Definition of 'document' crucial in hacker cases

A convicted computer hacker is attempting to clear
his name in the Appeal Court, reports PETER GRIFFIN.

The inadequacies of New Zealand laws covering computer misuse are once more in the spotlight as two controversial and long-running computer-hacking cases go before the courts again.

Convicted computer hacker Borislav Misic will take his two-year-old case to the Court of Appeal this month in a bid to overturn his 1999 fraud convictions for cracking Telecom's phone network and running up $80,000 worth of long-distance calls.

The Misic appeal, which for an undisclosed reason is being pursued by his defence team well outside the appeal submission time limit, is likely to hinge on whether the original trial judge, Judge Roderick Joyce, QC, was correct in ruling that data stored on a computer could be classed as a document according to Section 229A of the Crimes Act 1961.

That definition was crucial in a jury's finding Misic guilty on all three counts of fraud, for which he received a 12-month suspended sentence and six months' periodic detention.

The outcome of the Misic appeal will be watched closely by alleged hacker Andrew Garrett. The pre-trial hearing for Garrett's case was heard last week in the Manukau District Court, and his trial is expected to take place in July.

Garrett faces 16 counts, 12 of which rely heavily on whether, in this case, a computer program and passwords fit the legal definition of "document."

The unemployed blacksmith is accused of stealing passwords from customers of Telecom Xtra.

The "document" issue is so central to Garrett's case that Judge David Harvey decided to defer his ruling on whether a computer password and program could be classed as a document until the Misic appeal is heard.

Other charges of forgery, threatening property and wilful damage have been less problematic to deal with, but submissions presented by Garrett's lawyer, Michael Levett, took the line of the Law Commission in pointing out the deficiencies of the Crimes Act in relation to computer misuse.

Among his objections, Mr Levett objected to a "simulated hack" being performed in court. He also argued that according to the act's definition of damage, the computer allegedly hacked into by Garrett would have to be rendered inoperable which, he argued, was not the case.

Judge Harvey ruled that evidence could be presented to the jury in the form of a demonstration and that the impact of a Trojan virus such as "Back Orifice" on a computer fits the definition of "damage."

"Alteration to the magnetic particles on the disk may constitute damage to property constituting temporary physical harm and impairment of value or usefulness," he ruled.

Prosecutor Helen Gilbert presented the Crown's argument in both cases and said she would be watching the outcome of the Misic appeal with great interest as the document issue was central to many of the charges against Garrett.

The two cases have emphasised the need for law reform to remedy the shortcomings in the out-dated Crimes Act covering computer misuse.

In mid-1999 the Law Commission issued its report on computer misuse and called for the Crimes Act to be amended to deal with electronic crime.

In particular, the commission concentrated on the contentious document issue and said it was not clear that the word "document" in Section 229A included data stored on a computer.

The issue of wilful damage and whether intangible property such as computer data could in fact be damaged were also issues on which the commission called for greater clarification.

But Judge Harvey, citing case law from New Zealand and around the world, ruled that definitions in the Crimes Act relating to wilful damage and threatening property were sufficient and dismissed Mr Levett's submissions on both charges.

"Some of the issues raised are novel within the New Zealand context.

"New Zealand does not have any legislation that creates specific offences relating to intrusion to computer systems," said Judge Harvey.

Misic's lawyer, Paul Trehey, said the appeal could be a test case for future cases of a similar nature.

"It's a question of whether the judge could or should have ruled as he did. He instructed the jury as a matter of law that computer data could be viewed as a document. That's the whole issue."

The Crimes Amendment Bill No 6 at present before Parliament's law and order select committee is expected to clarify the law and give the legal fraternity much-needed guidance in the area of electronic crime.

The Internet Society of New Zealand has made its own submissions to the select committee, asking for stronger protection against malicious computer attacks.

Misic's appeal is scheduled for February 28. Based on the outcome of that hearing, Judge Harvey is expected to rule on the definition of "document" in June.