tangible things and relies on documentary evidence to validate transactions, incriminate miscreants and affirm contractual relations. What have been traditionally known as letters, journals, photographs, conversations, videotapes, audiotapes and books merge into a single stream of undifferentiated electronic impulses.
First, let me say that this is a criminal statute and it must be construed strictly. If a person accessing data can show that his intention is to play a game or to get money, or a bank statement or something similar, there is no possibility of a successful prosecution. The defendant must always have the benefit of the doubt.
On the copyright question, I want to make two points. One cannot interpret what may be decided by a court in a particular case but I see no reason why accessing a copyright programme should not be an offence. Unauthorised use of computers must be treated seriously. I have been almost accused here of not replying to specific questions raised. One of them involved a comparison with the UK practice and laws. When I use the comparison with the UK I am lectured. We cannot have it both ways. It is necessary to include computer program in the definition of data, because hackers are accessing programs and operating them. The object of the section is to make all forms of hacking an offence.
This is getting a bit tiresome. Where, in section 5, is there any room for discretion on the part of the courts on the grounds that the person was only playing a game? It refers to a person who, without lawful excuse, operates a computer to gain access to data. It does not say it has to be important or sensitive data, or that it must belong to somebody else. If it did, I would not be here arguing with the Minister. The Bill would have gone through hours ago.
The Minister is saying that, somehow, some benevolent person, who is not defined, would decide that because an individual did not really intend to do what we wanted in this Bill to prevent him doing, he will not be guilty of an offence. That is sloppy legislation. We are just hoping nobody will be prosecuted for the things we do not want them to be prosecuted for. Where in the section does it exclude actions which are not malicious such as trying to play a game? The section says if you do not have an excuse and you use a computer to gain access to data or to even try to gain access to it, you are guilty of an offence. If you try to play a game on a computer you are not supposed to be using, you are guilty of a criminal offence. We are not discussing the problem of viruses.
Computer hacking is a serious offence and is likely to remain so. In fact, the whole area of computer security is one of the great areas of concern for the future of information systems generally. It is difficult to visualise total security ever for computerised records, particularly when data is going to be transmitted through a variety of ways. Unauthorised access cannot be physically prevented as easily as it would have been with other forms of data, but it is not sufficient for the Minister to say, "We do not mean people like that to be prosecuted" in relation to those who are merely playing games. This type of problem has come up before on legislation in this House and people have ended up being prosecuted under measures where the intent of the Minister introducing the legislation was quite different. It happened under the Offences Against the State Act and The Forcible Entry and Occupation Act.
We also have the ridiculous situation of crossbows being defined as firearms. Now the position is that if you play a game on a computer when you are not supposed to, it is a criminal offence. The Minister can say he does not want people to be prosecuted for doing that. He can accept that none of us do. It is innocent use but the fact remains that, if somebody uses my computer to operate software he is not entitled to use, not being licensed to use it, he is not only in breach of copyright, but now, ludicrously, guilty of a criminal offence. The Bill should be written in better English. It is ludicrous.
May I just briefly concur with what Senator Ryan has said? I do not see anything about intentionality in this section. It would be a very difficult concept to prove anyway. If I can refer again to a general proposition regarding this section, I think the difficulty is, as I said yesterday, that you are introducing extraneous material into a Criminal Damage Bill. The introduction of all this stuff about computer hacking, which is a serious problem, is inappropriate in a Criminal Damage Bill. We know this Bill is modelled on the British legislation.
Which part?
The whole thing. The Minister has put his finger on precisely the point I was going to make. There are two sources in British legislation. The first, for the majority of the Bill, is the Criminal Damage Act, 1971, which deals with criminal damage and nothing else. The other source — the source of this section — is the Computer Misuse Act, 1990, which was produced after two reports. There was the Law Commissioners Report, No. 186, Computer Misuse, published in October 1989 and there was the report on computer crime published by the Scottish Law Commission, No. 106. The British have two reports and separate, detailed, exhaustively researched legislation, and here we have the identical word for word British legislation with a section on computer hacking tacked on. That is where the problems arise.
I want to record my support for the previous speakers. Section 5 says: A person who without lawful excuse operates a computer ... shall ... be guilty of an offence and shall be liable on summary conviction to a fine not exceeding £500 or three months imprisonment ... You cannot interpret it any other way than as it is stated in that Bill. I want to express my concern that sanctions other than imprisonment were not considered in this section. It would have been progressive legislation to look at areas other than a sentence of two or three months in prison as sanction for people who have carried out unauthorised accessing of data.
I think the Minister is hanging on to the phrase "access any data". Let me say clearly that you cannot operate a computer to do anything without the computer and you accessing the data. If you run a game on a computer the procedure is that the computer reads the game, which is a programme, which is data under the Act, and gains access to that data for you. Then you do something with it, you run the programme, but before you run a programme you have to gain access to it. You cannot run a programme that you have not accessed. If it is not there, you cannot run it; you have to access it first. The first thing you do before you run any programme, whether it be a word processing package or a simple shoot-him up children's arcade game, is to access the data, which is then processed by the computer to do something. You cannot run a computer to do anything without first accessing data. It accesses the data first and after that the computer does something else. The sequence of time may be quite short. However, the wording of this Bill says that the offence of operating a computer without lawful excuse to access data will be committed any time anybody runs a computer programme, because to run a programme you have to access the data, which is the programme, first. That is as explicit as I can be.
I have explained at length why a prosecution is not realistic unless the three ingredients of the offence are satisfied. For successful application the State must prove there was an intent to access data, and prove it beyond all reasonable doubt. I am quite satisfied that the wording in section 5 of this Bill is sufficient and that it safeguards what we want to guard against here, that is, the hacking of computers. This section must be dealt with in that context. We must realise that any weakening of the section by amendments such as those I have before me would weaken the determination to eliminate hacking as far as possible and to make it a crime. I am satisfied that the wording of this section is satisfactory in that respect.
The Minister says it would be difficult to prove. There could be nothing simpler than saying I saw X stick a disc into the disc drive on that computer and switch it on. By definition, by doing that, if they have no business operating that computer they have quite clearly operated the computer without lawful excuse to gain access to data. It could not be simpler. The computer can do nothing else. That means that anybody who uses a computer they are not supposed to use for one reason or another — not necessarily written down in this law — who has no lawful excuse to do so, is in breach of the criminal law by simply sticking a disc into the disc drive and typing "go" or whatever the word is. The Minister is now, I think, getting to the stage of accepting this.
Let me put this a different way. Suppose we had problems about people gaining access to Government information other than on computers and we wrote a section which said that any person who, without lawful excuse read a book which contained sensitive information was committing an offence, we would scream "Censorship", and quite rightly. The idea that you would use a scatter gun on all written information to prevent people getting their hands on information that is not legally their property would be regarded as an affront to people's liberty. We would never say, because we do not want people to be able to gain access to sensitive Government data or sensitive commercial data, that they could not read anything unless they had a lawful excuse to do so. That is, effectively, what we are doing here. We are saying that, other than where you have a lawful excuse, "to do anything is a criminal offence"— not just to look for other people's data, not just to pry into other people's privacy, but simply to use a computer to do anything where you do not have a lawful excuse is a criminal offence. If that is what the Minister wants, so be it; but it is quite ludicrous.
Question put.
The Committee divided: Tá, 28; Níl, 14.
Tá
- Bennett, Olga.
- Bohan, Eddie.
- Byrne, Hugh.
- Byrne, Sean.
- Cassidy, Donie.
- Dardis, John.
- Fallon, Sean.
- Farrell, Willie.
- Lanigan, Michael.
- Lydon, Don.
- McCarthy, Seán.
- McGowan, Paddy.
- McKenna, Tony.
- Mooney, Paschal.
- Finneran, Michael.
- Fitzgerald, Tom.
- Foley, Denis.
- Haughey, Seán F.
- Hussey, Thomas.
- Keogh, Helen.
- Kiely, Dan.
- Kiely, Rory.
- Mullooly, Brian.
- O'Brien, Francis.
- Ó Cuív, Eamon.
- O'Keeffe, Batt.
- Ormonde, Donal.
- Wright, G.V.
Níl
- Cosgrave, Liam.
- Doyle, Avril.
- Hourigan, Richard V.
- Jackman, Mary.
- Kennedy, Patrick.
- McDonald, Charlie.
- Manning, Maurice.
- Neville, Daniel.
- Norris, David.
- Ó Foighil, Pól.
- O'Reilly, Joe.
- Raftery, Tom.
- Ross, Shane P.N.
- Ryan, Brendan.
Tellers: Tá, Senators Wright and Fitzgerald; Níl, Senators B. Ryan and Norris.
Question declared carried.
Section 6 agreed to.
SECTION 7.
Amendment No. 8 was discussed with amendment No. 4.
Amendment No. 8 not moved.
Section 7 agreed to.
Section 8 agreed to.
SECTION 9.
I move amendment No. 8a:
In page 8, lines 32 to 36, to delete subsection (3) and substitute the following new subsection:
"(3) The Court, in making a compensation order, may require that the owner of the property concerned be made known and that the approximate cost of making good the damage to the property (or where appropriate, of replacing it) be made available to the Court."
The purpose of this amendment is to allow discretion to the courts if at the time of the hearing either the party who has been injured is not known or the cost of the damage is not readily available. I think this is in line with what the Minister has already said about having an open type of legislation which does not confine the courts in any way. The present section states:
A compensation order shall not be made unless both the injured party concerned and the approximate cost of making good the damage to it ... are readily ascertainable ...
We suggest in the amendment that the court in making a compensation order may require that the owner of the property concerned be made known — in other words, allow discretion to the courts as to whether they request the name of the owner and the approximate cost of making good the damage to the property to be made available to the court. This would allow a situation where the courts could come back at a later stage when the name of the injured party is known and then make a compensatory order to them and likewise with regard to the approximate cost of making good the damage. If that information is not available to the court at the time then the court could come back and make the order on the basis of a figure calculated at a date later than the court hearing.
This amendment was discussed at length in the other House on Report Stage and the Minister for Justice undertook to look at it again before the Bill was taken in the Seanad. It was conceded on that occasion that an official amendment to section 9 (3) had gone some way towards meeting the point of view expressed in the amendment we are now discussing. Section 9 (3), as it now stands, is one of a number of guidelines to be followed by the court once it has decided that the case before it is one where it would be appropriate to make a compensation order. It seeks to ensure that before a compensation order is made both the injured party and the approximate cost of making good the damage are readily ascertainable.
This, in my view, is a reasonable guideline to impose. We want to ensure that before any compensation is paid over it will go to the right person; and we want the amount of the compensation to be a reasonable approximation of the cost of the damage so that the injured party will be compensated where the convicted person can afford it. In the ordinary way a court convicting a person for malicious damage will know from the evidence in the case who the injured party is and what the cost of the damage is. The injured party will have made a statement to the Garda and will usually have said what the damage amounts to. Apart from that, the court from its experience of that type of offence and exercising its commonsense will have a good idea of the approximate cost.
However, to cover a case where the court is not in a position to determine at the time of the conviction who the injured party is or the approximate cost of the damage, section 9 (3) was amended in the other House to make it clear that the court, where it had decided to make a compensation order, could in effect adjourn the case and make the order within a reasonable period after the conviction during which the necessary particulars could be ascertained. I think the subsection, as amended, does meet the concerns that were expressed in the other House and here again on this amendment. It will enable the courts to award compensation even where the injured party or the cost of the damage are not readily ascertainable at the time of the conviction so long as the information becomes available within a reasonable time afterwards.
Amendment, by leave, withdrawn.
Section 9 agreed to.
NEW SECTION.
Amendments Nos. 9 and 10 in the name of Senator Costello. Presumbly they are not being moved?
I do not think I am in order to move it unless I have the permission of Senator Costello.
Acting Chairman
Unless the Senator has been authorised to move the amendment, I cannot permit him to do so.
I am not authorised.
Amendment No. 9 not moved.
SECTION 10.
Amendment No. 10 not moved.
Question proposed: "That section 10 stand part of the Bill."
I wish to make a point for the benefit of Members who have an interest in it. The point of the amendment that is not being moved was met in a redraft of subsection (4) of section 10, which was substituted by an official amendment in the other House.
Question put and agreed to.
Section 11 agreed to.
SECTION 12.
Amendment No. 11 not moved.
Section 12 agreed to.
SECTION 13.
Acting Chairman
Amendment No. 12 is a Government amendment and I understand that, subsequent to this amendment being tabled, Senator Costello tabled a similar amendment. Amendment No. 14 is consequential on amendment No. 12 and both may be discussed together.
Government amendment No. 12:
In page 11, subsection (1), line 42, to delete "justice" and substitute "judge".
This amendment and amendment No. 14 are drafting amendments. They reflect the fact that since this Bill was published the Courts Act, 1991, provided that justices of the District Court are to be referred to as judges of that court.
Amendment agreed to.
Amendment No. 13 not moved.
Government amendment No. 14:
In page 12, subsection (1), line 5, to delete "justice" and substitute "judge".
Amendment agreed to.
Section 13, as amendment, agreed to.
Section 14 to 16, inclusive, agreed to.
Title agreed to.
Bill reported with amendments.
Acting Chairman
I understand there is an amendment on Report Stage and in order for this amendment to be introduced, I will adjourn the House for 15 minutes.
Sitting suspended at 5.30 p.m. and resumed at 5.45 p.m.