Cyber Law Project: Cyber Law Compliance in University A's SMS System

This project is a comprehensive analysis of cyber law principles and their application to a Student Management System (SMS) implemented by University A in New South Wales, Australia. The project examines the legal framework governing data protection and cybersecurity, focusing on the Cybercrime Act 2001 and the Privacy Act 1988, as well as the regulations set forth by the Australian Cyber Security Centre. The report details the obligations of the university under these laws, including the need for robust IT infrastructure, skilled personnel, and stringent security measures to prevent cyberattacks like hacking and phishing. It emphasizes the importance of compliance to avoid penalties and protect sensitive student data. The project also outlines the potential consequences of non-compliance, including imprisonment and financial penalties. The overall goal of the project is to provide a practical guide for ensuring the security and legality of the SMS, highlighting the importance of adhering to cyber law in an educational setting.

Cyber Law
Project

Table of Contents
INTRODCUTION...........................................................................................................................1
MAIN BODY...................................................................................................................................1
Laws and regulations that needs to be comply with...............................................................3
Obligations under legislations................................................................................................4
Importance of obligations under various laws .......................................................................5
Things need to be done by the university...............................................................................8
Other areas to be considered...................................................................................................8
CONCLUSION......................................................................................................................8
REFERENCES................................................................................................................................9

INTRODCUTION
Cyber law is a branch of legal system which is applicable on the matters related with
internet, cyberspace and related areas (Ajayi, 2016). It is wider in context as it provides legal
provisions governing freedom of expression, access to and usage of internet and online privacy.
It is also called “law of the internet”. The report consists a case study in which all the laws which
needs to be complied must be with. Furthermore, obligations regarding policies and procedures
about cyber have been mentioned along with their consequences in case of breach or
contravention. Furthermore, other all supplemented areas which has compliance related to cyber
law have been mentioned.
MAIN BODY
In the given case, University A in NSW, Australia is considering to implement a whole
new Student Management System (SMS) in order to have better management of operations. This
will fulfils variety of requirements such as improved compliance, better response of University to
market conditions, to improve student experience and many more.
By looking into number of benefits such as reduced spend on compliance amendments,
minimised cost of student service, increased revenue generation, etc. Hence, after evaluating all
the alternatives, University has chosen to go for In-house built system.
In house built system involves activities whereby a product is produced by an entity
within the premises of an organization. In this process, a company does not rely on outsourcing.
Employees of the organization are used to build the product. It is suitable and can provide
number of benefits because people working in the organization possess better knowledge and
carries their functions in a better way. There is a co-ordination and familiarity of processes which
reduces number of risks (Hobe, 2017).
1

Student management system (SMS) is a software which is programmed to manage
routine operations of school and colleges. It contains information about every student which is
important. Furthermore, variations can be done in every system according to requirements of
customers. Generally, universities often choose in-built system for making software which can
be developed internally with reduced costs. There are software like SAP, J2E etc. which are used
for designing the software package that can fulfil needs of clients.
There are other considerations apart from cost which hold importance such as legislations
applicable on cyber system. Software and internet are two components which are used in SMS
for efficient working. It is huge in scope and includes related aspects of internet and software,
thus, legislations have been enacted which have objectives to protect people from cyber crimes.
These software consists confidential information of students such as account details, address, and
other important data which can not be disclosed publicly. Hence, Australian government has
passed laws and rules which are required to be followed by every school or university opting for
any software under Student Management System (Kundi, G. M. and et. al, 2014).
Cyber security refers to protection of internet connected systems including hardware and
software and data from cyberattacks. In Australia, Cybercrime Act, 2001 is for the security of
information that is contained in any software implemented by any education institutions,
organizations etc. The scope of this act extends to all the areas of Australia and defines computer
related act, event, circumstances or outcomes which might weaken security or affect operations
of a system.
2

Figure. 1. Cost spent by Australian Government
Laws and regulations that needs to be comply with
Privacy Act, 1988, this regulates management of personal information about people of a
country and in this context, the data of students in University A. this act provides handling,
storing, usage, accessing and correction of personal data which is confidential in nature.
Regulations provided by Australian Cyber Security Centre. There are legal provisions
which must be complied with in order to avoid legal consequences. Australian Cyber Security
Centre has provided certain requirements which should be there before proceeding with
development of SMS, these are as follows:
 Availability of Information Technology infrastructure. These includes hardware and
software which are updated with latest version of software. It reduces costs which can be
blocked in using outdated IT infrastructure (Lipton, 2015).
 Expertise to use the software by a person who is capable and equipped with adequate
knowledge and skills to handle and work on the system.
 Information about number of laws applicable on data that will be contained in the system.
 Adequate security for protecting hacking, phishing or any other cyberattacks.
3

There are many other requirements which should be fulfilled. However, before going for
implementation of SMS, various crimes as provided in Crimes Act, 1914 should be known. This
act helps in giving details about activities that can be termed as crimes. These are as follows:
 Hacking: Unauthorised access into a computer or computer networks. Person involved in
this illegal activity is known as hacker. It can change security features and make the
system weak. This can increase the chances of data theft. It is an illegal activity as
provided by Government of Australia. In an individual has entered without authorization,
modified or limited data then it will be assumed as hacking.
 Denial of service (DoS) attacks: According to s477.3, unauthorised impairment of
electronic communication is termed as DoS. There are two main points which should be
considered which are if the offence has been committed has resulted into any
unauthorised impairment of electronic communication or from a computer and the person
has knowledge about impairment being unauthorised (Nasu, H. and McLaughlin, R. eds.,
2014).
 Phishing: Phishing has been termed as an online fraud. The circumstances in which a
person has obtained properties of others on a dishonest basis or caused financial damages
then it will be included in the definition of phishing.
These are some common types of crimes from which information about students of
University A should be protected.
Obligations under legislations
The obligations of University A under various types of laws mentioned-above have been
elaborated as follows:
Cybercrime Act, 2001: Obligations of University A under this act are as follows:
 Not to allow any act which is unknown related to premises, computers, or
telecommunications services within the University.
 To gather information which can help with the whole system.
 To obtain a certificate from prescribed authority certifying that all the formalities have
been complied with and security has been incorporated.
 To restrict unauthorised access in the system (Radziwill, 2015).
 To maintain the reliability, security and authenticate any modifications done.
 Not to use personal information without respective person's authority.
4

Privacy Act, 1988: It holds legal provisions which are directed towards personal
information about individuals (Privacy Act, 1988, 2019). University A has to fulfil the following
obligations which are mentioned below:
 There is a requirement of development of internal privacy regulations.
 The telecommunications should be effective to have efficient flow of information.
 Any kinds of criminal records and anti money laundering should be notified.
 There should be Personal Property Securities Register maintained at the university.
 Right information must be provided to OAIC to be recorded in the registers.
 To entertain complaints and provide documents in case of any investigation being held by
Australian Information Commissioner.
Australian Cyber Security Commission:
These are equally important and should be completed without missing any important rule
which might affect significantly. Various obligations provided by ACSC are as follows:
 All users of software in the system should resent password for reducing risks of
credential compromises.
 Password must be lengthy and complex to decrease chances of brute force attack.
 Implementation of lockout for multiple failed logins attempts.
 In case, any unauthorised access has been noticed, the password must be reset or changed
immediately (Schmitt, M. N. ed., 2017).
 Avoid using same password for a number of times. Furthermore, sharing of password
should be prohibited.
 The password should not be an easy word from the dictionary or a combination of
personal data such as name and DOB. Along with this, recognisable pattern should be
avoided.
 In case of suspicious logins, there should be an automatic log out within few seconds of
login.
 Use of anti viruses to have safety against malware which can cause threats of stealing etc.
Importance of obligations under various laws
Cybercrime Act, 2001: The usages of Information technology has increased in the past
few years due to which people have become aware about pros and con of it. A work can be done
easily and accurately with the use of software. However, number of incidents have been seen in
5

previous years wherein many cyber crimes have been noticed. Personal information are
important to each individual which can not be made public. An organization opting for SMS
software should take care of data. Every protection must be provided to prevent cyberattacks.
Cybercrime Act, 2001 must be followed in order to have meanings of various terms which can
be considered as crime. Furthermore, there are offences and their punishments/penalties which
can be awarded if any crime has been committed by a person. Along with this, requirements
imposed by this act is to make sure that unauthorised access are restricted, and personal
information of students can not be shared without their permission. Furthermore, by following
the legal provisions under this act, IT infrastructure can be contained in a reliable and secured
form. Also, the certificate so obtained can be used as an evidence in the matter of disputes
(Roscini, 2014).
Non-compliance of any of the obligations under this Act will amount to offences which
have penalties provided below:
 Unauthorised modifications of information which has caused or likely to cause
impairment, any person guilty will be punished for a maximum of 10 years
imprisonment.
 Unauthorised impairment of electronic communication who has committed this offence
will be punished with imprisonment of 10 years.
 Unauthorised access to, or alterations of or restriction of data will held a person liable for
imprisonment of 2 years.
 Unauthorised impairment of data held on a computer disk has the penalty of maximum 2
years.
 Possession or control of data with the intention to commit computer offence, the penalty
for this is about maximum 3 years.
 Production, supply or obtaining data with the intention of committing offence in the
computer system, in such case the penalty will be maximum 3 years.
 An individual having knowledge of a computer or computer system and assisting access
in the system will be imprisoned for maximum 6 months.
Privacy Act, 1988: This act is intended to safeguard personal information of individuals
and to protect against any breach by transferring data to a third party without getting permission
from concerned individual. The obligations provided by this act gives a base to the organization
6

for collecting, using, keeping and disclosure of data. In context of University A, information of
students must be kept in the same way as mentioned in this Act. Furthermore, it helps increasing
better access to system which can help in preventing misuse of data (Obligations under ACSC
regulations, 2019).
Furthermore, complaints in the system can be forwarded to prescribed authority and in
case of any incident in which there are possibility that security might have affected, then request
for investigation can be requested. Also, there are elements such as reliable, accurate, timely etc.
data should be kept which reduced risks of irrelevant information being included in the system.
Furthermore, criminal actions and offences are to be recorded separately which mitigates
wastage of time in separating the data into different classes. The Criminal Code provides
offences and their related penalties and imprisonment.
Any person who has breached or contravened one or more above-mentioned obligations,
then that individual will be penalised according and have to pay penalty units. In such cases,
Commissioner is empowered to pass an order to pay penalty (Sabillon, Cavaller and Cano,
2016). In case of a civil penalty provisions:
 serious or repudiation of interference with privacy will amount to 2000 penalty units.
 In case of multiple penalty provisions, it can range from 500 to 2000 penalty units.
 Unauthorised collection, use or disclose or data- penalty will be 120 units or
imprisonment for 2 years or both.
 Transferring of information outside University premises- 120 penalty units or
imprisonment of 2 years, or both.
Regulations by Australian Cyber Security Commission:
ACSC is one of the authorities who provides obligations which is mandatory to fulfilled.
It works on increasing existing level of security by focusing on changing passwords on a timely
7

manner. There are certain rules which should be followed as mentioned. These are intended to
make password of a system strong so that hackers can not break or weaken the security. The
personal information should be protected against all viruses by installing anti virus. This helps in
preventing malware, phishing etc. so that no alterations in the original data is done. Furthermore,
stealing of information is prevented if there is a difficult password. In case of any breach in any
of the above-mentioned obligations, the defaulting person can be convicted (Shackelford, 2014).
There are offences and penalties which will be awarded in case of any breach. University
A together with the officials involved in the offence will be held liable and awarded fines or
sentenced imprisonment.
Things need to be done by the university
University A should demonstrate all its students about number of legislations applicable
on it. Furthermore, various terms should be explained which might have different meaning. This
is to enhance the knowledge about laws protecting cybercrimes and attacks. This helps in
keeping the trust and reliability on the system which is going to be used by students.
Furthermore, offences and their related penalties will be elaborated so that no one tries to
contravene legal provisions. This will help all the students to upload their personal information
and related data which might be significant for the university. Along with this, modifications can
be done as and when they occur (Smyth, 2014).
Other areas to be considered
With the compliance of cyber law, there are other areas which needs to be concentrated.
Following laws are not sufficient, University should focus on rules that are additional but
important. Along with this, all the amendments must also be considered which might have the
potential impact on working of system. Furthermore, the software should be updated on a timely
basis along with anti virus software to protect data being misused. Furthermore, a strong and
complex password must be given to students which is to be reset accordingly to have more
security.
CONCLUSION
From the above report, it has been concluded that with the increase in usage of internet
and relying on computer system have raised need for having laws that will protect the
information. Various legislations which are compulsory to follow have been enacted to safeguard
8

personal information of individuals. Furthermore, various software should be analysed before
choosing one and the one which fulfils all the requirements should be chosen. Along with this,
there should be a team dedicated to handle the matter regarding IT. In addition to this, people
working on system should be given adequate knowledge about legal provisions and awareness
about not to breach any obligations or law.
9

REFERENCES
Books & Journals:
Ajayi, E. F. G., 2016. Challenges to enforcement of cyber-crimes laws and policy. Journal of
Internet and Information Systems. 6(1). pp.1-12.
Hobe, S., 2017. The IISL Assumes Responsibility for Questions of Cyber Law. German Journal
of Air and Space Law (ZLW). 66. p.647.
Kundi, G. M. and et. al, 2014. Digital revolution, cyber-crimes and cyber legislation: A
challenge to governments in developing countries. Journal of Information Engineering
and Applications. 4(4). pp.61-71.
Lipton, J., 2015. Rethinking cyberlaw: A new vision for internet law. Edward Elgar Publishing.
Nasu, H. and McLaughlin, R. eds., 2014. New technologies and the law of armed conflict. TMC
Asser Press.
Radziwill, Y., 2015. Cyber-attacks and the exploitable imperfections of international law. Brill.
Roscini, M., 2014. Cyber operations and the use of force in international law. Oxford University
Press, USA.
Sabillon, R., Cavaller, V. and Cano, J., 2016. National cyber security strategies: global trends in
cyberspace. International Journal of Computer Science and Software Engineering. 5(5).
p.67.
Schmitt, M. N. ed., 2017. Tallinn manual 2.0 on the international law applicable to cyber
operations. Cambridge University Press.
Shackelford, S. J., 2014. Managing cyber attacks in international law, business, and relations:
In search of cyber peace. Cambridge University Press.
Smyth, S. M., 2014. The Greening of Canadian Cyber Laws: What Environmental Law can
Teach and Cyber Law can learn. International Journal of Cyber Criminology. 8(2).
Online:
Privacy Act, 1988. 2019. [Online]. Available through: <https://www.oaic.gov.au/privacy-law/>.
Obligations under ACSC regulations. 2019. [Online]. Available through:
<https://www.oaic.gov.au/privacy-law/privacy-act/notifiable-data-breaches-scheme/
information-from-the-australian-cyber-security-centre-about-preventing-and-mitigating-
data-breaches>.
10