- English Law(Civil, Criminal, Tort) ✓
- Computer Misuse Act ✓
- General Data Protection Act ✓
- Freedom of Information Act ✓
- Intellectual Property ✓
- Contracts Law ✓
- Employment Law ✓
- The Internet - Responsibility of ISPs, Defamation, etc. ✓
- Ethics and Professionalism ✓
Disruptive Innovation - an innovation that helps create a new market and value network, eventually disrupts existing market and value network, displacing all earlier technology.
- Designed to protect "society" from wrong doers
- Police investigation and arrest.
- Central Prosecution Service (CPS) proceed with prosecution.
- "Innocent until proven guilty".
- Must be proven "guilty beyond a reasonable doubt".
- Settling Disputes between people (Companies can behave as people).
- Litigation must be brought by one of the parties of the dispute, they are the plaintiff, against the other, the defendant .
- Both parties must present arguments.
- Decision based on balance of probabilities
- Litigation is usually brought with the goal of obtaining damages ($$) or an injunction (court order).
- In Common Law, a Tort is a 'civil wrong'.
- The action might not be necessarily illegal/ criminal but has still caused harm. Such harm can be addressed by courts
- Torts-based litigation is usually solved through the awarding of damages.
- Negligence - Duty of care, the plaintiff suffered damages as a result of the negligence of the defendant.
- Nuisance
- Defamation
- A "Legislative Act of Parliament or Statute can create, amend or repeal any existing law.
- Any statute overrules any previous act or precedent, but not court decisions based on previous laws.
- Appeal to Criminal Division of Court of Appeal
- Possible to overturn convictions/ court decisions based on appeal where new evidence can be presented and a new verdict given which can overturn or affirm a previous ruling.
- Unauthorised access to a computer .
- Unauthorised access to a computer to commit a serious crime.
- Unauthorised modification of the contents of a computer.
A person is guilty iff :
- They cause a computer to perform any function with intent to secure access to any program or data held in any computer
- The access he intends to secure is unauthorised
- They know at the time when they cause the computer to perform the function that this is the case.
- Punishable by a fine up to £5000 or 6 months imprisonment
- Key points:
- Knowledge & intent
- Attempt is insufficient
- No requirement of damage done
- eg. a blackmailer might hack into an email account to gain evidence of an affair
- It is not necessary for the more serious crime to be carried out as long as intent to do so can be shown.
- Punishable by 5 years imprisonment or an unlimited fine
A person is guilty of an offence iff:
- They carry out any act which causes an unauthorised modification of the contents of any computer.
- At the time they carry out the act they have the requisite intent and knowledge.
- Requisite Intent covers:
- To impair the operation of any computer
- to prevent or hinder access to any program or data held in any computer
- to impair the operation of any such program or the reliability of any such data.
- Punishable by 5 years imprisonment or an unlimited fine.
- Examples of offences include:
- Spreading a virus
- Encrypting files and demanding a ransom for revealing the key
- Redirection of a browser to certain pages.
- All party review of the act
- Input from professional bodies
- Added an additional offence
- Impairing access to data
- Motivated by DDOS attacks
- Increased tariff for unauthorised access (1) from 6 months to 2 years imprisonment
- To show this is a serious crime
- A crime which is extraditable under UK law.
- Still relatively few prosecutions under CMA
- Common view is that the real issue with Computer crime is a lack of resources for investigation and prosecution other than laws.
-
Created to alleviate pressures from EU law makers
-
Resulted in 2 main amendments to the CMA:
- Anyone obtaining malware can be prosecuted before they even steal any personal information.
- Any UK nationals, previously escaping law can now be prosecuted.
-
EU nationals can be extradited to their relevant countries under a blanket directive.
- Major concerns about large amounts of data being collected about people
- Data being used for reasons other than why is was originally collected
- The DPA is designed to protect individuals against:
- The use of inaccurate / incomplete personal information
- The use of information by unauthorised persons
- The use of information for reasons other than why it was collected
-
Data defined as : Information that is being processed automatically or is collected with that intention or recorded as part of a "relevant filing system"
-
Processing = Obtaining, recording or holding data or carrying out any operation on it
-
Data Controller = Who controls why or how data is processed
-
Data Processor = Anybody who processes the data on behalf of the controller
-
Personal Data = Data which relates to a living person who can be identified using this data (possibly with other data the Controller might have)
-
Sensitive Data = Personal Data having racial, ethnic, religious, political or sexual aspects of a person
- Next major revision
- Focus is on the protection of personal data
- Aims for consistency across Europe
- Technology has changed drastically since 1998
- Emphasis on transparency, accountability and awareness
- Should give more control to a person's own data
- online identifiers, location data, etc.
- Applies the EU's GDPR standards
- preparing Britain for Brexit
- Businesses will be able to continue to operate across Europe.
- Covers all other
- General data
- Law enforcement Data
- National security data
- Modifies GDPR to work better for the UK
- Academic Research
- Financial services
- Child protection.
-
Lawfulness
- Personal Data will be processed fairly and faithfully and in particular will not be processed unless:
- a. at least one condition in "Schedule 2" is met
- b. in the case of sensitive data, at least one condition in "Schedule 3" is met
- Schedule 2 - consent is given for some legal obligation to process data (tax returns, law enforcement, etc.)
- Schedule 3 - Explicit consent is given
-
Purpose
- Personal Data shall be obtained only for one or more specified purposes, and shall not be further processed in any manner incompatible with that purpose(s)
- Data cannot be collected "just in case it's useful"
-
Data Minimisation
- Personal Data should be adequate, relevant and not excessive in relation to the purpose or purposes for which it is being collected.
-
Accuracy
- Personal Data should be accurate and, where necessary, kept up to date.
- Reasonable steps must be taken to ensure that inaccurate personal data is erased or rectified.
-
Storage
- Personal Data processed for any purpose or purposes should not be kept for longer than it is necessary.
- How long is long enough?
- Financial data must be kept for 7 years for auditing
- Civil actions can be issued six years after any event
- CCTV data is routinely deleted after one month
- Procedures for data deletion must be rigorous and specified
-
Access
- Personal Data should be processed in accordance with the rights of the data subjects under this act
- GDRP Rights of the Individual :
- Right to be informed
- What, why and how your data is being processed
- Right of access
- Request all Personal Data and Confidential Data for free
- Right to rectification
- incorrect data can be corrected
- Right to erasure
- all data erased from systems without delay (new in GDPR)
- Right to restrict processing
- Cease processing and leave data alone
- Right to data portability
- Receive an electronic version of all the data you have submitted (new to GDPR)
- Right to object
- to processing such as direct marketing or profiling
- Rights based in relation to automatic decision making
- not to be subejct to a decision based upon profiling
-
Security
- Personal data shall be processed in a manner that ensures appropriate security of personal data
- Protection against unauthorised or unlawful processing
- Protection against accidental loss, destruction or damage
- Must use appropriate technical or organizational measures
-
Overseas transfer
- No GDPR equivalent principal
- Transfer will only take place if the country of transfer offers and adequate level of protection
-
Accountability - new in GDPR
- The controller shall be responsible for, and be abe to demonstrate compliance with these principals
- Framework for lawful interception of computer, telephone and postal messages
- ISPs (& most employers) can monitor communications without consent to:
- Establish facts
- Ensure company regulation are being complied with
- To ascertain standards which ought o be achieved
- To prevent crime
- To investigate unauthorised use of telecommunications systems
- To find out whether a communication is business or personal
- To monitor but not record calls to confidential counselling helplines
- Such organisastion are required to make reasonable efforts to inform users that such interception might take place
- RiPA also allows government agencies the right to ask for interception warrants to monitor communications to or from specific persons / organisations.
- Act to provide clear right of access of information held by bodies in the public sector
- with certain conditions and exemptions
- Where information is exempted from disclosure there is a duty on the public body to disclose where, in the public body's view, the public interest in disclosure outweighs that of maintaining the exemption.
- Monitored by the Information Commissioner
- Potential conflicts between FOI requests and GDPR/DPA in cases where there is personal data
- Usually, FOI requests must be answered within one month of receipt
- sometimes impossible
- FOI requests have been used to "punish" perceived slights
- Public organisations need to develop the necessary infrastructure to handle FOI requests. Often this cost is passed via FOI request charge
Intellectual Property (IP)
- Theft = The intentional taking of somebody else's property with the intention of permanently depriving them of it
Copyright c◯
-
Copyright, Design and Patents Act of 1988
-
Copyright (computer programs) Regulations of 1992
-
The owner of an IP work has certain exclusive rights:
- The right to:
- make copies of the work
- issue copies of the work to the public (paid | free)
- adapt the work (English -> Japanese, Java -> Python)
- These rights are automatic
-
Anybody must request permission to view/ use the IP
-
Copyright doesn't stop anybody publishing identical work, only directly copied work
-
Copyright lasts 70 years after the author's death
-
Copyright applies to databases where content is of the authors own creation
-
Database copyright also applies if "There is substantial investment in obtaining, verifying or presenting the contents of the database"
-What can you do without Permission?
- It is not infringement to:
- Make a backup of a program you are authorised to use (only 1 copy)
- You can decompile code to correct any errors
- You can sell your right to use a program
- but you must destroy any copies you have
-What is Infringement
- Primary infringement
- Exclusive right of copyright holder are infringed
- Civil issue - damages, injunctions
- Secondary infringement
- Primary infringement in a business context
- selling copies
- using pirated software in a business context
- Criminal issue
- Large fines, imprisonment
-DRM
- Many pieces of software use DRM
- providing information about how to avoid DRM is the same as actual copyright infringement (as of the 1988 Copyright, Design and Patents Act)
-
Patents Act of 1977
-
A patent is a temporary right granted by the state enabling the inventor to prevent other people from copying his work without permission
-
Patents must be applied for (are not automatic)
- Are far stronger than Copyright
- Prevents other people from coming up with the same solution
- Patents were meant to encourage innovation
- reward an inventor with a grace period to recoup development costs
-
For a product to be patented it must be:
- New
- Involves an inventive step
- isn't an obvious solution
- Is capable of industrial application
- Is not in an area specifically excluded i.e. no:
- Scientific theories
- Mathematical Methods
- Literary/ dramatic/ artistic work
- Presentation of information
- A scheme, rule or method for performing a mental act (includes computer programs)
-Obtaining and enforcing
-
Patents are granted nationally
-
Technically you need to apply in each country
-
Trade schemes such as WIPO, European PO etc. eliminate this requirement
-
Timing is crucial
- Data of initial applicaion determines what is "new"
- Full paten specification requires specialist work
- Often takes 4 years to complete
-
Computing being a global business requires the patent to be taken out in enough countries for it to be challengeable
-
Enforcing is difficult
-
Many are contested
-
Software can be patented iff:
- It is part of a product that can be patented
- Controls some process with a physical effect
- Processes data that arises from the natural world
| Pros |
Cons |
| - Patents allow for financial rewards for innovators and creators |
- software has been successful without patents |
| - Fund future research |
- Patents allow big companies to claim basic computer functionality as their exclusive right |
| - Fund computer scientists |
- A great deal of software has already been written without patents, leading to retrospective patents being granted |
|
- Most original development is done by small companies, which is then licensed to/ exploited by big companies |
- Political/Software Philosophy
- Software is released as "free"
- No restrictions on re-use/modification/ copying
- EXCEPT:
- Any resulting code must also be free
- Work often involves an obligation of confidence:
- Software developement for a company might reveal commercially sensitive information
- Conditions of employment for employees
- Long periods of notice for employees with sensitive knowledge
- Clauses in consultancy agreements for consultants
- Without such conditions, obligations might occur under Equity
- Obligation occurs if a reasonable person in such a position would reasonably understand that information was given in confidence.
-Public Interest Disclosure Act of 1998
- Information can be disclosed if the employee believes any of the following might occur:
- A criminal offence
- Failure to comply with legal obligation
- A miscarriage of justice
- Danger to health and safety
- Environmental Damage
- Information that occurrences of these have been concealed
-
Any sign capable of being represented graphically which is capable of distinguishing goods and services
-
Useful to protect some kind of retail software
-
Trademarks can be registered or not
- Registered in the UK by the Intellectual Property Office
- There are rules for what can be a trademark
-
UK 1994 Act makes it illegal to
- Apply unauthorised trademark to goods
- Sell or hire goods with such a trademark
- Have in the course of business such goods
- Usually a criminal offence but civil actions can also be brought
-
Unregistered trademarks are also protected in the UK under the Tort of passing off
- Civil action (less strong than registered trademarks)
-
Old law
-
All parties intend to make a contract
-
All parties must be competent to make a contract
-
There must be a "consideration"
- Each party must receive and provide something
-
Minor additions have been made for modern technology
-
Fine for most things, Except software
-
Software Projects are high risk
-
Contracts protect both parties
- Typically tailor-made, bespoke systems
- Short agreement
- Who the parties are
- what has been said before is not part of the contract
- Standard T&C
- How the supplier normally does business
- A set of schedules/ annexes
- PArticular requirements of the contract
- What is supplied
- Deadlines
- What payments are to be made
- etc.
-
Unlikely for a clause to exist stipulating a due date of payment with consequences otherwise such as surcharges or break of contract
-
Payment is more likely to be staggered
- Initial Payment of 15% on signing
- Stage payments during development
- 25% at acceptance of software
- 10% at end of contract
-
Such a system is designed to protect the supplier
- Client may go out of business
- Cash flow for the supplier
-
Staggering can be done by
- calendar month (benefits supplier)
- by project completion (benefits client)
- Contract needs to specify client obligations
-
Provide documentation
-
Provide access to appropriate staff
-
Provide machine facilities for testing
-
etc.
-
Most suppliers will have their own standards of testing and quality assurance
-
Large clients will prefer to use their own
- Must be specified in the contract
-
Acceptance
- Client must provide fixed set of acceptance tests
- Successful demonstration of system will constitute acceptance
-
Warranty
- Standard is 90 days
- Any identified errors are fixed free of charge
- Beyond this is subject to negotiation
-
Indemnity
- Risk of supplier infringing on IP rights of third party
- usual for contract to indemnify client and supplier so each are not liable for any infringement by the other due to their own fault
Termination and Arbitration
-
Termination
-
Arbitration
- Contracts are complex
- Litigation is expensive (often not worthwhile)
- Contract may specify that in the case of a dispute the option of an independent arbitrator will decide
- Avoids legal costs
Time and Materials Contracts
-
Also referred to as a "Cost Plus" contract
-
Supplier agrees to develop software
- payment based on costs incurred plus daily rate
-
Acceptance tests and payment is often much simpler
-
Often cheaper than fixed price contracts
-
Sometimes project is unclear meaning fixed price is impossible
-
Fixed price contracts are complex
-
Contract hire offers a simple alternative
- Supplier provides services of staff for a fixed period
- Agreed hourly/ daily rates
- Client takes responsibility for managing staff
- Termination by either side can be done at short notice
-
Consultancy - Expert analysis is a key part of business
- Usually produces a report
- Done at a fixed price but
- small amount of cash involved
- harder for a report to fail an acceptance test
- reputation of a consultant is a good guarantee
-
Issues with Consultancy
- Confidentiality
- Need to be safeguards to ensure consultant doesn't profit against the client following the project
- Terms of reference
- what is the consultant mean to be looking at?
- often changes during the course of the project
- major source of disagreements
- Who approves the final report?
- Usually client approves draft
- May require amendments
- Might damage consultants reputation
- Liability
- Few consultants want to be liable for the advice they give
- Most clients want them to be liable
- Complex
- Ensuring recruitment/selection/promotion complied with legislation
- Staff training and development
- Appraisal
- Dismissal and redundancy procedures
- Administrating grievance procedures
- Being aware of new legislation
- Health and Safety
- Recruitment is expensive
- Keep employees happy
- Soliciting applications
- Often outsourced
- Pre-selection & shortlisting
- Typically charge 25% of first year salary for services
- Left to parent company
- Selection Procedures
- 1-1 interviews with senior management
- reliable
- Difficult to make comply with anti-discrimination legislation
- Interview by panel
- Common
- Easy to comply with legislation
- May not be reliable
- Charismatic people have large advantage
- Avoids nepotism & corruption
- Psychometric tests
- ability tests
- eg maths or written skills
- Aptitude tests
- focus on ability to learn
- reliable for assessing programming ability
- increasingly difficult for more advanced skills
- Personality Tests
- common
- Unclear definitions of "good personality traits"
- value unclear
Staff Training and Management
- UK industry is often criticised for lack of interest in staff training
- In the US employers frequently fun part time masters degrees
- UK governments have attempted to provide initiatives
- Disparity of pay & benefits cause dissatisfaction in employees
- Public services
- fixed pay scales
- Annual increments
- Promotion = moving to a better scale
- Rarely competitive with private sector
- Private companies
- Individual agreements within broad guidelines
- Often difficult to justify
- Job evaluation to make sure people are doing enough work for their pay
- Equal pay for equal work & anti-discrimination legislation
- Management by objectives
- Regular (annual) meeting with manager
- Agreed objectives
- Objectives should be
- Clear
- measurable
- achievable
- revised objectives for next period
Redundancy and Dismissal
-
HR is responsible for ensuring proper procedures are followed
-
Such actions are hard on
- the employee
- general staff morale
-
Laws surrounding redundancy are complex
-
Unfair dismissal
- reason for dismissal must be valid
- correct procedure must be followed
-
Reasons for a justified dismissal
- Lack of capability
- Misconduct
- Breach of law
- Redundancy
-
But NOT:
- Legal union activity
- legal action to enforce employee rights
- issues covered by anti-discrimination law
- Company behaves in a way towards employees that makes them feel as though they must resign
- Any breach in terms of employment contract can be seen as contrcutive dismissal
- Constructive dismissal is not necessarily unfair (often is)
- Examples include moving office and requiring current employees who want to remain to move along with the office.
-
Redundancy = when the company no longer requires people to do a certain job
-
Potentially, the company may have gone bust
-
Employees are entitled by law to certain minimum levels of compensation based on age, salary and experience
-
In UK law there are 2 concepts of redundancy
- For purposes of compensation, redundancy is where employer no longer needs employees for a given job
- For purposes of consultation, redundancy is dismissal where reason is not related to individuals concerned
-
Difficult to decide who to make redundant
- last in first out is the normal
- Laws governing where one company takes over another
- Employees of the old company are automatically employees of the new company
- Conditions of employment must be maintained
- Provide similar but not equal protection against:
- Sexual
- Gender
- Disabled
- Religion
- Political Discrimination
- Used to be that each was monitored by a different government body
- Consolidation of all previous laws into a single act
- Provides a single framework which guarantees
- anti-discrimination
- equal pay and employment conditions
- Equal access to sales and services
- All of the above for the following :
- Gender
- Sexual preference
- Marital Status
- Age
- Race
- Religion
- Political Views
- Disabilities
- With some explicit exceptions
- How responsible an ISP is for their customers behaviour is dependant on what the ISP does:
- Simply a conduit
- Caching
- Hosting
- ISP does no more than transmit data to and from the internet
- ISP does not
- Initiate transmissions
- select or modify data
- can store data as part of the transmission process
- ISP is not responsible for:
- Not liable for any civil damages
- not open to any criminal sanction
- ISP is not liable if:
- it did not know anything unlawful was going on
- where a claim of damages is made, it did not know anything which should have led it to think something unlawful was going on
- when it found something illegal, it acted expeditiously to remove the information or disable access
- the customer was not acting under the authority or control of the ISP
- If a crime is committed in Country A but the criminal moves to country B, can the criminal be prosecuted?
- if there is an extradition treaty in place then
- criminal arrested in B can be sent back to A
- only if the act is also a crime in country B
- Extraditions often fail
- Can the criminal be prosecuted in B ?
- generally : no
- exceptions include
- UK will prosecute child abuse committed in other countries
- You live in country A, publish a website that is legal in country A but a criminal offence in country B
- You cannot be prosecuted in country A
- It is highly unlikely you will be extradited to B
- Unwise for you to visit B
- "An article shall be deemed to be obscene if its effect
or the effect of any one of its items is, if taken as a
whole such as to tend to deprave and corrupt
persons who are likely, having regard to all relevant
circumstances, to read or hear the matter contained
or embodied in it."
- Possession is not illegal
- Publication and distribution is
- Protection of Children act of 1978
- serious criminal offence
- mere possession is an offence
- does not need to be obscene
- Wide international agreement
- Very severe penalties
- All non-child porn is protected under the 1st amendment
- Mainly concerned with children accessing porn
-
UK body formed in 1996
-
Supported by government, police and ISPs
-
Monitors and takes action against offensive internet content
- eg.:
- (intentional) child pornography
- Adult material that potentially breaks the law
- Contains criminally racists material in the UK
-
Operate a hotline to the public
-
Receives around 20,000 complaints annually
- International, Independent Association
- Board contained major tech players such as IBM, BT and Microsoft
- Provided a framework for content producers to label their websites with content labels (nudity, violence etc.)
- Disbanded in 2010 due to lack of acceptance
- Ethics is the area of philosophy concerned with right and wrong behaviour
- Most people consider themselves to be "good"
- However, bad things happen
- The ethics of a situation can be complex
- Philosophy = the rational analysis of assumptions based on arguments
- Moral Philosophy asks:
- What does it mean to be/do good?
- What is wrong/ evil?
- How can we lead a "good life" ?
- Not directly practical, doesn't yield definite answers
- People disagree on solutions to moral issues
- But also disagreements in all areas of science
- Most of us agree on the major points of morality
- Who am I to judge others?
- Judgement is needed in some cases
- e.g. Human rights abuses
- Morality is a private matter
- Not just private beliefs
- Our actions affect others
- Morality is a matter for individual cultures to decide
- Moral relativism
- e.g ages of consent
- Considerable agreement across many cultures
- Founded in 3 BC
- Popular in the Roman Empire
- Rationality and acceptance of misfortunes
- PAssion is the cause of suffering
- Ignorance is the main cause of evil in the world
- Thinking as a spiritual exercise
- Equality and brotherhood for all mankind
- Popularised by Jeremy Bentham (1780 AD)
- Hedonic Calculus
- Any pleasure or pain can be measured and quantified
- Act Utilitarianism (John Stuart Mill, 1863)
- An action is right if it promotes happiness
- Choose the action that will produce the greatest amount of happiness
Utilitarianism and the Law
- Greatest happiness for greatest number of people implies altruism
- Law exists to enforce altruism for benefit of society
- Therefore, using this argument we can quantify why stealing is wrong:
- Stealing increases happiness of thief
- Reduces happiness of victim
- Makes other people feel insecure
- Therefore, net happiness is lower
- How do we quantify pleasure and pain?
- How do we decide what is good if we don't know the consequences?
- Utilitarianism ignores the needs of an individual
- Medical treatments require tax funding
- Taxes make more people unhappy
- Therefore, we should stop funding medical treatments
- Moral realism
- Intuitive awareness of moral "facts"
- Self evident principles of right action:
- Promoting the happiness of people
- Refraining from harming others
- Treating people justly
- Telling the truth
- etc.
- Principles are not always self evident
- If morality is objective fact, why do we still debate right and wrong?
- Good actions represent the rights of individuals
- Humans have essential rights
- French declaration of human rights (1789)
- US Bill of rights (1789)
- The European Bill of Human Rights
- Act as if you are legislating for everybody else
- if you do an action, would you want everybody else to have taken the same action?
- Treat any action as if it was a law for everybody
- Act so as to treat human beings always as ends and never as means
- Act as if you were a member of a realm of ends
- Act as a member of a community
- All of whom treat each-other as ends rather than means
- All of whom decide as if they were legislating for all
- One should treat other as one would like other to treat oneself
- One should not treat others in ways that one would not like to be treated.