InternetNZ says the new “possession of software for committing crime” clause in the Crimes Amendment Bill No 6 risks fingering innocent users for illegal activity.
The clause, numbered 252, prohibits possession or selling of software “or other information” that could assist hacking, even when it is also useful, or even primarily intended, for another purpose.
"It seems to us that this could prevent people putting up information on a website which they know can be used to commit crime, even where they are doing so to help people avoid that crime,” says Sue Leader, executive director of InternetNZ, formerly the Internet Society. “For example, someone putting up information about common security defects could be caught. There may also be Bill of Rights freedom of expression issues with this," she says.
InternetNZ’s legal and regulatory committee also takes issue with the new provision covering denial of service attacks - clause 251 (2) (c). Worded as it is, a blanket prohibition on “[causing] any computer system to (i) fail; or (ii) deny service to any authorised users,” the proposed clause “goes well beyond any malicious denial of service,” says Leader.
“For example, ISPs may have all sorts of legitimate reasons to have their systems deny access to particular people or to refuse to supply service.
“The ultimate irony is that this section could even mean that an ISP that takes its system down to combat a denial of service attack could be a criminal under the very section designed to criminalise that attack itself, unless the ISP has specific authorisation to do so.”
Leader says InternetNZ's view is that "an element of intentional wrongdoing or damage" must be added and there must be exceptions "for legitimate activities the unavoidable consequence of which is that services are curtailed".