Computer Misuse Act 1990 | Offences, Penalties and Cybercrime Laws
‘Hacking’ is the act of identifying and exploiting weaknesses in a computer, smartphone, tablet or network system to gain unauthorised access to personal or organisational data.
While some individuals engage in hacking lawfully to help protect confidential information and strengthen security, the term is generally associated with cybercrime and computer misuse, which amounts to a criminal offence in the UK under the Computer Misuse Act 1990 (‘the Act’).
The Act was introduced in response to the rapid growth of computer use and in order to help combat criminal activity such as internet fraud and cyber-attacks. It establishes a range of penalties based on the severity of the offence.
The Act has received considerable criticism for failing to properly anticipate the impact that the internet and the World Wide Web would have on cyber offences, both of which were still in their infancy when the legislation was enacted.
Although, some of the offences created by the Act feature in other legislation, including the Data Protection Act 2018 and the Investigatory Powers Act 2016, the Act remains the statutory framework for computer misuse offences in the UK. Its structure has been substantially adopted and followed by a number of other countries.
John Veale of KANGS comments upon the offences created by the Act and cyber-crime and computer hacking generally.
Cybercrime Offences Explained
Cybercrime can be split into two broad categories:
- Cyber-dependent crime: offences that can only be committed through the use of computers. Offences under the Act fall within the Computer Misuse category.
- Cyber-enabled crime: offences that can be committed without the use of computers, but where their scale, reach or impact is enhanced through computer use.
Cyber-dependent offences include the spread of malware or viruses such as, worms, trojans, spyware and ransomware, whether for sale or personal use. They can also include activities intended to damage, disrupt or interfere with data or network activity, such as denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks, as well as phishing.
Misuse of Computer Offences | The Computer Misuse Act 1990
The Act creates the following five offences.
Section 1: Unauthorised access to computer material.
A person is guilty of an offence if:
- he causes a computer to perform any function with intent to secure access to any program or data held in any computer or to enable any such access to be secured.
- the access he intends to secure, or to enable to be secured is unauthorised and
- he knows at the time when he causes the computer to perform the function that that is the case.
Section 2: Unauthorised access with intent to commit or facilitate commission of further offences.
A person is guilty of an offence if he commits an offence under s.1 with intent:
- to commit an offence to which this section applies or
- to facilitate the commission of such an offence (whether by himself or by any other person).
It is immaterial whether the further offence is to be committed on the same occasion as the unauthorised access offence or on any future occasion.
Section 3: Unauthorised acts with intent to impair, or with recklessness as to impairing, operation of computer etc.
A person is guilty of an offence if:
- he does any unauthorised act in relation to a computer and,
- at the time when he does the act, he knows that it is unauthorised and
either, intends, by doing the act to:
- impair the operation of any computer,
- prevent or hinder access to any program or data held in any computer or
- impair the operation of any such program or the reliability of any such data or
- enable any of the things mentioned above to be done.
Section 3ZA: Unauthorised acts causing, or creating risk of, serious damage.
A person is guilty of an offence if:
- he does any unauthorised act in relation to a computer,
- at the time of doing the act he knows that it is unauthorised,
- the act causes, or creates a significant risk of, serious damage of a ‘material kind’ and
- he intends by doing the act to cause serious damage of a material kind or is reckless as to whether such damage is caused.
Damage of a ‘material kind’ may be to human welfare, the environment and the economy and national security of any country.
An act causes damage to human welfare only if it causes:
- loss to human life,
- human illness or injury,
- disruption of a supply of money, food, water, energy or fuel,
- disruption of a system of communication,
- disruption of facilities for transport or
- disruption of services relating to health.
Section 3A: Making, supplying or obtaining articles for use in offences under Section 1, 3 or 3ZA
A person is guilty of an offence if he:
- makes, adapts, supplies or offers to supply any article intending it to be used to commit, or to assist in the commission of, an offence,
- supplies or offers to supply any article believing that it is likely to be used to commit, or to assist in the commission of, an offence,
- obtains any article intending to use it to commit, or to assist in the commission of, an offence or
- with a view to its being supplied for use to commit, or to assist in the commission of, an offence under sections 1, 3 or 3ZA.
Penalties for Offences Under the Computer Misuse Act
Offences under the Computer Misuse Act 1990 are triable ‘either way’, meaning they can be tried summarily in the Magistrates’ Court or on indictment in the Crown Court.
When a defendant is convicted in the Magistrates’ Court, the maximum sentence is typically a fine, twelve months’ imprisonment or both.
In the Crown Court, upon conviction, a defendant will receive a more severe sentence dependent upon the individual circumstances of the offence, with the maximum prison sentences being:
- Section 1: two years,
- Section 2: five years,
- Section 3: ten years,
- Section 3ZA: fourteen years,
- Section 3A: two years.
In each case a fine may be imposed instead of or in addition to a prison sentence.
In respect of a conviction under section 3ZA of the Act:
If convicted of an offence causing or creating a significant risk of serious damage to:
- human welfare or
- national security,
a defendant is potentially liable to imprisonment for life.
How Can We Help You?
Allegations of computer misuse and cybercrime are often supported by complex digital evidence, forensic analysis, system logs and expert testimony.
Whether you have been invited to attend a police interview under caution, arrested, or are facing investigation or prosecution, obtaining specialist legal advice can be crucial to protecting your position and your rights.
The specialist criminal defence team at KANGS has extensive experience defending clients under investigation or charged with offences under the Computer Misuse Act 1990 and related legislation. We provide strategic, proactive support from the outset of an investigation, combining technical understanding with strong legal representation.
If you are facing allegations of computer misuse, cybercrime or any related offence, contact us for confidential expert advice. Our experienced solicitors are here to guide and support you at every stage, helping you navigate complex technical and legal issues while building the strongest possible defence on your behalf.
Tel: 0333 370 4333
Email: info@kangssolicitors.co.uk
We provide initial no obligation discussion at our three offices in London, Birmingham, and Manchester. Alternatively, discussions can be held through video conferencing or telephone.
Top ranked by leading legal directories Chambers UK and the Legal 500.
