Serious Crime Bill [Lords] — House of Commons, 2015-01-05
Topic: Law and Crime
Stephen William Hammond (Conservative, Centre-right): My right hon. Friend is absolutely correct. Any number of reports in the past six months have found that major companies have not helped Governments either to assess the risks to their own networks, which creates a national risk, or to assess the threat from organised crime, which leads to serious risks not just to such companies, but to individuals. A number of companies should accept their responsibilities in that area The Bill is very important because of the sheer expansion in the potential for cybercrime. Sections 1 to 3 of the Computer Misuse Act 1990 clearly set out ways to deal with unauthorised access, but the provisions of that Act are now simply too limited. What was relevant in 1990 is no longer relevant, and the pace of change in equipment and software capability requires a significant updating of the response. Economically, part 2 is a singularly important part of the Bill. It accepts that the current law is hopelessly inadequate, and puts in place a new offence in relation to unauthorised acts "causing, or creating risk of, serious damage" The Home Secretary set out that that applies not only to the area of economics, but in other areas, such as security and the environment Simply in the area of economics, such crimes are so serious that they could wreck—that is not too strong a word—the whole economy. It is therefore hugely important that the Bill covers unauthorised acts in relation to computers that result in serious damage. The definition of "serious damage" has rightly been left somewhat opaque, because some of the information inside banking systems would be difficult to assess, but the Bill rightly recognises how far the world has moved since the 1990 Act It is clearly right for the Home Secretary to include protections in the Bill. The need to establish a significant link to the UK is now clear—for example, one of the accused, the target computer system or the damage must be in the UK or, if the attack is from abroad, the accused must have been a UK national at the time of the attack and there must be a similar offence in the relevant country. That provides relative protection while putting in place the right measures to enable law enforcement agencies to tackle this crime. There has been some detailing of the need to upgrade sentencing, and the Bill also recognises that the 1990 Act fails to deal with the seriousness of such crimes. It therefore rightly imposes life imprisonment for serious injury or death, while a sentence of 14 years applies for serious economic damage The potential to commit cybercrime, and the manner in which is it committed, is constantly evolving, and it is right for the new offence to recognise that and the seriousness of its effects. It is also true that whatever we do in the UK—our attempts to extend protection extra-territoriality in the Bill are important—it simply will not be enough. Much of cybercrime is international, and although like many in the House I am hugely concerned about the onward march of certain areas of the EU into our lives, no sensible person would set their face against international co-operation.