Computing related legislation

Allow other suitable answers relating to examples of other types of surveillance e.g. CCTV, directed surveillance.

MP4 relates to password protected data or accessing data protected under the DPA

Examiner’s Comments

There were a number of candidates who could not accurately name one additional power.

Accept: Right to see their own data/change if incorrect

Examiner’s Comments

This was generally well answered and candidates showed good understanding of the Data Protection Act (DPA) principles.

<html>
<head>
<title>Robot User
Interface</title>
</head>
<body>
<h1>Robot directives</h1> <ul>
<li>Serve the company trust</li>
<li>Protect data</li>
<li>Uphold standards</li> </ul>
<a
href="updates.html">Updates</a> <p>Login</p>
<form action="dologin.php"> Password
<input type = "text"
name="pw">
<input type = "submit"> </form>
</body>
</html>

HTML tags are not case sensitive

Correct answer only

Examiner’s Comments

Generally well answered and many candidates gained full marks with most being able to gain at least two.

Ignore presence or lack of <style> tags. Ignore lack of semicolons

Penalise misspelling of "color" once and then FT

h1 {
color:white;
background-color: red;
}

White can be #FFFFFF or #FFF Red can be #FF0000 or #F00

Examiner’s Comments

Many candidates were able to gain

full marks. The most common reasons candidates lost marks was through the use of quotes around the colour equals instead of colons and for misspelling colour

Must be full name of Act for MP1 FT for versions of Copyright or nothing for MP2-6

Examiner’s Comments

Many candidates were able to gain 2 marks but many did not give the full name of the legislation.

Do not accept just "ask permission"

Examiner’s Comments

Many candidates were able to gain 2 marks. It was surprising to see how many believed that you could use copyright images for your business just by crediting the artist.
Candidates should be made aware that although crediting the artist may help avoid plagiarism it does not allow you free use of a copyright image.

The following shows example content that may form part of a candidate’s answer. It is not intended to be an exhaustive resource, nor should a candidate be expected to specifically cover any particular amount of this.

Knowledge (AO1)

• Implements additional rights regarding surveillance / monitoring of individuals and acquisition of communications data

• Provides the right for many organisations (including the Police and security services) to do this.

• Purpose is to detect crime and defend national security (e.g. terrorism, public disorder)

• Gives access to individuals’ private communications, such as emails, text messages, phone calls, Internet history.

• Some people feel this is an invasion of their privacy

Application (AO2)

• Monitoring can be carried out by far more organisations than just the Police and Security services – for example, local councils, the pension regulator and the Environment Agency are all able to use surveillance or request data about individuals.
• If files are encrypted, the Act gives powers to force the handover of keys (from individuals or organisations) with a 2 year prison sentence possible on refusal.
• Wide ranging powers have allowed Police and Security services to intercept criminals’ communications and stop / disrupt crime.

Evaluation (AO3)

• In the modern world, it is important that Police and Security services are given the power to deal with electronic communications in this way. Many crimes (e.g. terrorism) can be detected and stopped before they occur, making the public safer.
• However, some say that it is now a “snooper’s charter”, with more organisations using their powers for minor offences such as detecting

those lying about their address to get children into a better school or fly-tipping.

• Many communication tools (e.g. WhatsApp) now include end-to-end encryption by default so that messages cannot be divulged by the organisation because they do not have access to it. Other encryption tools include plausible deniability.

Examiner’s Comments

Responses to this question were varied, some candidates showed a clear understanding of the powers and to whom they are given. Some were aware of the powers but focused on the police or security services in their response. Some went off track, talking about other countries. In general this was not answered well and candidates tended to have a one sided view of the act.

Examiner’s Comments
Most candidates were able to gain 1 mark for this question, but few went on to gain a second mark.

Knowledge: Benefits
Customer:

• Personalised offers

Business:

• Targeted adverts
• Able to track movement habits of customers
• Provide more personalised shopping experiences.

Drawbacks
Customer:

• Personal intrusion
• Invasion of privacy
• Pressured selling

Business:

• Cost of infra structure
• Viewed as invading personal privacy

Moral and Ethical issues

• Violation of civil liberties
• Recording people on the street who are not going into the shop

Legal issues:

• under data protection laws the shop would need to o Keep any data recorded secure o Personal data should be accurate and up to date

Application:
Benefits
Customer:

• Personalised experience will lead to more convenient shopping trips
• Staff will give personalised service

Business:

• Tracking movement of customers means able to identify best opening times

• Tracking customers around shop allows better analysis of popular products

• Use of modern technology will make the shop be seen as forward thinking.

Drawbacks
Customer:

• Customers may not want to be “pressured” meaning they decide not to shop there anymore.
• Tracking data could be hacked and used by criminals

Business:

• Extra hardware costs may lead to higher prices/competitors undercut them.
• Customers who feel their privacy has been invaded may “vote with their feet”

Moral and Ethical issues

• Abuse of civil liberties could damage reputation of shop

Legal issues:

• Shop may need to add extra software to blur out faces of non-customers
• Shop will need to spend more money on data protection compliance, leading to higher costs.

Evaluation:
Benefits

• Increased revenue from directed sales offset extra costs from hardware/legal obligations
• Improved reputation through use of modern technologies may attract more customers

Drawbacks:

• Loss of customer base due to customers unhappy with “pushy techniques”
• Poor public opinion from invasive advertising puts new customers off.

Examiner’s Comments
Candidates were assessed on the quality of their extended response in this question.

Most candidates understood the basic concept of storing personal details being a violation of customers civil liberties. Few candidates had a balanced discussion and focused too heavily on the negative aspects of this system therefore being restricted to a mid-level mark.

AO1
Computer Misuse Act is legislation aimed at criminalising unauthorised access to a computer system Three stages:
Unauthorised access to a computer system
Unauthorised access with intent to commit further offences
Unauthorised modification of computer material
Punishable by up to twelve months in prison and an unlimited fine.

AO2
Computer users who investigate how systems work require authorisation in order to not break the Act.
Examples such as changing a social media post on a friend’s mobile phone potentially breaks all three sections of the Act.
Investigation of systems can break the Act without intent, e.g. by changing server logs because of their

actions.
Users must be aware of the Act (as with any other law) in order to be responsible.

AO3
Material available online (e.g. self study videos) that explain how systems work and teach without the need to investigate using
unauthorised access.
Investigating systems that you own yourself or have authorisation to access does not break the law. Systems are offered to users with strict conditions attached and investigation is not a legitimate excuse for breaking the law. Ethical / white hat hackers will not break this law because they have authorisation.
Grey and black hat hackers will break Computer Misuse Act.

AO1
Encryption means that data is scrambled so that if it is intercepted, it cannot be understood.
Requires the use of a key to decrypt. Symmetric encryption uses on key

for encrypt/decrypt and so key exchange is problematic.
Asymmetric encryption uses different keys (public and private) so no need to exchange keys.
Regulation of Investigatory Powers Act (RIPA) gives authorities the power to compel disclosure of encryption keys

AO2
Encrypted messages cannot be read by outsiders without the key RIPA gives Police the power to insist on users decrypting messages / handing over the key to allow reading of messages.
Many messaging services already include end-to-end encryption by default
Use of VPNs to re-route traffic and attempt to escape monitoring possible
The ending of encrypted data shows that two parties are passing information they want to keep secret. Techniques like steganography can be used to his the existence of encrypted data.

AO3
Monitoring communication runs the risk of revealing secret but non-illegal communications
Restricting encryption means that secure sites (eg banks) may struggle to function
Legislation (RIPA) already ensures that communications can be monitored if there is just cause Routine monitoring runs the risk of false-positives
However, will reduce risk of illegal activities being co-ordinated (e.g. terrorism, drug trafficking).