The case arose out of certain activities, known as "computer hacking," which the respondents carried on between October 1984 and January 1985. These activities consisted in the obtaining of unauthorised access to various computers comprised in the Prestel Computer Network owned and operated by British Telecommunications Plc.
The indictment on which the respondents were convicted contained nine specimen counts, five against Schifreen and four against Gold. Except for the date and the particular computer involved the particulars of offence in each count were in similar terms, alleging that the respondent concerned:
"made a false instrument namely a device on or in which information is recorded or stored by electronic means with the intention of using it to induce the Prestel Computer to accept it as genuine and by reason of so accepting it to do an act to the prejudice of British Telecommunications Plc."
I take the relevant facts mainly from the judgment of the Court of Appeal (Criminal Division) delivered by Lord Lane C.J. Prestel is an information service which allows persons who have the necessary micro- computers to call up a computer data base and to receive information from it. Access to the Prestel computer is by way of the British Telecom telephone system. When the computer's number is dialled, the telephone system connects the dialler to the appropriate Prestel centre.
In order legitimately to obtain information from the Prestel data base, it is necessary to register as a user by filling in an application form and paying a rental charge. Once that is done, the user is allocated a customer identification number ("C.I.N.") consisting of ten numerals and also a password.
The user has, as part of his equipment, a television screen and a key- board. After he has become connected to the particular Prestel computer which he has dialled, a picture will appear on his television screen inviting him to "log on." He then types out his C.I.N. which is verified by the computer. Next the user types out his password which is also verified by the computer. If the computer has been able to match up the C.I.N. and the password with the user information which it has in its memory, the user is then admitted to those parts of the Prestel data base which he has been authorised to use. He can then type out his request for information on his keyboard.
The detail of the process by which the computer verifies the C.I.N. and the password is this. When the user telephones the computer, the call is answered by a device called a "port." A port is analogous to a doorway into the system. There is one port for each telephone line. The port tells the computer that a new call has been made and that the user needs to be shown the logging frame. The logging frame is then shown to the user on his television screen. The user then types out his C.I.N. This passes down the telephone line as a series of electronic impulses. There is a part of each computer which is reserved for dealing with the input and output and the control of each port.
The C.I.N. is received in a particular area reserved for that port alone. That area is called a user segment. Each user segment has three areas: (l) the input buffer (2) the control area and (3) the output buffer. The word buffer in this context is used to describe an area in a computer which is used to receive information from, or to transmit information to, the outside world. When the user types out his C.I.N., that is received in the input buffer and is then immediately moved into the control area and retained there for the duration of the logging procedure. This may be a very brief time indeed.
In order to verify the customer's identity and the password, the user's details must be accessed from the data base to determine whether he is a valid user or not. It is the function of the logging procedure to compare the C.I.N. with the information already contained in the user file. If there is no C.I.N. on the user file which matches that which has been typed out by the user, then the user is given up to three attempts to repeat his C.I.N. The same procedure is then adopted with the password. If these two checks are completed successfully, the user is then allowed into the Prestel computer.
After these operations are over, the areas in the upper segment that were used for the C.I.N. and the password are cleared. Thereafter the input buffer is used to receive the instructions being typed out by the user and the output buffer is used to show the information which has been requested on the user's television screen.
On numerous occasions between October 1984 and January 1985 each of the respondents, using his own micro-computer at his home, gained unauthorised access to a number of Prestel computers. They did so by obtaining and using the C.I.N.s and passwords of others without their permission. Having gained such access they obtained information to which they were not entitled; made unauthorised alterations to stored data; and caused charges to be made to account-holders without their knowledge or consent.
The respondents' object in carrying on these activities was not so much to gain any profit for themselves as to demonstrate their skill as "hackers." It never occurred to them that they might be committing any offences under the Forgery and Counterfeiting Act 1981.
That Act provides, so far as material, in Part 1, under the heading "Forgery and Kindred Offences":
"Offences
"1. A person is guilty of forgery if he makes a false instrument, with the intention that he or another shall use it to induce somebody to accept it as genuine, and by reason of so accepting it to do or not to do some act to his own or any other person's prejudice....
"Interpretation of Part I
"8(1) Subject to subs(2) below, in this Part of this Act 'instrument' means. . .(d) any disc, tape, sound track or other device on or in which information is recorded or stored by mechanical, electronic or other means
"9(1) An instrument is false for the purposes of this Part of this Act--(a) if it purports to have been made in the form in which it is made by a person who did not in fact make it in that form; or (b) if it purports to have been made in the form in which it is made on the authority of a person who did not in fact authorise its making in that form; . . .
"10(3) In this Part of this Act references to inducing somebody to accept a false instrument as genuine . . . include references to inducing a machine to respond to the instrument . . . as if it were a genuine instrument . . . (4) Where subs(3) above applies, the act or omission intended to be induced by the machine responding to the instrument . . . shall be treated as an act or omission to a person's prejudice."
My Lords, as appears from s1 of the Act of 1981 set out above, the primary ingredient of the offence of forgery is the making of a false instrument. Moreover the instrument must be one which comes within the definition of that expression in s8(1); and it must be false within the definition of that expression in s9(1). The difficulty in the present case is to identify the false instrument which the respondents were accused of having made.
According to the common language of the nine counts in the indictment the false instrument made by the respondents was a "device on which or in which information is recorded or stored by electronic means." This language was clearly used in an attempt to bring the case within the definition of the expression "instrument" contained in s 8(1)(d), but it gives little indication of the precise nature of the instrument concerned. Before the trial no particulars of the precise nature of the alleged device were asked for or given; and at the trial prosecuting counsel does not seem to have dealt specifically with this matter either in his opening address to the jury or in the course of the considerable amount of technical evidence which was adduced. It was apparently the trial judge who raised the matter for the first time during final submissions at the close of the prosecution's case. He said to prosecuting counsel: "If I were to say to you 'what is the instrument?' what would you reply?" To which prosecuting counsel replied: "The answer I would have to give would be the user segment."
In the course of his summing up to the jury the trial judge referred to the nature of the false instrument alleged to have been made in two main passages. In the first passage he said:
"Now I have already told you that 'instrument' may be any disc, tape, sound track or other device on or in which information is recorded or stored by mechanical, electronic or other means. All I will say at this stage as to that, but I will return to it, is that it is for you to say on the evidence you have heard whether it be the position that a false instrument or false instruments were here made by one or other or both defendants as the prosecution say."
In a later passage he said:
"Now during the log on process, these electronic impulses have to be held, albeit for a very short time indeed, in what I believe is called the input buffer which is in the user segment and checked for veracity, if you like, by the computer with the information it is already holding. It wants to see that everything is right, that everything matches, so it looks into itself to see that everything is right. Now this checking process happens both with the customer's identity number and with his password. No doubt it all takes a fraction of a second. So there is made by the caller, say the prosecution, an instrument. By this process, they say there has been created a device on or in which information is stored by electronic means. Now it is argued on behalf of the defendants such a construction is wholly artificial and unwarranted. Electronic impulses, they say, cannot be a device on or in which information is stored. That is their approach. Say the prosecution, that approach is too narrow an approach. Now I do not--I would be going too far if I did--say what is my view of the matter, nor do I direct you that in law you must find one way or the other on that. It is an issue of fact. As an issue of fact, it is for you . . . "
The matter having been left to the jury in that way, they brought in a verdict of guilty against both defendants on all the counts on which each of them was respectively charged.
On the defendants' appeal to the Court of Appeal (Criminal Division) it was contended for them, on various grounds, that what they had been proved to have done could not, as a matter of law, amount to the offence of forgery under the Act of 1981. The court, which had been referred during the course of the argument to the Law Commission (Law Com. No. 55) Criminal Law Report on Forgery and Counterfeit Currency of 1973, accepted most of the contentions put forward for the defendants. Lord Lane C.J., giving the judgment of the court, said [1987] Q.B. 1116, 1124:
"In our judgment the user segment in the instant case does not carry the necessary two types of message to bring it within the ambit of forgery at all. Moreover, neither the report nor the Act, so it seems to us, seeks to deal with information that is held for a moment whilst automatic checking takes place and is then expunged. That process is not one to which the words 'recorded or stored' can properly be applied, suggesting as they do a degree of continuance.
"There is a further difficulty. The prosecution had to prove that the appellants intended that someone should accept as genuine the false instrument which they had made. The suggestion here is that it was a machine (under s10(3)) which the appellants intended to induce to respond to the false instrument. But the machine (i.e., the user segment) which was intended, so it was said, to be induced seems to be the very thing which was said to be the false instrument (i.e., the user segment) which was inducing the belief. If that is a correct analysis, the prosecution case is reduced to an absurdity.
"We have accordingly come to the conclusion that the language of the Act was not intended to apply to the situation which was shown to exist in this case. The submissions at the close of the prosecution case should have succeeded. It is a conclusion which we reach without regret. The Procrustean attempt to force these facts into the language of an Act not designed to fit them produced grave difficulties for both judge and jury which we would not wish to see repeated. The appellants' conduct amounted in essence, as already stated, to dishonestly gaining access to the relevant Prestel data bank by a trick. That is not a criminal offence. If it is thought desirable to make it so, that is a matter for the legislature rather than the courts. We express no view on the matter. Our decision on this aspect of the case makes it unnecessary to determine the other issues raised by the appellants, in particular the submission that they should be found not guilty of forgery when there was no evidence that either of them had any inkling that what they were doing might amount to a contravention of the Act."
The reference in the first paragraph of the passage set out above to the user segment not carrying the two types of message necessary to bring it within the ambit of forgery is a reference to paragraph 22 of the Law Commission Report. In that paragraph it was pointed out that, in the straightforward case of forgery, a document contains two messages of two distinct kinds, first, a message about the document itself (e.g. that it is a cheque), and secondly, a message to be found in the words of the document that is to be accepted and acted upon (e.g. that a banker is to pay X pounds); and that it is only documents which contain both types of message that require protection by the law of forgery.
My Lords, the points of law of general public importance certified by the Court of Appeal (Criminal Division) as being involved in its decision to allow the appeals were these:
"1. Whether on a true construction of s1, 8, 9 and 10 of the Forgery and Counterfeiting Act 1981, a false instrument is made in the following circumstances--(a) a person keys into part of a computer (the user segment) a customer identification number and password of another, without the authority of that other, (b) with the intention of causing the same computer to allow unauthorised access to its database, and (c) the user segment, upon receiving such information (in the form of electronic impulses), stores or records it for a very brief period whilst it checks it against similar information held in the user file of the database of the same computer.
"2. Whether, in order to constitute a false instrument within the meaning of the said Act, an instrument must contain-(a) a message about the instrument itself, and (b) a message to be found in the words of the instrument that is to be accepted and acted upon.
"3. Whether, in order for a person to be found guilty of forgery within the meaning of the said Act, he must be proved to have been aware of the relevant facts which constitute the making of the false instrument.
"4. Whether the offence is made out if the 'somebody' whom the appellants allegedly intended should accept the false instrument as genuine (in this case--under s10(3)-a machine) is the same machine as that which was said to be the false instrument, namely the user segment."
Point 1 comprises, potentially at least, two questions. The first question, which has to be answered in any case, is whether, in the circumstances specified in paragraphs (a) (b) and (c), an instrument as defined in s8(1) of the Act is made at all. The second question, which only arises if an affirmative answer is given to the first, is whether the instrument so made is a false instrument as defined in s9(1).
The case for the Crown on the first question was this. The relevant instrument was the control, area of the user segment of the relevant Prestel computer whilst it had recorded and/or stored within it the electronic impulses purporting to be a C.I.N. and a password. That control area of the user segment consisted of semi-conductor chips and/or magnetic cores, either or both of which are devices "on or in which information is recorded or stored by . . . electronic means" within the meaning of s8(1)(d) of the Act. Such an instrument was made by each respondent when he keyed into the control area of the user segment through a telephone line the electronic impulses which constituted the C.I.N. and the password.
The case for the respondents on the first question was this. The recording and storage of information referred to in s8(1)(d) are processes of a lasting and continuous nature. The process relied on by the Crown involved no more than the C.I.N. and the password being held momentarily in the control area of the user segment while the checking of them was carried out, and then being totally and irretrievably expunged. The process did not, therefore, amount to the recording or storage of the C.I.N. and the password within the meaning of s 8(1)(d).
My Lords, s8(1)(d) contemplates that information may be recorded or stored by electronic means on or in (i) a disc, (ii) a tape, (iii) a sound track (presumably of a film) and (iv) devices other than these three having a similar capacity. The words "recorded" and "stored" are words in common use which should be given their ordinary and natural meaning. In my opinion both words in their ordinary and natural meaning connote the preservation of the thing which is the subject matter of them for an appreciable time with the object of subsequent retrieval or recovery. Further, in relation to information recorded or stored on or in a disc, tape or sound track, that is the meaning of the two expressions which appears to me to be clearly intended. For both these reasons I have reached the conclusion that the respondents' case on the first question is right and that the Crown's case on it is wrong. Moreover I share the view of the Court of Appeal (Criminal Division), as expressed by Lord Lane C.J., that there is no reason to regret the failure of what he aptly described as the Procrustean attempt to force the facts of the present case into the language of an Act not designed to fit them.
On the footing that the respondents' acts did not amount to the making of any instruments as defined in s8(1) at all, point 1 of the certified points of law must be answered in the negative; and it is unnecessary to consider whether, if they had done so, the instruments so made would have been false instruments as defined in s9(1).
Once point 1 of the certified points has been answered in the negative, points 2, 3 and 4 become academic. That being so, it is unnecessary to give answers to them either.
I would dismiss the appeal.
Appeal dismissed.