Cybercrime and Cyberterrorism in Polish Law

Abstract

The aim of the paper is to analyze the provisions criminalizing the phenomenon of “computer crimes” (“cybercrimes”) in the strict sense, i.e. acts in which a computer or network is the target of a crime (“a victim”). The paper consists of two parts—the main part in which analysis of articles 267-269c of the Penal Code of 1997 (Chapter XXXIII, entitled “Offenses against the protection of information”)—in which the Polish legislator defined these offenses—is carried out. The second part refers to the “cyberterrorist offense” which is an “ordinary” computer crime carried out with a “terrorist purpose”.

1 Computer Crimes in the Penal Code of 1997

The Polish regulation of prohibited acts set out in Directive 2013/40 is included in Chapter XXXIII of the Penal Code titled “Crimes Against the Protection of Information”, in the provisions of Articles 267-269c. It owes its present form to three amendments: the first one, introduced by way of the Act of the 18th of March 2004 Amending the following Acts: the Penal Code, the Criminal Procedure Code, and the Code of Minor Offences,¹ intended to adapt Polish regulations to the provisions of the aforesaid Convention on Cybercrime;² the second one, introduced by way of the Act of the 24th of October 2008 Amending the Penal Code and Certain Other Acts,³ intended to implement Framework Decision 2005/222/JHA on attacks against information systems;⁴ and the third one, introduced by way of the Act of the 23rd of March 2017 Amending the Penal Code and Certain Other Acts,⁵ the main purpose of which was to implement Directive 2014/42/EU of the 3rd of April 2014 on the freezing and confiscation of instruments and proceeds of crime in the European Union⁶ and, “partially” (as formulated in the Act), Directive 2013/40 on attacks against information systems and replacing Council Framework Decision 2005/222/JHA.⁷

Article 267(1) of the PC provides for penal responsibility of the offender for gaining unauthorised access to information⁸ not intended for him/her. It penalises three acts, which constitute attacks on the security of information systems and the data processed in those systems.

First, connecting to a telecommunications network⁹ or, in other words, the offender’s obtaining physical access to that network, e.g. by connecting to the server via the network and obtaining access to the data stored in that server (actions including the interception of data during transmission are penalised by Article 267(3) of the PC).

Second, obtaining access to information by breaking electronic, magnetic, computer or any other special protection. It follows that only the information, which is stored in computer systems, and which has been protected against unauthorised access by its holder, is protected. Electronic, magnetic or computer protection is to be understood as “any forms of hindering access to information, the breaking of which requires expert knowledge or a special device or code”,¹⁰ whereas “other special protection” is a complementary category, which includes means that cannot be classified with any of the kinds provided for in the applicable regulation, and the removal of which causes difficulties for the offender no lesser than the breaking of electronic, magnetic or computer protection.¹¹ Computer data can be protected either directly, e.g. by encoding or securing access with a password, or indirectly, as part of the overall protection of a computer system itself, by means of firewalls, break detection systems or authentication procedures. “Security breach” is the direct interference of the offender with the protection mechanism, which leads to the loss of its protective function and does not have to involve its removal.¹² In the doctrine, it is indicated that it must be actual and active at the time of committing the act. Otherwise, the statutory criteria of a crime are not met.¹³

Third, omitting the above-mentioned protection and gaining access to information due to that omission. One should bear in mind that the breaching of protection is merely one of the many techniques (and not the most popular one) used by hackers to penetrate computer systems. The other techniques are omitting protection, and they consist of misleading people (the so-called social engineering, which are, for instance, wheedling passwords out of people), misleading a system (e.g. the so-called IP spoofing, i.e. the creation of false addresses, directed at manipulating the source from which the data comes), or taking advantage of gaps (errors) in, or vulnerabilities of, operating systems, applications or protocols (sets of rules, which specify the communication processes responsible for identifying computers in a network, among other things), using programmes called exploits.¹⁴

In Article 267(2) of the PC, the legislator penalises unauthorised access to the whole or part of an information system.¹⁵ The authors of the 2008 amendment, which introduced the provision, pointed out rightly, in the justification, that the purpose of obtaining unauthorised access to a system may be not only obtaining access to information contained in such computer data, but may also serve, to some extent, as a first step to other activities such as, using the example taken from the justification, installing on a computer a programme enabling one to take control over the computer, in order to create a botnet¹⁶ by means of which the offender intends to launch a dDoS attack.¹⁷ That provision is applied when the offender’s purpose, as he has gained unauthorised access, is to commit a “common” crime (the offender’s conduct may involve, for instance, accessing another user’s account on an Internet auction site in order to commit fraud) or when he/she was guided by some other motives such as verifying his/her own skills or earning respect in the “hacker circles”. Therefore, the objective, which the offender was to achieve or the motive by which he/she was guided are irrelevant to the essence of the crime defined in Article 267(2) of the PC.¹⁸

Access to the whole or part of an information system should be understood as having an opportunity to use its resources, which basically means the data processed by it. This, however, is not tantamount to access to information since the data may be, for instance, either encoded or entirely incomprehensible to the offender.

Within the meaning of this provision, unauthorised access should be understood as access without an authorisation or access, which exceeds the limits of such an authorisation.

The solution adopted by the legislator in Article 267(2) of the PC received justified criticism for three basic reasons. First of all, it was a word-for-word copy of Article 2 of Framework Decision 2005/222 (“Each Member State shall take the necessary measures to ensure that the intentional access without right to the whole or any part of an information system is punishable as a criminal offence, at least for cases which are not minor”). It should be stressed that framework decisions were aimed to harmonise legal provisions of Member States. They set out objectives to be achieved, whereas Member States were free to choose the forms and methods to achieve them. Therefore, the provisions formulated in the objectives are very general. The framework decisions, which harmonise substantive criminal law, are not suitable for literal transposition. Second, Article 267(2) of the PC is extremely laden with content. The statutory criteria of the act defined in the article are met by the offender who “obtains unlawful access” to data because that is what obtaining access to a system in principle means, and in order to be held criminally responsible, he/she does not have to breach protection. The sole condition is access that is unauthorised. It should be assumed that the provision set out in Article 267(2) of the PC is applicable to cases, in which the main element of the offender’s act was gaining access to an information system, and not obtaining access to information. This is the case, for instance, when one breaks into a computer in order to insert a bot. Because of the broad subjective scope of Article 267(2) of the PC, also some of the acts penalised by Article 267(3) of the PC, defined as computer eavesdropping, may be potentially qualified also under Article 267(2) of the PC. Obtaining unauthorised access to a network is tantamount to gaining access to the data that is transferred over that network; the offender, therefore, meets the statutory criteria of a prohibited act under Article 267(3) of the PC.

Third, the only condition to be met in order to press charges against the offender for breaching Article 267(2) of the PC is the offender’s gaining access without an authorisation. The issue of access rights to the resources of an information system is, in most cases, regulated by “soft law”, the internal rules and regulations of a network. The granting of access rights for users and the scope of such rights are within the discretion of the system administrator. Such reference to non-legal norms is dangerous and difficult to reconcile with the principle of the specificity of a crime.¹⁹

The last amendment added provision 269c, pursuant to which one is not subject to punishment for the crime set out Article 267(2) or Article 269a, for acting exclusively for the purpose of protecting an information system, an ICT system or an ICT network, or for developing a method for such protection, and has immediately informed the holder of that system or network of the revealed threats, and his/her actions did not violate public or private interests, or did not do any damage.

The tool for combating the so-called computer eavesdropping²⁰ is the already mentioned Article 267(3) of the PC, which penalises the installation or use of, in order to obtain information,²¹ a listening, visual or other device or software.

It should be stressed that it penalises only the interception of computer data during its transmission. If the offender obtains data stored, for instance, on a server or private computer, this act should be qualified under Article 267(1) or Article 267(2) of the PC. The unlawfulness of the offender’s conduct is obviously derogated if the conduct that meets the statutory criteria of a crime is connected with lawful operations of law enforcement authorities (i.e. it follows from the relevant legal provisions²²).²³

Article 268(2) of the PC penalises any unauthorised interference with computer data that consists in destroying, damaging, deleting or altering significant information on a computer data carrier,²⁴ and in limiting its accessibility for an authorised person²⁵ by foiling or hindering, in any other manner, the familiarisation with such information recorded on such a computer data carrier.

The information that is the object of the offender’s act must be “significant”, especially in the objective sense (because of its content, weight and significance²⁶), taking into consideration the interests of an authorised person to familiarise him or herself with that information²⁷ for the purpose that was intended or supposed to have been intended.²⁸

As the protection concerns “information recorded on an electronic data carrier”, Article 268(2) of the PC is not applicable to any cases where the familiarisation with such information is hindered by disturbances in the network functioning (in this case, the offender’s conduct should be qualified under Article 268a (1) or (2), or Article 269a of the PC).

In this case, the aggravated crime corresponds to the act described in Article 268(2) of the PC, with substantial property damage caused by the offender being considered an element of that offence.

The first part of Article 268a (1) of the PC penalises acts such as destruction, modification of data, and hindering access to it. The second part, in turn, penalises acts such as disturbing (in other words, hindering the operation of an information system) or preventing the processing, storing or transferring of computer data. The statement refers to any acts which impinge on these processes, and which lead to any irregularities in, or slowdown of, these processes, as well as the distortion or modification of the computer data that is processed, transferred or stored.²⁹

In this case, the aggravated crime corresponds to the act described in Article 268a (2) of the PC, with the substantial property damage caused by the offender being considered an element of that offence.

The essence of the so-called computer sabotage defined in Article 269 (1) of the PC is the impairment, damaging or alteration of computer data of special significance to the State’s defence, communications security, the operation of the public administration, other public authorities or institutions, or a local government body, or disrupting or hindering the automatic processing, storage or transfer of such data. Pursuant to Article 269 (2) of the PC, computer sabotage may also include damaging or replacing a data carrier, or damaging or impairing a device designed to automatically process, store or transfer protected computer data. It is punishable by imprisonment from six months to eight years, which is a heavy sentence.³⁰

In view of the much greater significance of the information protected under Article 269 (1) of the PC, in comparison with the information subject to protection under Article 268 (2) of the PC, and the identicality of the remaining statutory criteria of prohibited acts penalised under those provisions, the crime described in 269 (1) of the PC is considered an aggravated crime in relation to the crime defined in Article 268 (2) of the PC.³¹ For these reasons, such a statement appears justified also in the case of the relationship between the crimes defined in Article 268a of the PC, or 269a and 269 (1) of the PC.

Article 269a of the PC provides for penal responsibility of the person who, without an authorisation, to a large extent disrupts the operation of an information system, an ICT system³² or an ICT network,³³ through actions of a logical character such as the transmission, destruction, impairment or alteration of computer data. The protection applies to the secure operation of a computer system and, in consequence, to accessibility of the computer data processed in that system.

An attack on the operation of an information system, an ICT system and an ICT network is a logical, rather than a physical attack. Disruption is to be caused by the transmission, destruction, impairment or alteration of computer data. These will include, for instance, DoS attacks.

As pointed out by Andrzej Adamski³⁴ and Włodzimierz Wróbel and Dominik Zając,³⁵ the provisions set out in Articles 268a and 269a of the PC overlap. The definitions “to a large extent disrupts or hinders the automatic processing, storing or transferring of data” and “to a large extent disrupts the operation of an information system, an ICT system and an ICT network” are essentially identical. The operation of the said systems and the ICT network consists in the processing, storing and transferring of data. As further proposed by Andrzej Adamski, Article 268a of the PC could be treated as a tool to prosecute the offenders, whose conduct does not meet the criteria of the perpetrator defined in Article 269a of the PC,³⁶ while Włodzimierz Wróbel and Dominik Zając claimed that the said article should be applied when the operation of an information system or an ICT network has been disturbed.³⁷ The offence under Article 269(1) of the PC should be considered as aggravated type to the offence described in Article 269a of the PC.³⁸

As in the case of the act described in Article 267 (2) of the PC, the provision of Article 269c of the PC may apply here.

Article 269b of the PC penalises prohibited acts committed with the use of “hacking tools”. Article 269b (1) of the PC, which is the equivalent of Article 7 of Directive 2013/40, penalises the creation, acquisition, sales or making available: 1) hardware or software adapted to committing the crime defined in Article 165 (1) (4) of the PC (causing danger to the life or health of many people, or resulting in large-scale damage to property), and in Article 267 (3), Article 268a (1) or 268a (2), in connection with 268a (1), art. 269 (1) or 269 (2), or Article 269a of the PC; 2) computer passwords, access codes or other data which enable unauthorised access to the information stored in an information system, an ICT system or an ICT network.

The solutions adopted in Article 269b (1) of the PC, from the moment of its inclusion in the Penal Code by way of the 2004 amendment, were widely criticised. For the most part, the critics pointed out that there was no provision excluding the penal responsibility of administrators and persons in charge of the security of information systems, who use such software in the process of developing and testing protection for systems, or authors of antivirus software.³⁹ In order to eliminate the shortcomings, section 1a was added to Article 269b, reading as follows: “Anyone who acts solely with the purpose of securing an information system, an ICT system or an ICT network against the crimes listed herein, or with the purpose of developing such a security method, shall not be considered as committing the crime referred to in section 1”. The primary aim of the amendment was, however, to increase the upper limit of the statutory penalty for the crime to five years of imprisonment, which was justified solely by indicating the necessity to make it possible for one to subject the offender to the so-called extended forfeit, as provided for in Article 45 (2) of the PC.⁴⁰ This also met with fair criticism.⁴¹ No matter what the intentions of the authors of the amendment were, one should take note of the fact that, essentially from the moment of the inclusion of Article 269b (1) to the Penal Code (by way of the 2004 amendment), emphasis was on the sanctions (the power to impose a penalty of up to three years of imprisonment). The provision actually penalises the acts or actions performed by a criminal offender in order to prepare to commit the crimes set out in the provision, some of which are punishable by the same or lesser sanctions.⁴² As for other “shortcomings” of the provision, one should give attention, in the first place, to the fact that Article 269b of the PC does not include hacking, whether in the form of unauthorised access to information under Article 267 (1) of the PC or unauthorised access to an information system under Article 267 (2) of the PC, in the list of crimes (for the commission of which the creation, acquisition, sales and sharing of hardware and software are penalised).⁴³

As far as other shortcomings of Article 269b (1) of the PC are concerned, the provision mainly refers to software “adapted” to commit the crimes specified therein. A problem, therefore, arises in connection with qualifying the actions of creators of software serving several functions (the so-called dual-nature software),⁴⁴ which is then used by third parties for criminal purposes, contrary to the creator’ intent.⁴⁵ With the aim of complying with the ratio legis of that provision and avoiding excessive criminalisation, Włodzimierz Wróbel proposed that it be interpreted in line with the definition of punishable preparatory activities under Article 16 (1) of the PC, which requires that the offender creating or acquiring the tools listed therein acts with direct intent (or, as regards selling and providing access, with indirect intent).⁴⁶ As it seems, however, most representatives of the doctrine (except for Włodzimierz Wróbel and Dominik Zając, Joanna Piórkowska-Flieger, Barbara Kunicka-Michalska⁴⁷ and Andrzej Marek⁴⁸ are of the opinion that, in order for guilt to be attributed to the offender, it suffices that he/she has acted with indirect intent.⁴⁹

The Polish legislation on computer crimes undoubtedly needs change. First of all, the conceptual framework should be standardised. At present, in the light of the ratification of the Convention on Cybercrime, it is not necessary to define the concept of information (computer) data as the definition offered by it has the character of a self-executing norm and may be applied directly. In view of the broadly discussed doubts about the scope of the concepts of an “information system”, those should be defined. The same applies to the term “ICT network”.

I believe that limiting the scope of criminalisation under Article 267(1) of the PC to the cases of violation of the secrecy of correspondence should be considered, along with assigning the principal role in combating hacking (i.e. obtaining unauthorised access to an information system) to Article 267(2) of the PC, by adding the requirement that the offender mitigates or omits the magnetic, electronic, computer or other security feature (which would also conform to the content of Article 3 of Directive 2013/40 recommending such a solution⁵⁰).

It is also necessary to modify the Polish regulation of computer eavesdropping. Article 267(3) of the PC requires the direct intent of the offender, while no such premise is contained in Article 6 of Directive 2013/40. One should possibly consider leaving that provision as it is (or mostly as it is), and at the same time adding a provision (in conformity with Article 6 of Directive 2013/40) determining the act in relation to which the offence defined in the current Article 267 (3) of the PC would constitute the aggravated offence.⁵¹

Amendments to Article 269b (1) of the PC are also warranted. It appears necessary to limit the penal responsibility to direct intent, and to specify that it concerns the hardware and software “most of all” or “primarily” (as was used in the English-language version of Directive 2013/40) serving the purpose of committing crimes. Moreover, the list of crimes for which they could be utilised should be extended at least by the remaining acts under discussion. It would be also advisable to ease the sanctions.

2 Cyberterrorism: “Cybercrimes of a Terrorist Nature”

Framework Decision 2002/475⁵² was transposed into Polish legislation by way of the Act of the 16th of April 2004 Amending the Penal Code and Certain Other Acts.⁵³ As mentioned earlier, its provisions are similar to those set out in the Directive 2017/541/EU,⁵⁴ and the definition of a “terrorist” offence (in PC—offence of a terrorist nature) has a similar shape.⁵⁵ The Polish legislator, however, did not decide on its literal transposition, instead creating a more synthetic one (Article 115 (20) of the PC), whereby emphasis was placed on the criterion of the offender’s purpose. Similar to Article 1 (1) of Framework Decision 2002/475 and Article 3 (2) of Directive 2017/541, the following were listed alternatively as the offender’s purposes:

• (1) severely intimidating many people,

• (2) forcing a state authority of the Republic of Poland or other state, or a body of an international organisation, to undertake or relinquish certain actions,

• (3) causing serious disruptions in the political system or economy of the Republic of Poland, another state or an international organisation.

The second element of the definition in Article 115 (20) of the PC was formulated differently from the original definition in Framework Decision 2002/475 (and is, in consequence, different from that in Directive 2017/541). The list of crimes which, when committed for any of the purposes listed in the definition, are viewed as corresponding to terrorist acts was replaced with a formal criterion, a requirement that the offence was punishable by a maximum term of imprisonment of at least five years.. Therefore, this provision does not result in delictum sui generis but it makes any offence (a crime and a more serious act punishable by deprivation of liberty for a maximum term of imprisonment of at least five years), committed for any of the purposes listed in the definition, be considered an offence of a terrorist nature. Pursuant to the provisions set out in Framework Decision 2002/475 (and Directive 2017/541), an offence of a terrorist nature also includes threat to commit such a crime (Article 115(20) in fine).⁵⁶

In the light of the above definition, cybercrimes of a terrorist nature may be the following prohibited acts: Article 165 (1)(4) of the PC (causing danger to the life or health of many people, or resulting in large-scale damage to property), Article 268(3) of the PC (preventing one from accessing information, which results in gross material damage), Article 268a(2) of the PC (an attack on computer data or the processing of such data which results in gross material damage), Article 269 of the PC (an attack on computer data of special significance), Article 269a of the PC (disturbing the operation of an information system, an ICT system or an ICT network) and—paradoxically (see earlier remarks)—Article 269b(1) of the PC (offences connected with “hacker tools”).