Within Motive and Law
What Turns Curious Hacking Into Serious Harm?
Duration, sensitive targets, copied data, concealment and disruption can make a curiosity claim far less persuasive.
On this page
- Duration, repetition and depth of access
- Why military and government targets raise the stakes
- How copying, concealment and disruption increase culpability
Page outline Jump by section
Introduction
A claim of curiosity does not, by itself, determine how seriously a hacking incident is treated. Courts and prosecutors generally look at what the intruder actually did: how long they remained inside a system, how many systems they accessed, whether they targeted particularly sensitive networks, whether they copied or altered data, and whether they tried to hide their actions. These factors help distinguish a brief episode of unauthorised exploration from conduct that creates substantial security risks or operational harm.[Crown Prosecution Service]cps.gov.ukCrown Prosecution Service Computer Misuse Act | The Crown Prosecution ServiceCrown Prosecution ServiceComputer Misuse Act | The Crown Prosecution ServiceAugust 3, 2023…
The debate surrounding Gary McKinnon illustrates this distinction. McKinnon consistently maintained that he was searching for evidence relating to UFOs and suppressed technology rather than seeking financial gain. Even so, the allegations against him involved prolonged unauthorised access to numerous US military, NASA and government systems, together with claims of copied files, installation of remote-access software and disruption to critical networks. Those features—not simply his stated motive—are what made the case legally and politically significant.[UK Parliament]publications.parliament.ukUK Parliament House of LordsUK ParliamentHouse of Lords - Mckinnon V Government of The United States of America and Another…
Duration, repetition and depth of access
One of the clearest aggravating factors is persistence. An isolated instance of unauthorised access may still constitute a criminal offence, but a campaign lasting weeks or months demonstrates repeated decisions to continue intruding after recognising that access is unauthorised.
Duration also tends to increase the opportunity for harm. A person who repeatedly returns to compromised systems can explore additional networks, obtain higher privileges, encounter more sensitive information and expose more victims. Courts therefore often view repeated access as evidence of greater culpability than a single exploratory incident.
Depth of access matters as much as duration. Simply reaching an exposed system differs from:
- obtaining administrator credentials;
- moving between internal networks;
- installing remote-access software;
- creating mechanisms for future access; or
- acquiring privileged accounts that allow broad control over a system.
In the allegations described during the McKinnon litigation, investigators claimed he installed remote administration software, scanned tens of thousands of government computers for additional vulnerable systems and moved between multiple military and government networks over more than a year. Those alleged actions illustrate why a curiosity-based explanation becomes less persuasive as the intrusion becomes increasingly systematic and technically sophisticated.[UK Parliament]publications.parliament.ukUK Parliament House of LordsUK ParliamentHouse of Lords - Mckinnon V Government of The United States of America and Another…
Why military and government targets raise the stakes
Not every computer system carries the same potential consequences if compromised. Military, intelligence, defence and other government networks often support activities whose disruption could affect public safety, national security or essential government operations.
For that reason, prosecutors and courts commonly regard the nature of the target as an important consideration alongside the hacker’s personal motive. The concern is not merely whether classified material was actually obtained, but whether the intrusion exposed systems whose compromise could have wider consequences than those affecting a private individual or commercial website.
The allegations in McKinnon’s case involved access to US Army, Navy, Air Force, Department of Defense and NASA computers. According to the House of Lords’ summary of the indictment, the affected systems included networks associated with military administration, naval logistics and defence operations. Whether or not every allegation was ultimately proved, the choice of targets itself substantially increased the seriousness with which authorities viewed the case.[UK Parliament]publications.parliament.ukUK Parliament House of LordsUK ParliamentHouse of Lords - Mckinnon V Government of The United States of America and Another…
This principle extends beyond military systems. Intrusions involving healthcare, emergency services, critical infrastructure or government administration are frequently treated more seriously because failures or interruptions may affect large numbers of people rather than only the system owner. The increased concern reflects the potential consequences of exposing sensitive systems, even where financial gain is absent.[Crown Prosecution Service]cps.gov.ukCrown Prosecution Service Computer Misuse Act | The Crown Prosecution ServiceCrown Prosecution ServiceComputer Misuse Act | The Crown Prosecution ServiceAugust 3, 2023…
How copying, concealment and disruption increase culpability
Curiosity is least convincing when an intruder goes beyond simply viewing information.
Several actions substantially increase legal and practical concern:
- Copying data. Downloading files, credentials or databases creates continuing risks because information can be retained, shared or misused later.
- Concealing activity. Deleting logs, disguising software or masking identity suggests awareness of wrongdoing and can make forensic investigation more difficult.
- Installing software. Adding remote-access tools or persistence mechanisms transforms a temporary intrusion into an ongoing compromise.
- Altering or deleting information. Changes to operating systems, user accounts or files can impair reliability and disrupt legitimate users.
- Interrupting services. Operational disruption may affect organisations far beyond the immediate computer system.
The House of Lords judgment summarising the US allegations against McKinnon stated that investigators alleged he copied files and passwords from government systems, installed software intended to facilitate continued access and concealment, and deleted operating-system files and logs that allegedly rendered military networks temporarily inoperable. McKinnon admitted unauthorised access but disputed causing the alleged damage. The distinction is important: even where the extent of damage is contested, allegations of copying, concealment and disruption significantly influence how prosecutors and courts assess seriousness.[UK Parliament]publications.parliament.ukUK Parliament House of LordsUK ParliamentHouse of Lords - Mckinnon V Government of The United States of America and Another…
Why curiosity becomes a weaker defence as harm increases
Courts generally distinguish between motive and conduct. A genuine fascination with UFOs, advanced technology or government secrecy may explain why someone chose a target, but it does not outweigh conduct that creates serious security risks.
The more an intrusion demonstrates planning, persistence and technical escalation, the less weight a curiosity claim is likely to carry. A person who continues exploring after recognising the sensitivity of the systems, repeatedly returns to them, acquires privileged access or copies information has made a series of deliberate choices that extend well beyond accidental discovery.
UK prosecution guidance reflects this broader assessment. Relevant considerations include the sophistication of the offending, efforts to conceal identity, financial, commercial or reputational damage, harm to victims and wider public-interest factors. Although the absence of financial motivation may remove one aggravating feature, it does not eliminate others arising from the scale, persistence or impact of the intrusion.[Crown Prosecution Service]cps.gov.ukCrown Prosecution Service Computer Misuse Act | The Crown Prosecution ServiceCrown Prosecution ServiceComputer Misuse Act | The Crown Prosecution ServiceAugust 3, 2023…
The broader lesson from the McKinnon case
The McKinnon case is often remembered because of its unusual claimed motivation, but its legal significance lies in demonstrating that criminal responsibility depends far more on the nature of the intrusion than on the explanation offered for it.
A brief, limited and responsibly reported security discovery presents a very different picture from prolonged unauthorised access to sensitive government systems. Duration, repeated access, privileged control, military targets, copied data, concealment and operational disruption all increase the potential harm and therefore the seriousness with which authorities are likely to view the conduct. Even where curiosity is genuine and financial gain is absent, these aggravating factors can outweigh the claimed motive when assessing criminal liability and sentencing.
Amazon book picks
Further Reading
Books and field guides related to What Turns Curious Hacking Into Serious Harm?. Use these as the next step if you want deeper reading beyond the article.
Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin'...
"With the nuance of a reporter and the pace of a thriller writer, Andy Greenberg gives us a glimpse of the cyberwars of the future while...
Countdown to Zero Day: Stuxnet and the Launch of the World's...
Top cybersecurity journalist Kim Zetter tells the story behind the virus that sabotaged Iran’s nuclear efforts and shows how its existenc...
The Hacker and the State: Cyber Attacks and the New Normal of...
Rating: 5.0/5 from 18 Google Books ratings
“A must-read...It reveals important truths.” —Vint Cerf, Internet pioneer “One of the finest books on information security published so f...
The Hacker and the State
Rating: 5.0/5 from 18 Google Books ratings
“A must-read...It reveals important truths.” —Vint Cerf, Internet pioneer “One of the finest books on information security published so f...
eBay marketplace picks
Marketplace Samples
Live-tested eBay searches with available results related to this page.
Selected fromhacker t shirt oneBay.co.uk.
Endnotes
1.
Source: publications.parliament.uk
Title: UK Parliament House of Lords
Link:https://publications.parliament.uk/pa/ld200708/ldjudgmt/jd080730/mckinn-1.htm
Source snippet
UK ParliamentHouse of Lords - Mckinnon V Government of The United States of America and Another...
2.
Source: publications.parliament.uk
Title: uk House of Lords
Link:https://publications.parliament.uk/pa/ld200809/ldjudgmt/jd090304/rgrj-1.htm
Source snippet
On 2 April 2008 a differently constituted Court of Appeal (Rix LJ, Henriques J and Sir Richard Curtis) heard Mr G’s appeal and allowed it...
Published: April 2008
3.
Source: publications.parliament.uk
Title: uk House of Lords
Link:https://publications.parliament.uk/pa/ld199899/ldjudgmt/jd990805/bow.htm
Source snippet
Bow Street Magistrates Court and Allison (A.P.) Ex Parte Government of the United States of America (on Appeal from a Divisional Court of...
4.
Source: cps.gov.uk
Title: Crown Prosecution Service Computer Misuse Act | The Crown Prosecution Service
Link:https://www.cps.gov.uk/prosecution-guidance/computer-misuse-act
Source snippet
Crown Prosecution ServiceComputer Misuse Act | The Crown Prosecution ServiceAugust 3, 2023...
Published: August 3, 2023
5.
Source: cps.gov.uk
Title: Disclosure Manual: Chapter 30
Link:https://www.cps.gov.uk/prosecution-guidance/disclosure-manual-chapter-30-digital-material
Source snippet
The complexity of digital disclosure is such that it may be necessary for additional resources to be applied...
6.
Source: cps.gov.uk
Title: cybercrime prosecution guidance
Link:https://www.cps.gov.uk/prosecution-guidance/cybercrime-prosecution-guidance
Source snippet
Cybercrime - prosecution guidance | The Crown Prosecution ServiceMay 1, 2018 — This can overload servers causing them to freeze or crash...
Published: May 1, 2018
7.
Source: GOV.UK
Title: latest on [gary mckinnon case]({{ ‘mc-kinnon-case/’ | relative_url }})
Link:https://www.gov.uk/government/news/latest-on-gary-mckinnon-case
Source snippet
on Gary McKinnon case - GOV.UKNovember 4, 2010 — LATEST ON GARY MCKINNON CASE Find out the latest position on the Glasgow-born systems ad...
Published: November 4, 2010
Additional References
8.
Source: casemine.com
Link:https://www.casemine.com/judgement/uk/5a8ff75e60d03e7f57eabd29
Source snippet
USA & ANOR Smart Summary FACTUAL AND PROCEDURAL BACKGROUND On 10 May 2006, in Bow Street Magistrates' Court, District Judge Evans acceded...
Published: May 2006
9.
Source: casemine.com
Link:https://www.casemine.com/judgement/uk/5a8ff75e60d03e7f57eabd29/amp
Source snippet
McKinnon v USA & Anor | England and Wales High Court (Administrative Court) | Judgment | Law | CaseMineApril 3, 2007 — The allegations ag...
Published: April 3, 2007
10.
Source: youtube.com
Link:https://www.youtube.com/watch?v=rxEUtzZL5to
Source snippet
Gary McKinnon hacker interview NASA UFOs UFO Hacker Shares New Secrets | Gary McKinnon Tim Ventura...
11.
Source: vlex.co.uk
Title: Mc Kinnon v United States of America
Link:https://vlex.co.uk/vid/mckinnon-v-usa-818719549
Source snippet
McKinnon v United States of America - vLex United KingdomJuly 30, 2008 — MCKINNON V UNITED STATES OF AMERICA [Jurisdiction]({{ 'jurisdiction/' | relative_url }}) | England & Wal...
Published: July 30, 2008
12.
Source: en.wikisource.org
Title: US v Gary Mc Kinnon Indictment
Link:https://en.wikisource.org/wiki/US_v_Gary_McKinnon_Indictment
Source snippet
v Gary McKinnon Indictment - Wikisource, the free online libraryuser accounts; (2) installed RemotelyAnywhere; (3) deleted critical syste...
13.
Source: vlex.co.uk
Title: Mc Kinnon v United States of America
Link:https://vlex.co.uk/vid/mckinnon-v-united-states-793612009
Source snippet
Mr McKinnon now appeals against those decisions. The USA has been designated a category 2 territory pursuant to...
14.
Source: youtube.com
Title: Gary Mckinnon: The Hacker Who Found UFOs
Link:https://www.youtube.com/watch?v=8_1DuqeU8hw
Source snippet
"How Did Landmark Cases Define "unauthorised Access" Under The Computer Misuse Act?[https://www.youtube.com/watch?v=zezzoxhrnZ8..."](https://www.youtube.com/watch?v=zezzoxhrnZ8...")...
15.
Source: youtube.com
Title: UFO Hacker Shares New Secrets | Gary Mc Kinnon
Link:https://www.youtube.com/watch?v=_SOTGFj7BwI
Source snippet
"Hacking for UFOs and fighting for his life. Who is Gary McKinnon?[https://www.youtube.com/watch?v=OImdnvQx7sQ..."](https://www.youtube.com/watch?v=OImdnvQx7sQ...")...
16.
Source: youtube.com
Link:https://www.youtube.com/watch?v=zezzoxhrnZ8
Source snippet
"What Is Unauthorized Access Under Computer Misuse Act Section 1?[https://www.youtube.com/watch?v=rxEUtzZL5to..."](https://www.youtube.com/watch?v=rxEUtzZL5to...")...
17.
Source: youtube.com
Link:https://www.youtube.com/watch?v=OImdnvQx7sQ
Source snippet
Gary Mckinnon: The Hacker Who Found UFOs...