Do You Know Computer Hacking is Legal Risks | Total Security

                            Computer Hacking: Legal Risks

The regulators and control

We will present in this part the main existing organizations within the framework of the fight against computer piracy. We will quickly develop their roles and the actions they can take.

The National Commission for Computing and Liberties (CNIL)

This commission was set up in 1978. It is an independent authority and therefore does not depend on any other institution.

The role of the CNIL is to promote the development of digital tools while ensuring the protection of individuals. For this, the commission has two main missions:

Inform and Advise :

the CNIL helps professionals and individuals by disseminating information on the risks incurred when using IT tools, in particular the risks associated with data piracy and the consequences that this can have on life users. It also provides training, generally in the professional context, aimed at ensuring the protection of private data in the context of the use of digital technologies. She advises on the implementation of systems to ensure the security of systems in companies.

Control and sanction  :

 the CNIL also has a monitoring role to ensure that the law is respected. It can thus intervene, in the same capacity as the police, in the premises of the companies and take note of all the documents which it considers necessary or question the people. It can also have access to the computer data of the companies it controls. Thus, in the event of an offence, the CNIL can sanction organizations that contravene the law by fines, the publication of sanctions in the press or the obligation to inform victims. In the event of a serious offence, the CNIL informs the competent authorities (for example, referral to the public prosecutor).

The central office for the fight against crime linked to information and communication technologies (OCLC)

It is an organization attached to the national police and responsible for the fight against crime related to information and communication technologies (ICT). Its field of action is wider than the internet alone, it also acts in the field of telecommunications or even automated means of payment. This organization is divided into five sections:

- An internet section responsible for collecting complaints related to illegal content on the web

- An operational section in charge of the repression of fraud

- A section dedicated to international relations, notably with direct cooperation with Interpol

- An agent training section

- A research and development section

This organization fights, for example, against credit card fraud, internet fraud, smartphone hacking, etc. The OCLC has also set up a website allowing everyone to report illegal content posted on the net.

The High Authority for the Dissemination of Works and Protection on the Internet (HADOPI)

This authority, created in 2009, is responsible for protecting copyright on the Internet. It monitors copyright infringements of works disseminated on the internet and can take sanctions against offenders in the event of an infringement of these rights.

However, HADOPI first of all have an educational role as part of its action. Indeed, in the event of copyright infringement by Internet users, the high authority informs the person concerned by a warning email to inform them:

- the facts which are alleged against him,

- its obligation to monitor its internet access (in the event of hacking of a person on another person's line),

- the existence of security means,

- the existence of legal offers available on the market.

It is only in the event of two recurrences that HADOPI sanctions offenders. During the first violation, the authority sends an email to the person holding the internet subscription. In the event of a recurrence within six months, she sends a new email as well as a registered letter. If there is another recurrence in the following year, HADOPI sends a new letter to inform the user that he is liable to criminal prosecution. It then decides whether or not to transmit the facts to justice and the penalties are often the suspension of internet access for a period of up to one year as well as a fine.

Cyber Operations Command

In 2016, 24,000 cyberattacks were avoided according to Defense Minister Jean-Yves Le Drian. The latter wants to go further and announced at the end of 2016 the creation of a cyber operations command from 2017 aimed at ensuring the cyber defence of the state but also to carry out offensive operations to avoid possible attacks. This unit will be attached to the Ministry of Defense and will have 2,600 people by 2019.

The legislation 

In this part, we will deal with the legislative aspect of the attack on information systems. With the development and generalization of computer systems in all sectors of society, the judicial system has had to adapt to new offences and offences and put in place measures to deal with these phenomena. So, here are the main laws on the subject:

Data Protection Act

This is the main law relating to the protection of users' private information in computer systems, although the law is also applicable for non-computerized files. It protects individuals and the flow of information concerning them.

The Data Protection Act is dated January 6, 1978, and was updated in 2004. It defines the principles to be respected when collecting, processing and storing personal data. This law ensures the protection of the privacy of individuals within the framework of information systems.

It defines the data that may be collected and that which is prohibited from the collection, for example, information relating to ethnic origins, religious affiliation, etc. except with the consent of the persons concerned.

The law ensures the proper use of information (in accordance with the purpose of collection) and defines the rights of users with regard to data concerning them: right of access, opposition, rectification and deletion.

Godfrey Law

This law of January 5, 1988, is the first law established against computer piracy. It provides a criminal framework for unauthorized intrusion into an automated data processing system ( STAD): this can be a computer, a telephone network, a server, etc.

It, therefore, provides for a number of penalties in the event of intrusion into this type of system without authorization. These penalties will be more or less severe depending on the damage caused to the systems, whether the offence is voluntary or not, or whether the offence is committed alone or in an organized group.

Sanctions Incurred 

In the event of non-compliance with the Data Protection Act, offenders risk:

In the event of non-compliance with the Data Protection Act, offenders risk:

• Administrative sanctions from the CNIL: warnings, fines (up to 300,000 euros), publicity of the sanctions imposed, etc.

• Criminal sanctions: in the form of prison sentences of up to 5 years and fines of up to 1.5 million euros.

• Civil sanctions: for example damages, confiscation of equipment or ban on the use of files used.

Here are some examples of penalties incurred according to the facts:

• "The fact of accessing or remaining, fraudulently in all or part of an automated data processing system": two years in prison and a fine of 30,000 euros or even three years and 45,000 euros in the event of modification or deletion of data in these systems.

• Disclosure of personal information: 5 years' imprisonment and a fine of 300,000 euros.
• These latter penalties are reduced to 3 years and 100,000 euros if the act was committed through negligence or recklessness.

• For certain very serious cases at the discretion of the legislator, certain exceptional sanctions may be applied, including among others: Prohibition of civic, civil and family rights (article 131-26 of the penal code). This can result in a ban on voting, testifying in the legal framework ...

A prohibition from exercising the professional activity within the framework of which the offence was committed.

Protegent360: Total Security does not require your attention and allows you to fully concentrate on your business tasks. Total security protects your employees without distracting them from their work with messages and notifications. Protegent360 total Security just does its job while you do yours.