Computer Misuse Act 1990

Summary

The Computer Misuse Act 1990 is the principal statute criminalising hacking and cybercrime in England & Wales. It creates three core offences: unauthorised access to computer material, unauthorised access with intent to commit further offences, and unauthorised acts with intent to impair the operation of a computer. It was substantially amended by the Serious Crime Act 2015 to address modern cybercrime threats.

Key Points

• Section 1: unauthorised access to computer material (basic hacking) — max 2 years' imprisonment
• Section 2: unauthorised access with intent to commit or facilitate further offences — max 5 years
• Section 3: unauthorised acts with intent to impair, or with recklessness as to impairing, the operation of a computer (includes DDoS attacks, deploying malware) — max 10 years
• Section 3ZA: unauthorised acts causing or creating risk of serious damage (e.g., threats to national security, human welfare, the environment) — max life imprisonment
• Section 3A: making, supplying, or obtaining articles for use in offences under ss.1-3 (hacking tools)
• Extraterritorial jurisdiction — offences may be prosecuted in the UK if there is a significant link to England & Wales (s.4-9)
• Unauthorised access offence (s.1)
• Access with intent to commit further offences (s.2)
• Impairing computer operation (s.3)
• Extraterritorial jurisdiction

Parts & Sections

Amendments History

Frequently asked questions

What is the main purpose of the Computer Misuse Act 1990?

The Computer Misuse Act 1990 is the principal statute in England and Wales that criminalises hacking and cybercrime. It establishes three core offences: unauthorised access to computer material, unauthorised access with intent to commit further offences, and unauthorised acts with intent to impair computer operation. The Act was substantially amended by the Serious Crime Act 2015 to address modern cybercrime threats.

What is the maximum sentence for basic hacking under the Act?

Section 1 of the Act covers unauthorised access to computer material, often described as basic hacking. The maximum penalty for this offence is two years' imprisonment. This provision targets individuals who access computer systems without permission, regardless of whether they intended to cause further harm or commit additional crimes.

What is the maximum penalty for causing serious damage through computer misuse?

Section 3ZA, introduced by the Serious Crime Act 2015, covers unauthorised acts that cause or create a risk of serious damage. This includes threats to national security, human welfare, or the environment. The maximum penalty for this specific offence is life imprisonment, reflecting the severe nature of the potential harm involved.

Is it illegal to create or supply hacking tools under the Act?

Yes, Section 3A makes it an offence to make, supply, or obtain articles for use in offences under Sections 1 to 3. This provision specifically targets the creation and distribution of hacking tools. It was introduced by the Police and Justice Act 2006 to address the supply side of cybercrime infrastructure.

Can the Computer Misuse Act apply to crimes committed outside the UK?

The Act has extraterritorial jurisdiction, meaning offences may be prosecuted in the UK even if they occur outside England and Wales. This applies if there is a significant link to England and Wales. This provision ensures that cybercriminals cannot avoid prosecution simply by operating from a different location if their actions affect UK systems or interests.