ICT OCR G061 2015 June 1st

Acts Leadingto Data SecurityThe Data Protection Act

• There are eight principles under the act:

• What rights do the public have?

• What are the problems with enforcing DPA to the individual?
  Lists can be sold by other organisations which means individual may not request for them to direct market but other companies may have your details
  Damage and distress hard to prove- has to be related to the use of information
  Difficult to know which companies have information about you, have to request and send money but they may not have it

Exemptions from the act:

• It does not apply to payroll, pensions and accounts data.
• Data held for recreational use/ leisure it is exempt from the act (e.g. address books, Christmas card lists).

Exemptions for specialcategories:

• In connection with national security.
• Prevention of crime.
• Collection of tax or duty.

Computer Crime and the LawComputer Crime and Malpractice:

As IT has spread, so has computer crime and abuse. The internet is used by innocent members of the public butalso by fraudulent traders, paedophiles, software pirates, hackers andterrorists. Activities might include planting computer viruses, storing pornographic images, carrying out all sorts of crimes, from credit card fraud to complex multinational money laundering. Computer crime involves illegal activity.Computer malpractice, in law, means professional negligence whenproviding computer related services. If you provide a service to somebody, youhave a legal responsibility to exercise reasonable care in providing theservice. For example, as a data back up service you would have to takereasonable care to back up the right data and keep it safe. Another example isin software development: If software is not properly tested, the company may beguilty of malpractice.The term is also used to describenegligent behaviour by employees relating to their use of computers. Forexample, not keeping a password secure, not sticking to company procedures,sending offensive emails, reading confidential mail and leaving computerslogged on and unattended. Hacking This is getting unauthorisedaccess to data held on a computer system. The extent to which this happens isvery difficult to monitor and is often found out by accident. Fraud on the InternetThe most common form takes placebetween traders. It appears to be legitimate in the purchasing of goods. For example:

• While trader might say they work for a particular company, like “Curry’s”, they may be unconnected with them. They could then take orders for goods and never deliver them.
• When buying software, you pay money and expect to be able to download the software. The seller takes the money and the software arrives either scrambled or not at all.

Shopping on the internet has enhanced computer crime. Criminals set up a good looking website; offer goods well below high street prices, the buyer will then input their personal details, often along with bank details. They will then be told their card cannot be processed. The criminals will then keep the card data and use it fraudulently. Security set up by retailers actually costs millions of pounds per year encryption software etc.) Encryption is done by a piece of software, which changes normal words into code that can only be deciphered using specialist software. VirusesA virus is a piece of software which affects a computer in a negative way. It is developed with a definite intention to cause damage to computer files or at least cause inconvenience or annoyance. Viruses are usually found as thefirst few instructions of a particular program on an infected disk or rely on a user choosing to execute the aforementioned program. So when executed, the virus is the first set of instructions to be performed. One of its first actions is to copy itself onto the computer and “hide” within obscure files,the operating system code or in unused disk blocks which are then marked as being “bad” and unavailable for use.
Computers and Data Storing and processing information by computers has brought many advantages for organisations. Forexample:

• Lots more data can be stored in a smaller space than with manual systems.
• It is much quicker to search through data to find the information required.
• Cross referencing is fairly easy in comparison (linking together pieces of information which are stored separately).
• Databases held by different organisations can be linked together by a computer network.
• Databases can be accessed from anywhere in the world.
• The security of data can be better protected as long as high levels of access are protected.
• Back up of data is much easier (but must be in a secure environment).

Data Misuse It is much easier for people to misuse data stored using a computer system than using a manual system because:

• Data can be copied quickly and easily, making it easy to steal information.
• Data can be modified or deleted without leaving any physical evidence.
• Data can be accessed from a remote location, e.g. by a network, which means a data thief does not need to break into a building in order to access the data.

Software Piracy Software is protected by copyright. The law says nobody is allowed to make a copy of software without permission. When we buy a piece of software, all we buy is a license to use it.We do not buy the actual software. This is because the copyright is protecting someone’s idea. Nobody can make, distribute or use copies of the work without the permission of the copyright holder. If you copy a computer program or supply an unauthorised copy for someone else without this permission you have broken the law. You could face criminal proceedings.

Regulation of Investigatory Powers Act (2000) (The Snoopers’ Charter)It was introduced due toconcerned regarding the use and misuse of communication interception techniques by public and private organisations. The act allows for the lawful interception of postal, telecommunications and digital communications. The act also makes it a criminal offense to monitor these communications without lawful authority.

Electronic Communications Act (2000)The legislation is in two mainparts:

• Cryptography service provided: This allows the government to set up a register of approved cryptography services.
• Facilitation of electronic commerce data storage: This recognises digital signatures which are now admissible in law.

There is a lot of conflict about digital signatures and some bodies still do not accept them as legal, though they actually are.
Benefits: Contracts that are signed over the internet have the same legality as those signed by hand.
Problems: It will take time before many bodies will accept these digital signatures. Buying and selling a house and wills are examples of two areas where it will take time for this to become acceptable.

Freedom of Information Act (2000)This came into force at the beginning of 2005. It deals with access to official information where it is possible to find out details of any topic from any public authority. The actapplies to all public authorities.The act allows anyone to make a request, with no restrictions on age. To gain access, you must write to the authority, make a request and they have twenty working days to comply.

Benefits: The main benefit is that information that did not used tobe accessible to the general public is now available. This increases accountability. The government can not make public decisions and hide them asthe information is available to those who request it.
Problems: It is possible to ask for any information at all, butthis does not necessarily mean that you will receive it. Some information maybe withheld in order to protect various interests as it may come under someother exemptions.
Learn all of that and you will be fine