Unauthorized Access, Hacking and System Interference

Introduction and Context

Modern organisations depend on interconnected computers, cloud services, mobile devices, industrial systems and digital identities. This dependence creates opportunities for innovation but also creates opportunities for unlawful interference. A person who enters an account without permission, deploys malicious software, overwhelms a service, alters records or uses stolen credentials may commit one or more cyber offences. The legal classification depends on the conduct, the mental element, the object attacked, the resulting harm and the jurisdiction involved.

This chapter examines the principal forms of unauthorised access and system interference. It also explains the boundary between criminal conduct and legitimate security testing. The central principle is simple: technical capability does not create legal authority. A person may possess a powerful tool, understand a vulnerability or be able to bypass a control, yet still have no permission to use that capability against a particular system.

Cybercrime laws differ between countries. Some jurisdictions criminalise unauthorised access as a standalone offence; others distinguish access, interference, interception, computer-related fraud and misuse of devices. Accordingly, this chapter presents general legal and professional principles rather than legal advice for a particular country. Students should consult the applicable statute, case law, procedural rules and organisational policy in their jurisdiction.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain unauthorised access, credential attacks, privilege escalation and system interference.
2. Distinguish confidentiality, integrity and availability harms.
3. Describe malware, denial-of-service attacks, botnets and data interference at a conceptual level.
4. Explain why intent, authorisation, scope and causation matter in cybercrime analysis.
5. Identify the legal and ethical boundaries of vulnerability assessment and penetration testing.
6. Apply a structured method to a cyber incident and identify appropriate evidence and governance responses.
7. Recommend proportionate preventive, detective and corrective controls.

1. The Core Concepts

1.1 Access, authorisation and misuse

Access means obtaining or interacting with data, a program, a device, an account or a network resource. Authorisation is the permission granted by the owner or lawful controller to perform specified actions. These concepts are related but not identical. A user may be authorised to enter an organisation’s email system but not to access payroll records. An administrator may be authorised to maintain a server but not to copy confidential customer data for personal use.

Unauthorised access therefore includes more than breaking through a technical barrier. It may involve:

• entering an account using credentials that were stolen, guessed or obtained through deception;
• bypassing an access-control mechanism;
• continuing to use a system after permission has been withdrawn;
• accessing a resource beyond the limits of a user’s role; or
• using legitimate access for an unauthorised purpose, where the relevant law recognises misuse or exceeding authorisation.

The precise legal boundary is jurisdiction-dependent. Some statutes focus on access without permission, while others require circumvention of a security measure or knowledge that access is unauthorised. Evidence of permission, scope and notice is therefore essential.

1.2 The CIA triad

The confidentiality, integrity and availability model provides a useful framework for analysing harm.

An incident may affect several properties simultaneously. For example, ransomware may deny availability, alter or encrypt data, and expose information if the attacker first copies it. The CIA triad is not itself a criminal law test, but it assists investigators, risk managers and courts in describing the consequences of conduct.

1.3 The offence structure

A useful analytical model separates four questions:

1. Actus reus: What physical or digital conduct occurred?
2. Mens rea: What did the person know, intend or recklessly disregard?
3. Authority: What permission existed, and what were its limits?
4. Result and causation: What harm occurred, and can it be connected to the conduct?

For example, the mere installation of a remote-management program may be legitimate in one context and criminal in another. Investigators must establish who installed it, why it was installed, whether approval existed, what it did and whether it caused or facilitated harm.

Criminal liability may also arise through attempt, aiding, conspiracy, procurement or possession of tools, depending on the jurisdiction. Mere possession is not universally criminal: many security tools have legitimate uses. Laws commonly examine intent, design, circumstances and intended use rather than treating all dual-use software as unlawful.

2. Forms of Unauthorised Access

2.1 Credential attacks

Credentials include passwords, passphrases, authentication tokens, cryptographic keys, biometric factors and recovery mechanisms. Credential attacks seek to obtain, predict, reuse or manipulate these authenticators.

Common categories include:

• Phishing and social engineering: persuading a person to disclose credentials or approve an unauthorised action.
• Credential stuffing: trying credentials obtained from one breach against unrelated services.
• Password spraying: trying a small number of common passwords against many accounts to avoid rapid lockout.
• Brute-force guessing: systematically testing many possible values against an account or service.
• Token theft: acquiring a session token or authentication cookie so that the attacker can act as an authenticated user.
• MFA fatigue or approval abuse: repeatedly prompting a user until the user accepts an unexpected request.

Credential attacks are often facilitated by password reuse, weak recovery processes, excessive privileges and insufficient monitoring. Multi-factor authentication reduces risk but does not eliminate it, especially where users can be deceived, tokens can be stolen or recovery channels are weak.

2.2 Exploitation of vulnerabilities

A vulnerability is a weakness in software, configuration, process or architecture that can be used to violate a security objective. Exploitation is the act of taking advantage of that weakness. Vulnerabilities may involve poor input validation, insecure defaults, outdated components, inadequate segregation or errors in access-control logic.

At certificate level, the important distinction is between understanding a vulnerability and exploiting it without permission. Responsible security work seeks to confirm risk with the least intrusive method, preserve evidence and avoid unnecessary access to personal or operational data. Unauthorised exploitation may create liability even when the actor claims that the purpose was research or public benefit.

2.3 Privilege escalation

Privilege escalation occurs when a user or process obtains permissions greater than those legitimately assigned. Vertical escalation moves from a lower privilege level to a higher one, such as from an ordinary account to an administrator account. Horizontal escalation enables access to another user’s resources at a similar privilege level, such as one customer viewing another customer’s records.

Privilege escalation is important because initial access and final impact are often different stages. An attacker may first obtain a low-value account and then seek administrative control, access sensitive data, disable monitoring or deploy malware widely. Effective controls include least privilege, separation of duties, secure configuration, timely patching, privileged access management and monitoring of unusual administrative activity.

3. System Interference and Malicious Code

3.1 Data and system interference

Data interference is the intentional or reckless alteration, deletion, suppression, deterioration or obstruction of computer data. System interference affects the functioning of a computer system by impairing, interrupting or obstructing its operation.

Examples include deleting logs, modifying financial records, corrupting databases, changing configuration files, encrypting business data or preventing legitimate users from accessing a service. The legal significance may depend on whether the conduct was temporary or permanent, whether a protected system was affected and whether substantial loss resulted.

Preserving original evidence is especially important in interference cases. Investigators should consider file metadata, access logs, database audit records, system images, backup history, endpoint alerts and communications. Analysis should be conducted on copies where possible, with a documented chain of custody.

3.2 Malware

Malware is software or code designed, used or adapted to perform unauthorised or harmful actions. Major categories include:

• Virus: code that attaches to another file or program and may replicate when the host is executed.
• Worm: malware capable of spreading between systems without requiring a user to copy the infected file manually.
• Trojan: a program presented as legitimate or useful while performing concealed harmful actions.
• Ransomware: malware that blocks access to data or systems, commonly through encryption, and demands payment.
• Spyware: software that covertly collects information or monitors activity.
• Remote-access malware: code that provides unauthorised control or command capability.
• Wiper: destructive malware intended to erase or corrupt data rather than restore access through payment.

The same software may perform several functions. For legal analysis, classification is less important than proving the conduct, intent, unauthorised nature, resulting interference and connection to the accused person. Malware deployment may also constitute fraud, extortion, privacy violations, data-protection offences or damage to critical infrastructure.

3.3 Dual-use tools

Security scanners, remote administration utilities, password-auditing tools, exploit frameworks and packet-analysis software can be used lawfully by defenders and unlawfully by attackers. A tool’s existence or possession is not sufficient, by itself, to establish criminality in many legal systems. Relevant factors may include:

• whether the tool is broadly legitimate or specially adapted for abuse;
• the owner’s purpose and knowledge;
• instructions, configuration and target selection;
• whether permission existed;
• whether the tool was distributed to facilitate an offence; and
• whether actual harm or attempted harm occurred.

Professional practice requires controlled environments, written approval, restricted test accounts and careful handling of output. Students should never test public systems, institutional systems or another person’s device merely because the system appears vulnerable.

4. Denial-of-Service Attacks and Botnets

4.1 Denial of service

A denial-of-service attack seeks to make a service unavailable or materially degraded for legitimate users. A distributed denial-of-service attack uses many sources, often compromised devices, to generate traffic or requests.

Attack patterns may consume:

• network bandwidth;
• connection tables or state-tracking capacity;
• application processing capacity;
• database resources; or
• a constrained service dependency such as authentication or DNS.

The legal issue is not determined solely by traffic volume. A relatively small volume can cause serious harm to a poorly designed service, while a large volume may be absorbed by a resilient provider. Relevant evidence includes duration, target, source infrastructure, commands, payment demands, coordination messages and the effect on availability.

Legitimate load testing is different from an attack because it is authorised, bounded, planned and monitored. It normally includes a test window, target list, traffic limits, emergency stop procedures, provider notification and a named responsible person.

4.2 Botnets

A botnet is a collection of compromised devices controlled, directly or indirectly, by an operator. Devices may include computers, routers, cameras, servers and internet-of-things equipment. A botnet can be used for denial-of-service attacks, credential theft, spam distribution, malware delivery, cryptocurrency abuse or proxying activity.

The botnet structure may include infected devices, command infrastructure, operators and criminal customers. This distributed structure complicates attribution. An internet address identifies a connection or device at a particular time; it does not automatically identify the human actor. Investigators must correlate technical records with account data, payment records, device evidence, communications and other facts.

Defenders can reduce botnet risk through secure configuration, firmware updates, removal of default credentials, network segmentation, egress controls, endpoint monitoring and rapid isolation of infected devices. Internet service providers and hosting providers may also contribute through abuse reporting, sinkholing, traffic filtering and coordinated takedown procedures, subject to legal authority and due process.

5. Misuse of Hacking Tools and the Authorisation Boundary

5.1 Authorisation as a documented relationship

Authorisation should be specific enough to answer five questions:

1. Who gave permission?
2. Which systems, accounts or data are in scope?
3. Which activities are allowed and prohibited?
4. During what period is testing permitted?
5. What happens if an unsafe or unexpected condition is discovered?

A vague statement such as test our website may be inadequate. A professional statement of work should identify domains, IP ranges, applications, test accounts, methods, timing, data-handling rules, escalation contacts and reporting obligations. It should also address third-party services, because an organisation may not have authority to test infrastructure owned by a cloud or telecommunications provider.

5.2 Ethical testing principles

Ethical testing is governed by legality, necessity, proportionality, competence, confidentiality and accountability. Testers should:

• obtain written permission before testing;
• verify the identity and authority of the client;
• define scope and exclusions;
• minimise disruption and access to real personal data;
• use synthetic or test data where possible;
• stop when a serious risk of damage arises;
• protect findings and credentials;
• report critical vulnerabilities promptly; and
• retain sufficient records to support reproducibility and audit.

A vulnerability disclosure by itself does not create permission. Even non-destructive scanning can generate load, trigger alerts, expose confidential information or affect third-party systems. Good-faith motives are relevant to ethics and sometimes to prosecutorial discretion, but they do not automatically remove legal risk.

5.3 Responsible disclosure

A responsible disclosure process generally involves validating a finding carefully, contacting the responsible organisation through an appropriate channel, providing enough information to reproduce and remediate the issue, allowing a reasonable response period and avoiding public disclosure of exploitable details before mitigation. Emergency conditions may justify faster escalation. Researchers should follow a published vulnerability disclosure policy where one exists.

6. A Framework for Investigating an Incident

A practical investigation should be systematic rather than driven by assumptions.

Step 1: Identify the alleged conduct

Describe the event in neutral terms: an account was accessed, a file was altered, a service became unavailable or malware was detected. Avoid prematurely labelling the event as hacking or sabotage.

Step 2: Establish authority and scope

Collect policies, contracts, access approvals, test authorisations, employment records and revocation notices. Determine whether the person was an employee, contractor, customer, researcher or outsider, and what access was permitted.

Step 3: Preserve evidence

Secure logs, endpoint images, cloud audit trails, email records, authentication events, firewall records and relevant devices. Record who collected each item, when, how and where it was stored. Avoid changing original evidence unnecessarily.

Step 4: Build a timeline

Correlate timestamps, accounting for time zones and clock drift. A timeline may connect a login, privilege change, file access, malware execution and service outage. Correlation does not prove causation, but it identifies questions for further examination.

Step 5: Assess intent and knowledge

Consider commands, messages, preparation, concealment, repeated conduct, warnings, training, authorisation documents and the person’s response. Technical evidence should be interpreted alongside human and organisational evidence.

Step 6: Assess harm and causation

Identify affected systems, records, users, costs, downtime, privacy consequences and recovery effort. Distinguish direct effects from speculative or unrelated losses.

Step 7: Report and remediate

A report should state facts, confidence levels, limitations, legal or policy issues, containment actions and recommendations. Remediation may include credential resets, patching, restoration, segmentation, monitoring improvements and notification obligations.

7. Applied Case: Northbridge Health Services

The following is an illustrative fictional case designed for learning purposes.

Background

Northbridge Health Services operates a patient scheduling platform. A systems analyst, Dana, has a legitimate account for maintaining test servers but no permission to access the production patient database. The organisation has a written policy requiring approval for production access and prohibiting the use of shared credentials.

Problem

During a weekend outage, monitoring shows repeated administrative logins to the production environment. Patient appointment records are altered, a database export is created and several servers later display an encryption notice. The export is found in a cloud storage location associated with an account used by Dana.

Analysis

The investigation begins without assuming that Dana is responsible. Access logs show that the initial login used a privileged service account. The service account password had been stored in an old script on a test server. Endpoint records show that the test server was infected with remote-access malware two days earlier. A cloud audit trail records an export initiated from an unfamiliar device, while Dana’s employment records show that Dana was travelling and did not have an approved production-access request.

The facts suggest several possible offences or policy violations: unauthorised access, credential misuse, data interference, unlawful acquisition of health information and deployment of malware. However, attribution requires further evidence. Investigators examine the malware, preserve the test server, obtain lawful provider records and compare the unfamiliar device with other authentication events. They also determine whether the storage account was controlled by Dana or merely compromised.

Approach and solution

Northbridge isolates the test server, disables the exposed service account, resets privileged credentials, revokes active sessions and blocks the malicious storage destination. It restores affected systems from verified backups and preserves compromised systems for forensic examination. The organisation informs its legal and privacy teams, documents decisions and follows applicable breach-notification requirements.

Longer-term measures include eliminating passwords from scripts, using managed secrets, requiring multi-factor authentication for privileged access, separating test and production networks, applying least privilege, monitoring unusual exports and conducting tabletop exercises. The organisation also improves its contractor and employee offboarding process.

Outcome

The investigation concludes that Dana’s credentials were not used directly by Dana. The evidence supports a chain beginning with compromise of the test server, theft of a service-account secret, unauthorised production access and subsequent data interference. The case is referred to law enforcement with preserved evidence and a documented timeline. Northbridge is able to restore operations and identify affected records.

Learning points

First, an authenticated login is not proof that the account owner performed the action. Second, poor secret management can turn a limited compromise into a privileged incident. Third, legal analysis requires authority, conduct, mental state, harm and causation. Finally, incident response must combine technical controls, evidence preservation, privacy governance and communication.

8. Governance, Regulation and Professional Responsibility

Organisations should maintain an acceptable-use policy, access-control policy, incident-response plan, vulnerability-disclosure process and evidence-retention schedule. Policies should be understandable, communicated and enforced consistently. Excessively broad monitoring can create privacy and employment-law risks; insufficient monitoring can prevent detection and accountability.

Cybercrime investigations must respect lawful authority, due process, privacy, proportionality and the rules governing digital evidence. Cross-border incidents may involve different definitions of offences, preservation procedures and disclosure obligations. Cooperation between organisations, service providers and law enforcement is often necessary, but information sharing should have a lawful basis and appropriate safeguards.

Professionals should avoid vigilante activity. Retaliating against an alleged attacker, accessing the attacker’s system or publishing personal information can create new offences, destroy evidence and harm uninvolved persons. Defensive action should be limited to authorised containment and coordination with competent authorities.

9. Contemporary Developments and Limitations

Cloud computing, containerised applications, identity providers, application programming interfaces and operational technology have expanded the attack surface. Identity has become a major security boundary because users and services may access resources from many locations and devices. Artificial intelligence can help defenders prioritise alerts, identify unusual behaviour and summarise events, but it can also assist phishing, malware variation and automated abuse. AI-generated output requires human review, access controls and testing; it should not be treated as evidence merely because it appears technically plausible.

Attribution remains difficult. Logs may be incomplete, attackers may use compromised infrastructure and timestamps may be inconsistent. Detection tools can generate false positives, while absence of a log does not prove absence of an event. Security controls also have costs and can impair usability. A balanced programme therefore uses layered controls, risk assessment, regular testing and continuous improvement rather than relying on one technology.

Best-Practice Checklist

• Define and document authorisation before any security test.
• Apply least privilege and separate administrative accounts.
• Use multi-factor authentication, especially for privileged access.
• Prevent password and secret reuse; store secrets in managed systems.
• Patch and securely configure exposed systems.
• Segment test, production and critical environments.
• Monitor authentication, privilege changes, exports and unusual availability events.
• Maintain tested, protected and offline-capable backups.
• Preserve evidence with a documented chain of custody.
• Coordinate disclosure, containment and recovery with legal, privacy and technical teams.
• Never treat a dual-use tool as automatically lawful or automatically criminal; examine purpose, permission, scope and conduct.

Chapter Summary

Unauthorised access is the acquisition or use of a digital resource without valid permission or beyond the limits of permission. Credential attacks, vulnerability exploitation and privilege escalation are common routes to such access. System interference includes altering, deleting, encrypting or obstructing data and systems. Malware can compromise confidentiality, integrity and availability, while denial-of-service attacks primarily target availability and botnets provide distributed infrastructure for abuse.

Legal analysis should identify the conduct, mental state, authority, harm and causal connection. Possession of a security tool is not necessarily criminal because many tools are dual-use; context, intent, configuration and actual conduct matter. Ethical testing requires written permission, precise scope, controlled methods, minimal disruption and responsible reporting. Incident response requires evidence preservation, timeline construction, attribution analysis and coordinated remediation. Strong governance combines least privilege, authentication, segmentation, secure configuration, monitoring, backups, privacy safeguards and professional accountability.

Key Terms

Authorisation: Permission to access or use a system, account, data or service within defined limits.

Botnet: A network of compromised devices controlled or coordinated by an operator.

Brute-force attack: Systematic testing of many possible credentials or keys.

Confidentiality: Protection of information from unauthorised access or disclosure.

Credential stuffing: Use of credentials obtained from one source against other services.

Data interference: Unauthorised alteration, deletion, suppression or obstruction of computer data.

Denial of service: Conduct that makes a digital service unavailable or materially degraded.

Distributed denial of service: Denial of service generated from multiple sources.

Dual-use tool: A tool capable of legitimate security work and unlawful abuse.

Integrity: Accuracy, completeness and trustworthiness of data and systems.

Least privilege: Granting only the permissions necessary for an authorised task.

Malware: Software designed, used or adapted to perform unauthorised or harmful actions.

Multi-factor authentication: Authentication using two or more distinct factor types.

Privilege escalation: Obtaining permissions greater than those legitimately assigned.

Responsible disclosure: Reporting a vulnerability through an appropriate process while limiting harm.

System interference: Unauthorised impairment, interruption or obstruction of a computer system.

Unauthorised access: Obtaining or using a system or resource without valid permission or beyond permitted scope.

Vulnerability: A weakness that can compromise a security property when exploited.

Review Questions

Short Answer Questions

1. Distinguish access from authorisation.
2. What are the three elements of the CIA triad?
3. Explain the difference between vertical and horizontal privilege escalation.
4. Why are hacking tools often described as dual-use?
5. Identify two requirements of an ethical security test.

Long Answer Questions

1. Explain how credential attacks can lead to unauthorised access and recommend controls to reduce the risk.
2. Discuss the legal and investigative significance of data interference and system interference.
3. Compare denial-of-service attacks and botnet-enabled distributed denial-of-service attacks.
4. Explain why written scope and authorisation are essential in penetration testing.
5. Describe a structured process for investigating a suspected malware incident.

Analytical / Application Questions

1. An employee is authorised to maintain a test server but uses a stored service credential to enter production and copy records. Analyse the authority, conduct, possible harm and evidence issues.
2. A researcher discovers a serious vulnerability in a public service and runs repeated tests without permission. Evaluate the ethical and legal risks and propose a responsible disclosure approach.
3. A hospital suffers an outage after a compromised internet-of-things device sends malicious traffic. Design a proportionate response covering containment, evidence, continuity, notification and long-term prevention.

Multiple Choice Questions with Answers

Question 1

Which statement best describes unauthorised access?

A. Using any security tool against a system

B. Obtaining or using a resource without valid permission or beyond permitted scope

C. Accessing a public website through a normal browser

D. Testing a system under a written and defined authorisation

Correct Answer: B. Obtaining or using a resource without valid permission or beyond permitted scope

Question 2

Which CIA property is primarily affected when records are changed without permission?

A. Confidentiality

B. Availability

C. Integrity

D. Authentication

Correct Answer: C. Integrity

Question 3

What is credential stuffing?

A. Trying many passwords against one account only

B. Using credentials from one breach against other services

C. Encrypting credentials in a password manager

D. Creating a new administrative account

Correct Answer: B. Using credentials from one breach against other services

Question 4

What is vertical privilege escalation?

A. Moving from a low privilege level to a higher privilege level

B. Accessing another user’s data at the same privilege level

C. Moving data between geographic regions

D. Changing a password after login

Correct Answer: A. Moving from a low privilege level to a higher privilege level

Question 5

Which characteristic most clearly distinguishes an authorised load test from a denial-of-service attack?

A. It uses a network connection

B. It is conducted with defined permission, limits and safeguards

C. It may affect availability

D. It generates system requests

Correct Answer: B. It is conducted with defined permission, limits and safeguards

Question 6

Why is possession of a security tool not automatically proof of a cyber offence?

A. All security tools are harmless

B. Tools cannot affect computer systems

C. Many tools have legitimate uses and context, intent and conduct matter

D. Tool possession is never regulated

Correct Answer: C. Many tools have legitimate uses and context, intent and conduct matter

Question 7

Which action is most appropriate immediately after discovering active malware on a test server connected to production?

A. Publicly publish the suspected attacker’s identity

B. Ignore it until a scheduled maintenance window

C. Contain the system, preserve evidence and coordinate response

D. Use the malware to attack its presumed source

Correct Answer: C. Contain the system, preserve evidence and coordinate response

Question 8

Which item is most important in defining a security-testing scope?

A. The tester’s preferred software

B. Targets, permitted activities, timing and exclusions

C. The number of people employed by the client

D. The colour of the organisation’s website

Correct Answer: B. Targets, permitted activities, timing and exclusions

Question 9

A botnet is best described as:

A. A secure private network used only by administrators

B. A collection of compromised devices controlled or coordinated by an operator

C. A database backup system

D. A software licensing agreement

Correct Answer: B. A collection of compromised devices controlled or coordinated by an operator

Question 10

Which statement about attribution is most accurate?

A. An IP address always identifies the human offender

B. A successful login proves the account owner acted

C. Attribution normally requires correlation of technical and non-technical evidence

D. Malware automatically records the attacker’s legal identity

Correct Answer: C. Attribution normally requires correlation of technical and non-technical evidence