Crossing boundaries in the digital space

DAR ES SALAAM: WITH the growing use of technology, many things we once did physically have slowly found a new home online. We shop online, work online, advertise online, communicate online and, for many people, earn a living online.

A small business may have no physical shop at all, yet it may have a busy Instagram page, a Facebook account, a website and a WhatsApp number bringing in customers every day.

Our digital spaces have become more than just spaces. They have become part of what we own, what we build and, sometimes, what we depend on to survive. But here is the interesting part. As technology grows, so does the creativity of people with bad intentions.

Every new convenience seems to come with a new trick. We find a new way to sell; someone finds a new way to steal. We find a new way to communicate, someone finds a new way to interfere. We build our businesses online and someone else learns how to break into the very space where that business lives.

And that brings us to something you may not have heard discussed this way before: cyber trespass. When we hear the word trespass, most of us think about land. You have your house, your farm or your piece of land. There is a boundary around it, whether it is a wall, a fence, a gate or simply a line you know belongs to you.

If I walk onto your property without your permission, I have crossed a boundary that was not mine to cross. That is the simple idea behind traditional trespass. But what happens when the property has no gate?

What happens when the boundary is a password? What happens when the place I enter is your Instagram account, your email, your website or your business system?

That is where things get interesting. Picture this. You run an online clothing business. Your Instagram account is your shop. Your customers know you by that account. They place orders through your messages. They see your new clothes through your posts. You have spent years building trust and a good name.

Then one morning, you wake up and your password no longer works. You try again. Nothing. Then the messages start coming in: “Why are you sending me this?” “Did you change the price?” “Why are you asking me for money?”

You are confused because you did none of those things. Someone has entered your account, taken control of it and is now speaking to your customers as though they were you. Suddenly, your little online shop has become a very big problem.

Your customers are confused. Your reputation is at risk. You may lose sales. You may spend hours trying to recover the account. You may even have to explain to customers that the person they were speaking to was not you.

Now ask yourself: if someone entered your physical shop without permission, you would probably have no difficulty calling that trespass. So why should the conversation become completely different simply because your shop exists behind a screen? That is the question cyber trespass brings to the table.

At its simplest, cyber trespass is about unauthorised and intentional interference with another person’s digital or computer system. In other words, it is not simply about accessing a computer. It is about crossing a digital boundary without having the right to cross it. And this is important because not every person who accesses a computer system is automatically a trespasser.

If you give your employee permission to use your business account, their access is authorised. If you give your website developer permission to work on your website, they are not suddenly a trespasser because they opened the system. The question is whether they had the right to be there and what they did once they got there. That brings us to one of the most interesting questions in cyber trespass: is entering someone’s digital space without permission enough, or must something more happen?

ALSO READ: The rise of AI agents, opportunity, responsibility and trust

This question was famously considered in Intel Corp. v. Hamidi. Hamidi was a former employee of Intel who sent emails to Intel employees criticising the company. Intel did not want the messages sent through its system and argued that Hamidi’s conduct amounted to trespass to its property. At first, you might think, “Well, if Intel said stop and he kept sending the emails, surely that is trespass.” But the court looked a little deeper. The emails had not damaged Intel’s computers.

They had not stopped the computers from working. Intel had not lost the use of its system. In other words, there was unwanted interference, but the computer system itself had not been damaged or impaired. The court therefore did not treat Hamidi’s conduct as trespass to chattels simply because the messages were unwanted. And that case teaches us that not every unwanted thing online is automatically cyber trespass. The law has to look at what actually happened.

Did the person have permission? Did they intentionally enter or interfere with the system? Did their conduct affect the system? Was there damage, loss or another form of interference?

These questions matter because the digital world is not always as straightforward as the physical world. If someone breaks your window, you can point to the broken glass. If someone walks across your land, you can point to the footprints.

But online, the damage can be invisible. Sometimes the damage is the time you spend recovering an account. Sometimes it is the customers you lose or the business reputation that takes months or years to rebuild. Sometimes it is information that has been accessed, altered or deleted.

Sometimes the biggest damage is simply the disruption caused by someone who had no business being there in the first place. And this is why the idea of cyber trespass deserves more attention, especially now that so many businesses live online.

Your Instagram page may be your shop, your website may be your office, your email may be your filing cabinet, your database may be your customer book and your password may be the lock on the door. The fact that we cannot see these things physically does not make them meaningless.

There is also an important distinction between cyber trespass as a civil wrong and illegal access as a criminal offence. In Tanzania, the Cybercrimes Act, 2015 makes intentional and unlawful access to a computer system an offence. So, depending on what happened, unauthorised entry into someone’s computer system may raise criminal as well as civil legal questions.

This is why we should stop thinking of online interference as simply “someone hacked my account.” Sometimes those few words describe something much bigger. They may describe interference with someone’s business, property, privacy, reputation and livelihood. Of course, the law also recognises that not every access is wrongful. Permission matters. Intention matters. The circumstances matter.

A person who accidentally opens the wrong page is not necessarily in the same position as someone who deliberately obtains your password, bypasses your security and takes control of your business account. The facts matter because the law is not simply asking, “Did you touch the computer?” It is asking, “What did you do, were you allowed to do it and what happened because of it?” So, the next time someone tells you, “It is just an Instagram account,” think again. For someone else, it may be just an account.

For you, it may be your shop, your customers, your reputation and your income. Technology has changed the way we live, but it has not removed the idea of boundaries. It has simply given us new ones. Some boundaries are made of bricks. Others are made of passwords.

Some have gates. Others have login pages. Some can be seen. Others can only be understood. And perhaps that is the easiest way to understand cyber trespass. You do not have to break a door to trespass. Sometimes, the door is a password. Sometimes, the property is digital. And sometimes, the person crossing the boundary is sitting hundreds of kilometres away, touching nothing physical, yet still causing very real harm.

Disclaimer: This article is published by Jua Leo, Jilinde Kesho for general legal education and public awareness. It does not constitute legal advice and should not be treated as a substitute for advice from a qualified legal professional. The application of the law depends on the specific facts and circumstances of each matter. If you believe that your rights have been violated, seek appropriate legal advice or legal assistance.