The law must still maintain the capacity to punish hard where someone has strayed into what society deems serious crime. However, almost any serious crime committed by a hacker could be committed by a non-hacker and prosecuted under other legislation. Fraud, wilful damage and dealing in stolen property are crimes regardless of the medium—and should be punished appropriately.
Does it make sense to view most look-see hackers—and by that I mean hackers who do not do malicious damage or commit fraud—as criminals? Probably not. They are primarily just a nuisance and should be treated as such. This would not be difficult to do. The law-makers could simply declare look-see hacking to be a minor legal infringement. In the worst-case scenario, a repeat offender might have to do a little community service. But such community service needs to be managed properly. In one Australian case, a corrections officer assigned a hacker to dig ditches with a convicted rapist and murderer.
Many hackers have never had a job—in part because of the high youth unemployment in some areas—and so their community service might be their first `position'. The right community service placement must involve hackers using their computer skills to give something back to society, preferably in some sort of autonomous, creative project. A hacker's enthusiasm, curiosity and willingness to experiment can be directed toward a positive outcome if managed properly.
In cases where hacking or phreaking has been an addiction, the problem should be treated, not criminalised. Most importantly, these hackers should not have convictions recorded against them, particularly if they're young. As Paul Galbally said to the court at Mendax's sentencing, `All the accused are intelligent—but their intelligence outstretched their maturity'. Chances are, most will be able to overcome or outgrow their addiction.
In practice, most Australia's judges have been reasonably fair in their sentencing, certainly compared to judges overseas. None of the Australian hackers detailed in this work received a prison sentence. Part of this is due to happenstance, but part is also due to the sound judgments of people like Judge Lewis and Judge Kimm. It must be very tempting, sitting on the bench every day, to shoot from the hip interpreting new laws.
As I sat in court listening to each judge, it quickly became clear that these judges had done their homework. With psychologist Tim Watson-Munro on the stand, Judge Lewis rapidly zeroed in on the subject of `free will'—as applied to addiction—regarding Prime Suspect. In Trax's case, Judge Kimm asked pointed questions which he could only have formulated after serious study of the extensive legal brief. Their well-informed judgments suggested a deeper understanding both of hacking as a crime, and of the intent of the largely untested computer crime legislation.
However, a great deal of time and money has been wasted in the pursuit of look-see hackers, largely because this sort of hacking is treated as a major crime. Consider the following absurd situation created by Australia's federal computer criminal legislation.
A spy breaks into a computer at the Liberal Party's headquarters and reads the party's top-secret election strategy, which he may want to pass on to the Labor Party. He doesn't insert or delete any data in the process, or view any commercial information. The penalty under this legislation? A maximum of six months in prison.
That same spy decides he wants to get rich quick. Using the local telephone system, he hacks into a bank's computer with the intention of defrauding the financial institution. He doesn't view any commercial or personal information, or delete or insert any files. Yet the information he reviews—about the layout of a bank building, or how to set off its fire alarm or sprinkler system—proves vital in his plan to defraud the bank. His penalty: a maximum of two years prison.
Our spy now moves onto bigger and better things. He penetrates a Department of Defence computer with the intention of obtaining information about Australia's military strategies and passing it on to the Malaysians. Again, he doesn't delete or insert any data—he just reads every sensitive planning document he can find. Under the federal anti-hacking laws, the maximum penalty he would receive would also be two years prison.