Denial of Service Attack

DDoS and similar overload attacks fall within section 3 of the Computer Misuse Act 1990, headed "Unauthorised acts with intent to impair, or with recklessness as to impairing, operation of computer, etc." The offence is made out where a person does an unauthorised act knowing it to be unauthorised, intending (or reckless as to whether the act will) "impair the operation of any computer" or "prevent or hinder access to any program or data held in any computer". Crucially, section 3(4) makes clear that the intent or recklessness "need not relate to" "any particular computer", meaning a defendant who floods a target with traffic does not need to have any specific victim machine in mind at the outset; a general intent to disrupt is sufficient, which is what makes the offence well-suited to botnet-driven attacks that indiscriminately target whichever systems are reachable.

The maximum sentence scales with the mode of trial: on summary conviction the offence is punishable by a fine and a term of imprisonment up to the general limit in a magistrates' court, but "on conviction on indictment, to imprisonment for a term not exceeding ten years or to a fine or to both" - a substantial uplift reflecting Parliament's treatment of computer sabotage as significantly more serious than mere unauthorised access under section 1. Because a 'temporary' disruption still counts, the Act expressly extends to short-lived denial-of-service incidents: it defines impairing, preventing or hindering something as including "doing so temporarily", so an attacker cannot argue that an outage lasting only minutes or hours falls outside the offence.