Slashdot Mirror
Breaching an AUP a Crime In Western Australia
An anonymous reader writes "A recent court case highlights that breaching an acceptable use policy at work could land you in court in Western Australia: a police officer doing a search of the police database for a friend was fined — not for disclosing confidential police information, but for unlawful use of a 'restricted-access computer system' — cracking. More worryingly for West Australians, this legal blog points out that breaching any Acceptable Use Policy would seem to be enough to land you in jail for cracking — for example, using your internet connection to break copyright."
I'm authorized to use the computer at work to search through medial records (I'm an Pharm.D), but I can get in trouble (and fined) for searching HIPAA records without cause.
So far, the courts in the U.S. have ruled against such an idea, because in effect it would let companies define the law for themselves, at whim.
It's no different than having access to a system tied into say patient records. There's no need or reason for you to go looking at information on someone else who you aren't treating or don't have permission to look at (for example in the US you have to sign papers for doctors to transfer your medical records etc to another doctors office).
I think the article is extrapolating something to include everything, where it shouldn't
When your job is to uphold the law, it is a bad idea to organize the conspiracy.
By default you have privacy and property ownership: the Wireless Telegraphy Act in the UK, for example, doesn't let you intercept messages without the consent of the sender. Just because it's "on the Internet", laws don't suddenly stop applying. So, unless your contract stipulates otherwise, standard laws apply - and the AUP specifies the limit on what you're allowed to do with someone else's system. Make sense?
to prison for violating an EULA...
For justice, we must go to Don Corleone
TFA says right off the bat that in the case in question, Giles v Douglas, was charged under a CRIMINAL statute. Giles was granted special permission under certain specific conditions to use the police database. She did not adhere to those conditions and thus her use of the database was impermissible. Impermissible use of the database is a criminal offence (instance of s440). There's nothing special about this case.
Breaching the AUP is not a crime. Breaching the AUP in a manner that leads to committing a crime is also not a crime. BUT COMMITTING A CRIME IS A CRIME! It just so happens that an AUP is involved in the details of this case.
Don't go to bed with no price on your head
No no don't do it
Don't do the crime if you can't do the time
Yeah don't do it
And keep your eye on the sparrow
When the going gets narrow
Don't do it
Don't do it
Where can I go where the cold winds don't blow
Now !!
Now is that really so hard ?? Instead of asking, why do THEY make this illegal, ask, why am I doing this illegal act !! Then tell yourself, don't do it !! Easy !! Simple !!
Good thing Clear isn't in Australia. Get thrown in jail for using more than 7 GB a month is a bitch.
restricted-access computer system means a computer system in respect of which —
(a) the use of a password is necessary in order to obtain access to information stored in the system or to operate the system in some other way; and
(b) the person who is entitled to control the use of the system —
(i) has withheld knowledge of the password, or the means of producing it, from all other persons; or
(ii) has taken steps to restrict knowledge of the password, or the means of producing it, to a particular authorised person or class of authorised person;
The definition of 'restricted-access computer system'. My interpretation of this, is that a police database would fall under this, but an internet connection would not. But the law isn't worded very well. It seems it was added in 1990, and written by someone with little understanding of computers.
So using a system you already have access to but not following workplace policy is cracking? You sound like one of those people who refuses to have a bank account and then wonders why nobody will hire you.
Only the State obtains its revenue by coercion. - Murray Rothbard
There is an easy fix for that.
Citizens of the world should establish and join an organization, which would create it's own Acceptable Use Policy, when other organizations, including corporations, etc. are dealing with their members.
If corporations and other organizations are entitled to create and legally enforce "Acceptable Use Policies", most certainly citizens, consumers should have the same right.
Transfers the cost to the taxpayers, and makes fishing expeditions pretty painless, and zero risk, for the companies doing it.
---- Booth was a patriot ----
Yesterday I told you I thought the stuxnet was a false flag op. Today it's proven.
It would sure be nice if all you slashdot heads took a break from compiling your latest kernels, and stop towing the establishment agenda.
Elections - abused by electronics - /.'ers poo poo it. /.'ers poo poo it.
Spying - abused by fios splitters -
HFT - poo poo
Stuxnet - The Protecting Cyberspace as a National Asset Act of 2010 + Internet ID
The dirty secret is if elections can be manipulated, so can fighter aircraft, space craft, nuclear reactors, os's, and the monetary system itself
Quit saying this stuff is okay. It's fucking not okay! It's treasonous! Wake the fuck up!
Congratulations, you've formulated a bullshit fix to a problem that doesn't even exist. RTFA.
Another misuse of the "Your Rights Online" tag and there are already a metric crap-tonne of morons saying that this is awful. It's a blog post that completely misses the fucking point. If wikileaks had reported that Australian police were allowed to look up information on citizens without a valid reason (i.e. for shits and giggles) everyone would be up in arms saying, "Isn't this terrible?". This isn't just a breach of an Acceptable Use Policy, it's against the law, for some very fucking good reasons. There are laws and procedures in place to stop simple invasions of privacy (like this) but also to stop criminals from bribing corrupt Police Officers to look up information for them.
People: We demand fair treatment! ...
Corporations: Then we won't do business with you.
People: Fine! We don't need you.
Corporations:
People: I miss facebook. And my mobile phone won't work. And I want to see the next episode of House.
Corporations: Sign the agreement.
People: Oh... you win.
The people who searched Obama's student loan info during his campaign got in a lot of trouble. They all lost their jobs and I think got probation. How is what the cop did any different?
Most companies of any decent size or who work with a company of any decent size have an AUP that makes it pretty clear that you can only access data on the company's systems for your job duties and not for anything else. If you violate that AUP you are aware it is wrong and should face the consequences. If you're lucky you'll only lose your job, but in serious cases I think you should face jail time. For instance if you looked up an address for a friend's ex-wife, it might be to send her money he owes her like he claims, or it could be because he wants to murder her...
In the United States (or at least in Florida, where I work) police databases are privileged information. Police officers are only allowed to access them when actively investigating crimes or civil infractions of the law. The public can only access scrubbed versions which redact private information like social security numbers and home addresses.
Illicit access, irregardless of disclosure, is a third degree felony under Florida law.
Then again, in our system specific databases are covered by specific criminal laws, so there's probably a difference between our system and this particular Australian incident.
If i don't like the colour of your fence i can take you to court over it. Doesn't mean i'll necessarily win.
I think this is far more reasonable than the cases in the US of people for example taking people to court for burning themselves on coffee because it wasn't labelled as hot, and WINNING.
If you abuse your authority to access private information, or breach terms of use that you signed then it SHOULD be legitimate for the provider to take you to court over it. If you disagree with terms of use, don't sign them.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
This situation is quite common.
It is illegal for Government Officers (in Oz and probably elsewhere) to use a Government Data Base for anything outside their authorisation. Like searching for a friends address.
The logs are kept and frequently analysed.
Aww shit, I live in WA.. this is kinda scary, thinking they could jail my ass for ripping copyright songs. >.> (but there IS a fair use clause.. erm)
The headline should read "Breaching a Police Database a Crime in all of Western World". The article is pure idiocy, only matched by your "solution" to this nonexistent problem.
Don't use your Internet connection to violate copyright, then you won't be susceptible to either civil or criminal charges.
Break out of the media consumption cycle and you'll have more time for things that actually matter.
I worked for WAPol (West Australian Police) up until 3 years ago (almost to the day! 3 Years and four days), and the police make it very clear to their employees that they aren't allowed to use the Police Database etc for looking up info that isn't related to a case they're working on.
It's not considered 'cracking' either. Unlawful use just means the person was using it for something other than their work, and when you have the sort of information the police database has on people you will know why you can't use it for personal, friends or family use. I have a vague recollection of an officer who got into trouble years ago for looking up information on his ex-partner and her new boyfriend. I also have a recollection of a lot of police officers getting in trouble for looking up a notorious criminals details when they had nothing to do with his case.
The summary/article is spreading FUD concerning something which has been the case for many, many years, and any Police employee (whether an officer or not) knows the consequences of.
It would be interesting to know what sort of information the officer was getting for their friend. "Doing a search of the police database for a friend' sound harmless enough till you put it into context of the information that's available. It's not like they were searching a dating service database for harmless info on what people like to do on dates or something, the officer was searching something with criminal records, peoples locations/addresses/phone numbers etc. and information you wouldn't want to be getting around, especially if you're trying to start a new life after screwing up badly, or if you're wanted by a gang for informing on them, or if you're in hiding from your ex-partner who you have an AVO against. This sort of information is dynamite against anyone and that's why it's restricted and pretty well monitored for who is accessing what. The 'friend' would only have asked for this info if it was stuff they couldn't obtain through a legitimate source, and if they can't get it legitimately then you wonder what sort of information they are after. On top of that, the officer involved would have known the risks involved, because they pretty much drum it into you that you can't access the database for anything other than a case you're working on, so what was so important that the officer felt they could risk their job for?
Sure enough, the cow costume was hanging up next to the superhero outfit and sailors uniform. (S,Spud)
But the law as written isn't just for police or even just public servants. It applies to anyone accessing any computer system (even those they have access to, like a forum) that requires a password and doing something outside the terms of the AUP of that system. Nothing in the way that the law is written applies to accessing confidential information, just to breaching the AUP of the system.
The fact that a police officer was charged (and convicted) under this law seems to be occupying everyone's attention, but outside of this specific case (which just provides precedent) look at the breadth of how it could apply.
When they came for the communists, I said "He's next door. Take him away. Goddam commies."
That's illegal in Sweden too and probably the most common reason for police to get fired, and sentenced, and that's a good thing. I don't want nosy policeofficers to look up their neighbours, boyfriends or such
Nothing in the way that the law is written applies to accessing confidential information, ...
The law specifically covers unlawful access. This is not necessarily CRACKING as the article claims:
she was convicted for common cracking
. She was actually convicted for using the system beyond her authority.
This law goes both ways. The police cannot come to your house and go through your computers without a warrant. If they do turn up and start accessing your computers without a warrant and without your permission you can sue them under the same law.
WA Pol have an AUP which is specifically designed to cover the illegal and unauthorised use of their system for confidential / classified material etc. It is there to protect people from officers using it illegally to get information that can be used to black mail people, or other illegal activities, etc.
If you read the conviction it specifically says:
17 It was common ground before the magistrate that the unlawful use in this case was in s 440A(2)(b).
ie she used it beyond what she was authorised to use it. The proof of this was in her emails
'Chucky, Kiralee just rings. Give me her name and date of birth, and I'll look up the IR and send you the information you need to contact the kids. So this is a point where she hasn't made any investigations at all. The first correspondence is, 'Give me the details and I will send you the name and address.' So at that point of time she can't have had any, shall we say, concerns, one would think, about - she wasn't aware, hadn't done any investigations, she was just told obviously from that, that he wanted to find out the location of the children, and she said, 'Yeah, sure. Give me the information, name and address, and I'll find it for you.'
In other words, she was going to give this guy the info he wanted and if you read on you find out that he hadn't even told her at this stage that he'd heard his wife had died. He'd just asked for his kids address, and she was going to look it up and give it to him.
So at that point of time, she did not have any of that information, because she hasn't accessed it, and the primary purpose, in my view, was to locate where the children are so that he could get the children back.
As I said previously, the police drum this information into you that you're not allowed to access this sort of info for personal use. In this case it was very obvious it was for personal use. I think the judge got it right that she knew she was accessing this information and she wasn't authorised to do so.
Now, imagine that the guys wife was still alive and the guy wanted this information in order to go kill his wife and kids. That's the reason police have strict protocols to follow etc. If something had of happened slashdot would be whinging the police and the judiciary system didn't follow the law and were to blame.
Now, looking at the breadth at which it applies, it means that no one, not even the police are allowed onto my or your (or anyone else's) systems without a warrant or the owners specific permissions.
As far as systems that people use are concerned, such as forums, social networks etc, if someone was to crack slashdot in order to get everyones personal information, under this law they can be persecuted. Such as the guy who recently did it for Facebook looking for girls nude pictures.
If someone invents an AUP that's so convoluted that it makes it impossible to use their site, it is pretty much the same as them refusing you access anyway. If they change the AUP on you, you still have recourse under the law. The law requires you to know the Criminal Law (ie the bit about you not being allowed to access things you have not been given authorisation to access). It doesn't require that you learn every AUP off by heart. So, if by some stupid chance a forum suddenly changes their AUP on
Sure enough, the cow costume was hanging up next to the superhero outfit and sailors uniform. (S,Spud)
I agree that what she did was wrong.
However I maintain that it seems like just about anyone could be in breach of any AUP. If a forum's AUP forbade things like "rudeness, flaming, profanity and blasphemy" and somebody let loose one day with a stream of invective (I have heard that happens on some forums), is that really a criminal offence?
When they came for the communists, I said "He's next door. Take him away. Goddam commies."
Technically all those things are considered criminal offences already whether performed on-line or off. They're covered by anti-discrimination / Harassment / hate speech laws etc (we have no blasphemy laws, but anyone making blasphemous comments are usually prosecuted under the anti-discimination laws for vilification).
Most forums based in WA would probably have those things listed in their AUP just to cover their own butts.
I know of a case which was thrown out of court for wasting the courts time because it was petty (someone screaming abuse at a political speaker - the politician had them arrested by the police). I would say that any case coming before a judge where the abuse/rudeness/profanity etc was nothing out of the ordinary would most likely also get thrown out (the precedent has already been set).
Sure enough, the cow costume was hanging up next to the superhero outfit and sailors uniform. (S,Spud)