Criminal law of the digital world
The offences of the Godfrain act, identity theft, phishing, their penalties, attempt, and what makes a security test lawful.
- 27 cards
- 5 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- On the timeline
- Scenarios
A few cards from the deck
Automated data processing system: what is it?
Show the answer
Any set of hardware, software and data that processes information; the notion covers a server, a website, a phone.
The Penal Code does not define it: judges read it very broadly, so almost anything connected or programmable falls within articles 323-1 and following.
What is the basic penalty for fraudulent access to a system, with no deletion or modification of data?
- 3 years in prison and a 100,000 euro fine
- 1 year in prison and a 15,000 euro fine
- 5 years in prison and a 150,000 euro fine
- 7 years in prison and a 300,000 euro fine
Show the answer
3 years in prison and a 100,000 euro fine
Simple fraudulent access carries 3 years and 100,000 euros. The penalty rises to 5 years and 150,000 euros if data is deleted or modified or the system's operation is impaired.
Offences against automated data processing systems, now in articles 323-1 and following of the Penal Code, come from the … act of ….
Show the answer
Offences against automated data processing systems, now in articles 323-1 and following of the Penal Code, come from the Godfrain act of 1988.
This is one of the oldest digital-law texts: it dates from 5 January 1988 and has been added to since, notably in 2004 with the possession of attack tools (article 323-3-1).
Fraudulent access or remaining: what is it?
Show the answer
Entering a system without authorisation, or staying in it after realising that access is not allowed.
Entering or staying is enough: no data needs to be stolen or damaged. If data is deleted or altered, the penalty is increased.
An internet user lands via a search engine on internal documents available without a password, notices that authentication is required elsewhere on the site, and downloads everything. Can he be convicted?
- No: the absence of a password makes access free
- Yes: the access was by chance, but staying and extracting are fraudulent
- Yes, for fraudulent access alone: downloading remained free
- No, unless the documents are resold afterwards
Show the answer
Yes: the access was by chance, but staying and extracting are fraudulent
This is the case decided by the Court of Cassation on 20 May 2015: the chance access is not held against him, but staying is, because once he understood access was restricted, he had to leave; the downloading is punished as theft of data, now classed as fraudulent extraction. The absence of technical protection is not an authorisation.