Legal and Ethical
The Criminal Use of Computer Systems
Contents
The Computer Misuse Act 1990 is the UK law that makes computer misuse a criminal offence. It was passed so that getting into a computer system without permission counts as a crime. The Act has been amended since 1990, so today's offences and penalties differ from the original version.
The offences
The Act defines three main offences:
- Unauthorised access — getting into computer material without permission, or attempting to do so knowing it is not allowed.
- Unauthorised access with intent to commit further offences — getting into a system without permission planning to carry out another crime as well.
- Unauthorised modification of computer material — changing data, programs or settings without permission. Intentionally spreading malware is treated as unauthorised modification.
Criminal use also includes creating malware and intentionally spreading it. Creating malware intended for use in an offence can be prosecuted as making an article for computer misuse; deliberate spreading is unauthorised modification. Accidental infection is not intentional spreading.
Current penalties
A later amendment added a further offence: making, supplying or obtaining articles for computer misuse, punished with up to 2 years' imprisonment and/or an unlimited fine.
| Offence | Maximum imprisonment | Fine |
|---|---|---|
| Unauthorised access | 2 years | Unlimited |
| Unauthorised access with intent to commit further offences | 5 years | Unlimited |
| Unauthorised modification of computer material, including spreading malware | 10 years | Unlimited |
| Making, supplying or obtaining articles for computer misuse | 2 years | Unlimited |
An unlimited fine means there is no maximum fine set by law, so a court can impose any amount. A person can be imprisoned, fined, or both.
Worked example
Suppose you help out at a local swimming club and use one of its tablets. A link on the club's system opens a page of members' contact details that is meant only for club staff, and you know this. Opening it is unauthorised access, carrying up to 2 years. Opening it planning to change another member's details is unauthorised access with intent to commit further offences, up to 5 years. Actually editing the details is unauthorised modification, up to 10 years. A program that automatically edits every record could be making an article for computer misuse, up to 2 years.
Unauthorised access means gaining, or attempting to gain, access to computer material — a device, an account, a folder or a whole system — without permission, when the person knows the access is not authorised. It covers trying as well as succeeding: nobody has to get in for the offence to happen.
Why a failed attempt still counts
The offence is complete the moment someone tries, knowing they have no right to be there. The owner does not need to lose data or money, and a wrong guess does not make the person innocent.
For example, a student at a youth club edits the web address of the club's booking page to reach its admin area. The page refuses and shows an error, but they knew they had no permission and were trying to get in — so the offence has been committed even though nothing opened.
Ways it can happen
- Sitting at a classroom computer a teacher has left signed in and opening the folder holding next week's test.
- Signing in to a neighbour's home router with the default admin password printed on the sticker underneath it, then changing its settings.
- Guessing the PIN on someone else's tablet and reading their messages.
The route in might be another person's login details, password-cracking software or an unlocked machine. All of these are the same offence because of one shared fact: the person knows the access is not authorised. Weak protection does not make access allowed — permission is what matters.
Access with intent to commit further offences
This is the more serious offence: getting into a computer without permission and doing it in order to commit another crime, or to make one easier. That crime could be theft (copying a company's customer list and selling it to a rival), fraud, blackmail or harassment (using someone else's account to send cruel messages to their contacts).
It is punished more harshly because the break-in is only the first step — the person is using the access to cause far greater harm, so the law looks at the plan behind the access as well as the access itself.
Unauthorised modification means changing data, programs or settings on a computer system without permission. It is one of the three main offences under the Computer Misuse Act 1990, alongside unauthorised access and unauthorised access with the intention of committing another offence.
The change must be deliberate and made with no right to do it — a file that is damaged by accident is not this offence. For example, a pupil who edits the school's reward-points database to add 500 points to their own record has changed data without permission.
What counts as modification?
| Computer material | Authorised change | Unauthorised modification |
|---|---|---|
| Data | An office worker corrects a typing mistake in a customer's address | Someone edits the same customer's order to mark it as already paid |
| Program | A developer releases a bug fix | Someone alters the program so it skips a payment step |
| Settings | An administrator adds a new staff account | Someone gives themselves administrator rights without approval |
Installing malware counts as unauthorised modification, because it puts new files on a system and changes its settings without the owner's permission. Software can do the changing for you too: a free toolbar that switches a company's browser homepage and search engine to a different site has altered settings without permission, and a program that quietly creates extra user accounts has changed data.
Permission is the deciding factor. An IT technician updating a database as part of their job is authorised; someone making the same change without approval is committing an offence. Unauthorised modification can make records unreliable or stop software working, so the Computer Misuse Act 1990 sets a penalty of up to 10 years in prison and an unlimited fine.
Malware is software written to cause harm, such as damaging a device or corrupting files. Creating it and deliberately spreading it are both criminal offences, but the law treats them in different ways.
Creating malware
Writing malware can be treated as making an article for use in computer misuse. The offence is committed by producing the tool, not only by using it. For example, if you write a program that scrambles every document on a computer so its owner cannot open them, you have created malware. It does not need to have damaged anything yet: making a tool that is designed for computer misuse, intending it to be used that way, is enough.
Intentionally spreading malware
Deliberately distributing malware is also an offence. Spreading it on purpose is treated as unauthorised modification under the Computer Misuse Act 1990, because once the malware runs it changes data, programs or settings on someone else's system without their permission. Sending an infected game mod to a friend, uploading it to a shared cloud folder or copying it onto a school network drive on purpose are all examples of intentional spreading.
Intention is the key difference. If your own device picks up an infection and the malware copies itself to your contacts without you knowing, you have not intentionally spread it — the person who released the malware is responsible. Accidental infection is not the same as deliberately passing malware on.
Why it is treated seriously
Malware can corrupt data or damage a computer system. It might wipe a folder of coursework, change figures in a spreadsheet or stop a device from starting up. Because the harm can be serious and hard to undo, the law treats creating and intentionally spreading malware as criminal offences.
Malware can reach a device by more than one route. A route is the path a malicious program takes to get onto your system or to start running on it.
Infected removable storage
Removable storage devices such as memory cards and portable hard drives can carry malware from one device to another. The malware may be hidden in a file or program stored on the drive. When you connect the device and open that file, the malicious code can transfer to your computer and run. No internet connection is needed for this route, so an infected drive can still spread malware on a network that is otherwise well protected.
Unsecured or open Wi-Fi
An unsecured or open Wi-Fi network has no password or security key, so anyone nearby can join it. Because the network is not protected, a malicious device on it could intercept data you send, redirect you to a fake page or swap a file you download for an infected one. You cannot easily tell who else is connected.
Untrusted websites and downloaded files
Untrusted websites are sites you do not know or trust. They may offer free software, game add-ons or tools that hide malware inside the download. When you visit the site or download and run the file, the malicious program can install itself. For example, a pop-up advert might offer a free drawing app; the installer also copies harmful code onto your device.
Email malware is malicious software that arrives in an email and can be installed when you open an attachment or click a link. The email is only the delivery method: the harmful code is hidden inside the attached file or on the web page that the link opens.
You do not infect a computer simply by receiving or opening an email. The infection happens when you take the next step and run the attachment or follow the link, because that is when the malicious code is allowed to execute. For example, an email might claim to be a cinema sending your booking receipt, with an attachment called booking-receipt.pdf.exe. The end of the name tells the computer to run it as a program, but the .pdf part makes it look like an ordinary document, so opening it can install malware on your device. A link can work in a similar way: it may look like a normal web address but take you to a page that tries to run harmful code.
Reducing the risk
Treat unexpected attachments and links with suspicion, especially if the message is urgent, asks you to sign in, or comes from an address you do not recognise. Do not open the attachment or click the link.
- Do not open suspicious attachments or links: this stops any hidden program from running, so the malware never gets the chance to install.
- Delete the email: removing it reduces the chance that you or someone else opens it by mistake later.
- Report it: telling your email provider or school IT team can help them block the sender and warn other users, which protects them from the same message.