The UK government has said it wants to hand out life sentences to anyone found guilty of a cyberattack that has a catastrophic effect, under plans announced in the Queens speech. Any hackers that manage to carry out cyberattacks which result in loss of life, serious illness or injury or serious damage to national security, or a significant risk thereof would face the full life sentence, according to the serious crime bill proposed in Wednesdays Queens speech. As well as targeting cyberterrorists, the new offence in the proposed update to the Computer Misuse Act 1990 would also hand harsher sentences to those hackers carrying out industrial espionage, believed to be a growing menace affecting UK business. The law would have a maximum sentence of 14 years for attacks that create a significant risk of severe economic or environmental damage or social disruption. Currently, the section of the CMA covering such an offence carries a 10-year sentence. Jim Killock, executive director of the Open Rights Group, said the bill would be difficult to justify, given current laws already carry punishments for those who carry out significant acts of terrorism, whether via computers or other means. If a supposed cyberterrorist endangers life or property, there are existing laws that can be used to prosecute them, Killock said. Such acts have only been seen in Hollywood movies, said Mustafa Al-Bassam, a computer science student who was convicted under the CMA for his participation in cyberattacks on companies as part of the hacktivist collective LulzSec. The government has also not addressed complaints over the application of current computer crime law, which some in the security industry claim actually makes the internet less safe. This is because certain kinds of research could be deemed illegal. Experts known as penetration testers, who look for weaknesses in internet infrastructure, often carry out similar actions to real cybercriminals in their attempts to improve the security of the web, such as scanning for vulnerabilities. But such research is punishable under British law, even if it is carried out for altruistic ends, leaving potential weaknesses unresolved, critics of the CMA said. Any researchers looking for the recent Heartbleed bug, which left a vast number of websites open to attack, could have been charged under British hacking laws, said Trey Ford, global security strategist at penetration testing firm Rapid7. Its concerning that the law designed to protect people from cybercrime also penalises activity designed to identify areas of cyber risk, he said. There are similar fears over in the US, where researchers recently told the Guardian they had been threatened with indictment for their own security tests. Yet some have been encouraged by the wording of the serious crime bill, which noted the update to the CMA would ensure sentences for attacks on computer systems fully reflect the damage they cause. Its good to see government trying to be proactive to put specific law enforcement tools in place before theyre needed, but they should be careful to not accidentally criminalise good faith efforts, said Beau Woods, a security expert from the digital public safety organisation I Am The Cavalry. Simon Placks, head of cybercrime investigations at consultancy EY, added: Any move towards tougher sentencing for cybercriminals is a move in the right direction, and will be welcomed by businesses. Read the story over at the Guardian website:
Posted on: Thu, 05 Jun 2014 07:21:44 +0000