Posts on this blog represent my opinion. It may be my considered opinion on the basis of my formal study of law and technology. But it is not legal advice. It must not be treated as, or acted upon as, legal advice and no liability is accepted for doing so.

Monday, 6 July 2009

What is a Computer?

(A word of warning: more so than normal, this blog entry is my opinion, and does NOT constitute nor should be relied upon as legal advice.)

Readers might be forgiven for thinking that the answer to the question posed by the title of this entry is, quite literally, staring me in the face. Yes, I’m typing this blog on what it quite unquestionably a computer. But what else counts as a computer? A PDA? Yes, no question of it. A smartphone? Almost indisputably, especially given that my iPhone is far more powerful than many PDAs, or indeed many portable computers of only a few years ago. But what about a digital camera?

My question isn’t purely academic. As a keen photographer I’ve followed with both interest and concern the growing number of accounts of photographers being stopped and searched under anti-terror legislation, or harassed by security guards, again often on the pretext of security. A common feature of such incidents is the demand that the photographer delete images on his or her camera. And this explains my question, because I think there is a good case to be made that to do so is illegal under the Computer Misuse Act 1990.

It turns out I have company in high places in this regard. Lord Carlisle, in his 2008 annual report on the operation of the Terrorism Act 2000, notes with concern reports of the use of recent anti-terror legislation against photographers (see paras 195 to 197) and specifically comments that police officers who use force against photographers to, for instance, make them delete photographs, risk liability for both disciplinary and criminal proceedings. What I am suggesting is that irrespective of other liability under such legislation as the Police and Criminal Evidence Act 1984, the CMA may well provide specific protection to photographers.

(As an aside, there is a simple and practical approach to dealing with such incidents: comply with the demand, and then use readily-available data recovery utilities to recover the deleted files later, so long as no new pictures have been recorded on the memory card in question. But that doesn’t address what I consider to be the unjust nature of the demand in the first place.)

The relevant part of CMA 1990 is section 3, as recently amended by the Police and Justice Act 2006. S.3 provides that it is an offence for a person to, knowing that the act is unauthorised (s.3(1)(b)), prevent or hinder access to any program or data held on a computer (s.3(2)(b)). If a digital camera counts as a computer for the purposes of CMA 1990, then deleting a photograph from it would constitute preventing or hindering access to data held on it. (Even if the image was recoverable, it would still count as ‘hindering’.) The relevant questions are therefore whether a digital camera does count as a computer and whether a demand by a police officer or security guard to delete photographs is deemed to be unauthorised.

The second question is the easier one to answer. S.17(5) CMA 1990 says that access is unauthorised if it is by someone who would not be entitled to control access to that data, and who does not have the permission of someone who does. The only person entitled to control access to a computer owned by me and in my possession is me; the same applies to any device that counts as a computer for the purposes of CMA 1990.

Now, s.10 CMA 1990 does provide certain exemptions for law enforcement, and in particular it says that access by a constable or other investigating officer is not unauthorised even if done without consent. However, it very also very clearly states that this only applies to the offence created by s.1(1) CMA 1990, that of gaining unauthorised access to computer material. It does not apply to s.3. So, in the context of a camera, an officer may look at pictures stored on it in the course of a lawful search because s.10 makes such access lawful. But s.10 does not make it lawful to infringe s.3 by deleting them.

All this of course presupposes that a digital camera is a computer, at least as far as CMA 1990 is concerned. Unfortunately, whilst the Act includes a lot of other definitions, it is silent as to what a computer is; whoever drafted the act evidently thought it obvious. It probably was obvious in 1990, when even the advent of PCs had not changed the understanding that a computer was a box that you typed data into and which gave output in text or graphics on a screen or via a printer. But, as I noted earlier, today we see a much wider range of devices as being computers. As I said, my iPhone is almost certainly one by any reasonable definition. Now, it incorporates a camera (quite a good one, as I have one of the new 3GS models) and I am confident that there would be a very strong case that if anyone tried to make me delete pictures on my iPhone or attempted to do so themselves then they would be committing an offence under s.3 CMA 1990.

But the iPhone is a general-purpose device, not one dedicated to photography. (Yes, I know it’s strictly a phone. But it is really a small, powerful PDA with a phone built in, as is clear from the way Apple will sell you an iPod Touch that is almost identical but sans phone.) My Canon digital SLR is made for the sole purpose of taking photographs; it is definitely more of a camera than my iPhone, but is it also less of a computer?

How have other countries sought to define computers? Singapore’s Computer Misuse Act is closely modelled on the UK Act, but with additional explanatory material that defines a computer as

an electronic, magnetic, optical, electrochemical, or other data processing device, or a group of such interconnected or related devices, performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such devices, but does not include an automated typewriter or typesetter, a portable hand held calculator or other similar device which is non-programmable or which does not contain any data storage facility.”

Would this include a digital camera? It mentions both electronic and optical elements, together with data storage – all of which a digital camera possesses. The exclusions seem to me to relate to devices that cannot store data or run software. Digital cameras clearly do the former, and indeed can run software too, as is seen from the patches posted by manufacturers.

If we accept that the Singaporean definition of a computer is a reasonable one (and speaking as someone who’s been studying computers one way or another since the mid-1980s, it seems eminently sensible to me) then it is hard to avoid concluding that English law should recognise a digital camera to be a computer for the purposes of the CMA 1990. If so, then s.3 makes it an offence to delete, or seek to force someone to delete, photographs from such a camera without lawful authority, and as the s.10 exception does not apply to s.3, mere investigation does not provide such authority.

Does this mean that I think that anyone told to delete photographs should refuse to do so and cite s.3 CMA? As I said earlier, this post is not legal advice and must not be taken as such. What people do under such circumstances must be up to them; however, I feel that should a complaint about forced deletion of photographs be pursued, then the s.3 CMA aspect is at least deserving of consideration.

11 comments:

Ken Brown said...

OK, so what about my little blue chip? That SD card is where the pictures are stored. (And any other files I choose to store there). And I regularly take the card out and put it in other computers, even ones that look like computers.

Is my camera still a computer without it? And even if it isn't, is the card on its own a computer without the camera or other CPU (pretty obviously not)

Can the police say they are deleting files from this dumb card, not from any computer?

marypcb said...

that's particularly interesting given the amount of extra features being added to digital cameras. Not just sound and video recording but facial recognition, in-camera rotation and panoramic stitching and video processing. my camera does green-screen-free chromakey background removal and replacement on digital video (shoot video, subtract background, insert new background). However, these are all photographic features, making it a special purpose, dedicated computer - which may refute your point. My gut feeling is that no, a camera is not a computer, because it is a special purpose not a general purpose device and because you cannot install new software or a new OS and give it different features that are nothing to do with the original device. Even a camera with a game on would still be a camera with a game on. But a camera with Flash and the option to load new games; that would cross the line. A working definition for a statuary instrument would be worse than the list of allowed electronics on a plane!

@Ken - most cameras have internal storage for one or two images, for the purposes of letting punters play with them in the shop. They also all have an internal storage buffer. A hard drive can be removed from a computer, but it's - by the Singapore definition - part of it.

Simon Bradshaw said...

Ken

Good point. Another way in which the CMA is becoming outdated is that it doesn't seem to distinguish well between data held on a computer and that data when removed. Even after s.3 was recently amended, it still refers to 'data held in any computer'. If the card is on its own, then it's not in a computer.

Having said that, to delete the files, the card would have to be put into a computer. And it would then be 'data held in any computer' (just not your computer) but deleting it would still be unauthorised, as it's your data and you weren't consenting to its deletion. So I would argue that s.3 still applied.

Of course, you could just destroy the SD card, but that would be good old-fashioned Criminal Damage.

(Interesting question: would using a magnet to wipe a removable hard drive whilst it was out of a computer contravene s.3 CMA or be criminal damage? I'm not sure it would.)

Frank Wales said...

Separately from all this, is there also not a case to be made that deletion of the images constitutes tampering with evidence, in that presumably the pictures are allegedly unlawful?

Otherwise, what's the basis for complaining about them in the first place?

Simon Bradshaw said...

Frank,

Well, that presupposes that taking the photograph was illegal. Lord Carlisle strongly expresses the view (and a lot of photographers will be glad to hear it) that the controversial s.58A TA 2000 (as recently inserted) does not, under any normal circumstance, make it an offence to photograph a police officer.

pangloss said...

Section 3 is now so wide since the PCEA changes it can be all things to all men (the bit you omitted I think is the change just made removing "modification" and replacing it with "act" in s 3- that was to enable prosecuting DDOS but it also enables your camera argument.) I just proved it could be used to prosecute spam in ra book..

Al I can say is it may be literally possible (and I don't think the definition of computer is the big sticking point - if you look at the Law Comm that preceded it was deliberately not defined so it could fit what technologies came along) but you'd have trouble persuading a prosecutor I suspect -- tho a civil prosecution is still possible (isn't it?) Section 10 only applies to s 1 access onoly, because no one in 1990 contemplated a policeman would ever want to do anything but gain unauthorised access - why would they want an exemption to allow them to send viruses??. I strongly suspect a court would dig up a common law power of PCs implying some kind of common law exemption to allow for s 3 intrusions by PC Plod. (Indeed if anyone ever notices that the police DO use Trojan viruses to investigate these days - ask B and Wiebke - there'll be a change to s 10 in there befoe you can say knife.)

The point you mention in passing is that the CMA s 3 was exactly brought in because they were doubts criminal damage applied to intangible and restorable things like data - couldn't criminal damage be used here in that the camera 9a tangible) is damaged by having its photos deleted?

I also wonder vaguely with the mention of the IP in the camera if there isn't something there about circumventing technological protrectios for copyrt put in place by the rights holder ..:-)

In my heart I feel this is aclar civil liberties issue re police powers and since this will be a campaign issue not a litigation really it should be faced head on as such - but I know that wasn't your point.

(Btw did you see today BT dumped Phorm??)

pangloss said...

Oops I meant PJA not PCEA sorry..

alexmc said...

> when even the advent of PCs had not changed the understanding that a computer was a box that you typed data into and which gave output in text or graphics on a screen or via a printer

That covers every digital camera I know of. And *yes* most of them are programmable.

I cannot see how any argument that a digital camera was not a computer could possibly work.

The best they could hope for would be to argue that an embedded microprocessor was no more than a smart machine part - and that doesnt really apply for a digital camera.

An alternative argument - that they are just peripherals - might work for something like a web cam, but not for something as interactive as a camera.

alexmc said...

Pangloss wrote:
(Btw did you see today BT dumped Phorm??)

URLs?

Simon Bradshaw said...

Pangloss - I rather doubt a common-law power would apply; the whole point of PACE 1984 was to put police powers on a statutory footing. The fact that s.10 CMA 1990 was felt necessary indicates to me that any act on arrest or investigation needs specific statutory authority, but I'd welcome comment on this from anyone more familiar with police legislation.

Richard Jones said...

As a computer programmer, I find it funny that you're trying to decide if your Canon digital SLR is a computer or not. I'll let you out of your misery:

Virtually any Canon Powershot D-SLR is unequivocally a computer. You can write and upload your own software to it (see: chdk.wikia.com). It has a screen and a keyboard. You can program it to make it do general purpose computation, not solely related to photography, but any computation you like within the limits of the available CPU and memory on the camera. It runs a general purpose operating system similar to (though not the same as) the OS on your desktop. Programs are written in the same language (C) as you would write programs for your desktop computer.

Or let me put it another way. If the Canon Powershot models mentioned on the page above (and the same applies to many other manufacturers and models), if those aren't computers, then the desktop machine I'm typing this on isn't a computer.