Cybercrime

The core offence underpinning most hacking prosecutions is section 1 of the Computer Misuse Act 1990, headed simply "Unauthorised access to computer material", which is committed where a person causes a computer to perform a function intending to secure unauthorised access to a program or data and knows at the time that the access is unauthorised. A second, more serious tier of offending is created by section 3, headed "Unauthorised acts with intent to impair, or with recklessness as to impairing, operation of computer", which captures conduct intended (or reckless as to whether it will) "impair the operation of any computer" - the provision used to prosecute malware distribution and denial-of-service attacks - and which on conviction on indictment carries imprisonment "for a term not exceeding ten years or to a fine or to both", reflecting Parliament's view of the seriousness of large-scale computer sabotage compared with simple unauthorised access.

Cybercrime is not confined to the Computer Misuse Act: much online offending is prosecuted as ordinary fraud committed by digital means. The Fraud Act 2006 creates the offence of "fraud by false representation", which applies equally whether the false representation is made in person, by letter, or - as is now typical - through a phishing email, a fake website, or a fraudulent online marketplace listing. Prosecutors therefore routinely charge cyber-enabled offending (such as online banking fraud, romance scams, or business email compromise) under the Fraud Act rather than, or in addition to, the Computer Misuse Act, with the choice of statute depending on whether the essence of the wrongdoing is the deception practised on the victim or the unauthorised interference with a computer system.