It isn’t illegal to hack into Web sites in New Zealand.“My understanding is you can be sued through civil action for a number of offences, but not hacking itself,” says Reg Hammond, manager of IT policy for the Ministry of Commerce. He believes that while hackers can be sued for trespass, vandalism or theft as appropriate, hacking isn’t covered by law.
But Ken Moon, a partner with law firm AJ Park and Son, believes the law doesn’t even go that far. Any cyber crime, he believes, will be hard to prosecute.
“Trespass comes into law in two ways — criminal and civil action.” Criminal trespass is treated lightly, says Moon, on a par with loitering. It is also very specific in its intent.
“It only makes it a crime to trespass in specific instances, like on a ship or in the yard of somebody’s business.” Even then, trespass is only a crime if another crime is also being committed, like breaking and entering.
“If you just want to be nosy you’re not guilty of an offence.” Moon says suing directly in civil court also has its difficulties because the law refers directly to trespassing on land or personal property.
“Intellectual property is considered too intangible to be property,” says Moon. According to Moon, even if an intruder causes damage by deleting files or modifying data, that still wouldn’t qualify as criminal damage. “They would have to damage the hardware itself for it to be considered criminal damage and that’s pretty unlikely.” Even theft itself is an unlikely candidate.
“If somebody got your information and made use of it for themselves that still isn’t ‘real’ theft. You can’t seize information because it’s not property.”
One man with a vested interest in the issue of hacking and the law is National Business Review network manager, Graeme Colman. He is currently drafting a letter to the Minister of Justice, Doug Graham, about the issue following an unsuccessful attempt to break into the NBR’s Web site.
“I want to see where [Graham] stands on the issue of trespass with regards to Web sites and the like,” says Colman, who believes New Zealand needs laws governing cyberspace in particular rather than having laws designed for other areas adapted to fit the electronic model.
The 1989 Crimes Bill was introduced to revamp the existing Crimes Act. It included three clauses related directly to cyber-crime but it did not address the issue of hacking into a Web site but doing no damage. The bill was rejected because of issues over other clauses, and an attempt to introduce just the clauses relating to cyber-crime failed as well.
In 1990 Britain introduced the Computer Misuse Act which included a clause outlawing unauthorised access, regardless of whether damage was caused. Moon says that before the law was enacted several hacker prosecutions were thrown out, but since then a number have been successful.
Neither the government nor the opposition have plans to introduce a cyber-crime bill in the foreseeable future.