LAWS526 - Cyber Law: Analysis of New Zealand's Cybercrime Strategy

This document provides a student's analysis of various legal aspects of cyber security, primarily focusing on New Zealand's cyber security strategy and related legal challenges. It addresses the four goals of New Zealand's Cyber Security Strategy: cyber resilience, addressing cybercrime, cyber capability, and international cooperation, emphasizing the importance of addressing cybercrime to protect critical infrastructure and national security. The analysis includes a hypothetical case involving a flaw in a car's voice-operated lock system, discussing potential legal ramifications under New Zealand's Criminal Act 1961. Furthermore, it delves into the concept of ethical hacking, its benefits in identifying vulnerabilities, and the associated legal risks. The document concludes by highlighting the broader importance of cyber security as an organization-wide information governance issue, addressing the financial and reputational risks associated with cyber attacks and the necessity of robust security measures.

Running head: LEGAL ASPECTS OF CYBER SECURITY
Legal aspects of Cyber Security
Name of the Student
Name of the University
Author Note

1LEGAL ASPECTS OF CYBER SECURITY
Table of Contents
Section A....................................................................................................................................2
Section B....................................................................................................................................3
Section C....................................................................................................................................5
Section D....................................................................................................................................7
Bibliography...............................................................................................................................9

2LEGAL ASPECTS OF CYBER SECURITY
Section A
Response to Question One:
The Cyber security strategy of New Zealand contains four goals, chiefly: cyber
resilience, addressing cyber crime, cyber capability and international cooperation. The
addressing of cybercrime is one of the four major goals set by the nation. A properly
functioning cyber space has significant benefits for the public of New Zealand. Digital and
technology and the internet allow the general mass to access various services on the web and
connect with the world forum. The critical infrastructure of New Zealand includes finance
and banking, transportation, telecommunication and energy sectors which are heavily
dependent on the digital system. Several government agencies use digital documentation
management and the internet to perform everyday business processes. The online services are
utilized by the citizens of the country to perform official or personal work. With the ever-
increasing reliance and use of the Internet and other digital technologies tags along with itself
an increased exposure of vulnerabilities leading to cyber threats. Cyber attacks have become
sophisticated and advanced in the recent past and addressing such crimes are of utmost
importance. The cyber attacks that are launched are mostly on intellectual property and also
additional important proprietary information held by the businesses or by certain individuals.
The cyber attackers are found to be properly coordinated, funded properly and invest hugely
in adopting modern techniques to exploit the digital ecosystem and draw information out of
the system. New Zealand is not completely immune from such intrusions and attacks. Any
successful targeted attack on the critical infrastructure and the critical services will negatively
impact the economy of New Zealand which in turn threatens the national security of the
country. Cyber attacks easily interfere with production and delivery of indispensable services
or lead to the stealing of personal information or other intellectual property. The addressing

3LEGAL ASPECTS OF CYBER SECURITY
of the cyber crimes must meet and address the challenging nature of the ever growing and
efficient and effective security threats. It is important for New Zealand to ensure its cyber
security activities, address the cyber crimes as coordinated as possible to identify the udrlying
risks and mitigate any emerging cyber risks and threats. It is of significant importance as the
government holds the responsibility to protect its critical assets so that business processes can
be run smoothly without any external intervention. The addressing the cyber crimes involves
the government to ensure a safe digital environment for the conduction of business process
and operation of the tasks. If there are business operations using cloud services, stringent
security protocol needs to be implemented to secure the network channels. The identified
technological issues in the system involve several soft spots on the network channel of the
overall working process of the government. The government has taken up measures to curtail
overwhelming scams. There are several underlying weak spots in the system, which are not
apparent. If proper back door checking and analyzing is not done to identify and patch the
spots noticed, these spots opens up gaps for malware to enter the system. The workers using
the IT services if are not well equipped and hold considerable knowledge about the system
can unknowingly open up ports for cyber attack. It is of crucial importance to maintain
periodic surveillance on the network system on the nation.
Section B
Response to Question Two:
Peerless Cars Inc is luxury sports car maker. The car manufactured by the company has
a worth of $200,000 in the market. The sports car uses advanced lock technology which is
completely voice-operated. The locks work in this fashion: the name of the lock is
pronounced by the consumer with a four digit combination. The electronic lock identifies the

4LEGAL ASPECTS OF CYBER SECURITY
voice of the customer and the four digit code to unlock the lock. The lock password can be
set and altered following the techniques set by the manufacturing company. Delia who
bought a PCI car spend days understanding the working of the digital lock. It was found by
her that an unusual sound causes the voice-recognition device to send a (-1) signal to the set
program of the computer. This was the flaw in the programming of the digital lock which
unlocks every car’s lock regardless of the four digit combinations fed into the system. Dalia
then have uploaded the particular sound on her website making the flaw public. The uploaded
file can be easily downloaded containing the sound file and can be used unethically to unlock
all of PCI cars available. The Criminal Act 1961 of New Zealand, subsections 216B and
216C can be used upon Delia for purposefully and intentionally sabotaging the electronic
lock system of PCI cars. Subsection 216B penalizes a person if he or she is intentionally
intercepts any private communication by using an interceptive device1. This is truly stands for
the case of Delia who purposefully intercepted the communication system of the car,
jeopardizing the security if PCI cars. Delia is under obligation of subsection 216C provides
jail time of 2 years to perpetrators who discloses the private communication2. Dalia in her
case has publically pointed out the flaw in the electronic lock communication system on her
website. She breached the law disclosing the private information of the company on her
website. These subsections can be used to bring Dalia to the books. Dalia can use potential
alibis for her case as she can state that she did it out of interest to understand the working of
the smart electronic lock. She can also state that it was important for the company to identify
the flaw in their lock system which could cause potential damage to property and theft of
property. In a way she has helped the company to identify the vulnerability in their voice
1 Legislation.govt.nz. 2019. "Crimes Act 1961 No 43 (As At 28 September 2017), Public Act Contents – New
Zealand Legislation". Legislation.Govt.Nz.
http://www.legislation.govt.nz/act/public/1961/0043/137.0/DLM327382.html.
2 Legislation.govt.nz. 2019. "Crimes Act 1961 No 43 (As At 28 September 2017), Public Act Contents – New
Zealand Legislation". Legislation.Govt.Nz.
http://www.legislation.govt.nz/act/public/1961/0043/137.0/DLM327382.html.

5LEGAL ASPECTS OF CYBER SECURITY
system to improve the working of the electronic device. The mentioned points can be her
reasonably applicable defenses.
Section C
Response to Question Five:
Ethical hacking is referred to as an ethical way to penetrate into a computer system,
application, network or any other technological resources on behalf of its owners3. The
ethical hackers or the white hat hackers intercept a computer system with the permission
taken from the respective owner. The underlying motive of ethical hacking lies in the
discovering of vulnerabilities and soft spot with the computer system and network system,
which when spotted by a malicious hacker, could use it to exploit the network or the
computer system4. The purpose of the hacking is to strictly evaluate the security patches
within the system and improve the weaknesses noticed inside of the computer or the network
system5. Ethical hacking involves by passing security protocols with the acknowledgement of
the owner to fix the security concerns6. The hackers do not use the vulnerabilities but provide
the organization or the enterprise to remediate their weak security protocols. The ethical
hackers come across security exposures in the system configuration, the system can be a
known or an unknown platform to seek out for operational weaknesses7. Ethical hackers use
3 Berger, Hilary, and Andrew Jones. "Cyber Security & Ethical Hacking For SMEs." In Proceedings of the The
11th International Knowledge Management in Organizations Conference on The changing face of Knowledge
Management Impacting Society, p. 12. ACM, 2016.
4 Hartley, Regina, Dawn Medlin, and Zach Houlik. "Ethical Hacking: Educating Future Cybersecurity
Professionals." In Proceedings of the EDSIG Conference ISSN, vol. 2473, p. 3857. 2017.
5 Thomas, Georg, Oliver Burmeister, and Gregory Low. "Issues of Implied Trust in Ethical Hacking." ORBIT
Journal 2, no. 1 (2018).
6 Regalado, Daniel, Shon Harris, Allen Harper, Chris Eagle, Jonathan Ness, Branko Spasojevic, Ryan Linn, and
Stephen Sims. Gray Hat Hacking The Ethical Hacker's Handbook. McGraw-Hill Education Group, 2015.
7 Nicholson, Scott. "How ethical hacking can protect organisations from a greater threat." Computer Fraud &
Security 2019, no. 5 (2019): 15-19.

6LEGAL ASPECTS OF CYBER SECURITY
the same tools to penetrate into the computer or network system but with the permission and
acknowledgement of the owner, ethical hackers do not exploit the identified vulnerabilities8.
There are potential risks in ethical hacking, legal in nature as well. The legal risks of ethical
hacking include lawsuits due to divulgence of personal, sensitive or confidential
information9. The disclosure of sensitive and confidential information can cause a legal battle
field between the ethical hacker and the involved organization. The hacking process makes it
easier for the hacking to turn into legal battle. When a hacker is enters a system, he comes
across valuable information about the organization and any leak of those information can
cause severe damage to the organization and its reputation10. There is a chance where the
ethical hacker might commit some error which can lead to a negative impact on the
organization’s revenue. Occurrence of such a circumstance can implore the organization or
the enterprise to sue the white hat hacker for poor performance. The ethical hacker runs a
chance of falling into legal risks if proper precaution is not taken. Inefficient performance can
put the hacker into a legal battle. So it is important for the ethical hacker to take up a
defensive state when performing his job on the client’s network or system. The ethical hacker
can use the acquired information against the company in the future if there is a bad air
between them this will cause huge damage to the organization as all the confidential
information will be leaked which can be taken up by the competitors in the market to earn an
added edge in the business.
8 Patil, Sonali, Ankur Jangra, Mandar Bhale, Akshay Raina, and Pratik Kulkarni. "Ethical hacking: The need for
cyber security." In 2017 IEEE International Conference on Power, Control, Signals and Instrumentation
Engineering (ICPCSI), pp. 1602-1606. IEEE, 2017.
9 Sinha, Sanjib. "Legal Side of Hacking." In Beginning Ethical Hacking with Python, pp. 3-3. Apress, Berkeley,
CA, 2017.
10 Trabelsi, Zouheir, and Margaret McCoey. "Ethical hacking in Information Security curricula." International
Journal of Information and Communication Technology Education (IJICTE) 12, no. 1 (2016): 1-10.

7LEGAL ASPECTS OF CYBER SECURITY
Section D
Response to Question Six
Cyber Security is not only a technical challenge as viewed by many organizations.
Cyber security requires undivided attention and should be addressed as part of organization
wide information governance. Cyber security is a rising subject that needs immediate
attention as the count of cyber threats and crime is constantly increasing at a high velocity.
Cyber crime has become a huge business prospects, valuation lies in billion dollars11. The
importance of cyber security is because of the following reasons. Cyber attacks can be
expensive for the organizations or companies to endure. The company not only faces
financial damage but it also hurts and stains the reputation of the company or the
organization12. The recent times have seen the evolution of sophisticated hackers using
advanced hacking tools to intercept and intervene into the network or computer system.
Cyber security is important to patch the loose ends in the network system of an organization
which becomes the entry point of the attackers to inject a malware into the system of the
organization13. Implementation of cyber security helps the company to detect and respond to
malicious movement in the system that can cause potential damage to the organization14.
11 Aldabbas, Mohammad, Stephanie Teufel, and Bernd Teufel. "The importance of security
culture for crowd energy systems." In 2017 Information Security for South Africa (ISSA), pp.
10-15. IEEE, 2017.
12 Balzacq, Thierry, and Myriam Dunn Cavelty. "A theory of actor-network for cyber-security." European
Journal of International Security 1, no. 2 (2016): 176-198.
13 Azmi, Riza, William Tibben, and Khin Than Win. "Motives behind Cyber Security Strategy Development: A
Literature Review of National Cyber Security Strategy." (2016).
14 Min, Kyoung-Sik, Seung-Woan Chai, and Mijeong Han. "An international comparative study on cyber
security strategy." International Journal of Security and Its Applications 9, no. 2 (2015): 13-20.

8LEGAL ASPECTS OF CYBER SECURITY
Another reason why cyber security is important is because the data stole or lost in the attack
holds priceless value to company assets15. If the data is misused or used against the
organization, the transition will face damage beyond comprehension. Information governance
is important to prevent such act and future threats16. For the better understanding of the risks
and treats, record management is important. The record provides valuable insight of the
internal business structure and the facts that need to be focused17. A familiarized environment
helps in better understanding of the underlying threats and vulnerabilities if present and chart
out productive schemes to counter the identified recorded facts. Record management should
not be marginalized at an early stage in decision making. Recording the information risks and
security issues at an early stage involves the engagement of the workers to identify the risks
and chart out mitigation schemes.
15 Schatz, Daniel, Rabih Bashroush, and Julie Wall. "Towards a more representative definition of cyber
security." Journal of Digital Forensics, Security and Law 12, no. 2 (2017): 8.
16 Collins, Alan, ed. Contemporary security studies. Oxford university press, 2016.
17 Vieane, Alex, Gregory Funke, Robert Gutzwiller, Vincent Mancuso, Ben Sawyer, and Christopher Wickens.
"Addressing human factors gaps in cyber defense." In Proceedings of the Human Factors and Ergonomics
Society Annual Meeting, vol. 60, no. 1, pp. 770-773. Sage CA: Los Angeles, CA: SAGE Publications, 2016.

9LEGAL ASPECTS OF CYBER SECURITY
Bibliography
Aldabbas, Mohammad, Stephanie Teufel, and Bernd Teufel. "The importance of security
culture for crowd energy systems." In 2017 Information Security for South Africa (ISSA), pp.
10-15. IEEE, 2017.
Azmi, Riza, William Tibben, and Khin Than Win. "Motives behind Cyber Security Strategy
Development: A Literature Review of National Cyber Security Strategy." (2016).
Balzacq, Thierry, and Myriam Dunn Cavelty. "A theory of actor-network for cyber-
security." European Journal of International Security 1, no. 2 (2016): 176-198.
Berger, Hilary, and Andrew Jones. "Cyber Security & Ethical Hacking For SMEs."
In Proceedings of the The 11th International Knowledge Management in
Organizations Conference on The changing face of Knowledge Management
Impacting Society, p. 12. ACM, 2016.
Collins, Alan, ed. Contemporary security studies. Oxford university press, 2016.
Hartley, Regina, Dawn Medlin, and Zach Houlik. "Ethical Hacking: Educating Future
Cybersecurity Professionals." In Proceedings of the EDSIG Conference ISSN, vol. 2473, p.
3857. 2017.
Legislation.govt.nz. 2019. "Crimes Act 1961 No 43 (As At 28 September 2017),
Public Act Contents – New Zealand Legislation". Legislation.Govt.Nz.
http://www.legislation.govt.nz/act/public/1961/0043/137.0/DLM327382.html.

10LEGAL ASPECTS OF CYBER SECURITY
Min, Kyoung-Sik, Seung-Woan Chai, and Mijeong Han. "An international comparative study
on cyber security strategy." International Journal of Security and Its Applications 9, no. 2
(2015): 13-20.
Nicholson, Scott. "How ethical hacking can protect organisations from a greater
threat." Computer Fraud & Security 2019, no. 5 (2019): 15-19.
Patil, Sonali, Ankur Jangra, Mandar Bhale, Akshay Raina, and Pratik Kulkarni. "Ethical
hacking: The need for cyber security." In 2017 IEEE International Conference on Power,
Control, Signals and Instrumentation Engineering (ICPCSI), pp. 1602-1606. IEEE, 2017.
Regalado, Daniel, Shon Harris, Allen Harper, Chris Eagle, Jonathan Ness, Branko
Spasojevic, Ryan Linn, and Stephen Sims. Gray Hat Hacking The Ethical Hacker's
Handbook. McGraw-Hill Education Group, 2015.
Schatz, Daniel, Rabih Bashroush, and Julie Wall. "Towards a more representative definition
of cyber security." Journal of Digital Forensics, Security and Law 12, no. 2 (2017): 8.
Sinha, Sanjib. "Legal Side of Hacking." In Beginning Ethical Hacking with Python, pp. 3-3.
Apress, Berkeley, CA, 2017.
Thomas, Georg, Oliver Burmeister, and Gregory Low. "Issues of Implied Trust in Ethical
Hacking." ORBIT Journal 2, no. 1 (2018).
Trabelsi, Zouheir, and Margaret McCoey. "Ethical hacking in Information Security
curricula." International Journal of Information and Communication Technology Education
(IJICTE) 12, no. 1 (2016): 1-10.

11LEGAL ASPECTS OF CYBER SECURITY
Vieane, Alex, Gregory Funke, Robert Gutzwiller, Vincent Mancuso, Ben Sawyer, and
Christopher Wickens. "Addressing human factors gaps in cyber defense." In Proceedings of
the Human Factors and Ergonomics Society Annual Meeting, vol. 60, no. 1, pp. 770-773.
Sage CA: Los Angeles, CA: SAGE Publications, 2016.