Computer Misuse Act 1990

The Computer Misuse Act 1990 is the UK law that makes computer misuse a criminal offence. It was passed so that getting into a computer system without permission counts as a crime. The Act has been amended since 1990, so today's offences and penalties differ from the original version.

The offences

The Act defines three main offences:

• Unauthorised access — getting into computer material without permission, or attempting to do so knowing it is not allowed.
• Unauthorised access with intent to commit further offences — getting into a system without permission planning to carry out another crime as well.
• Unauthorised modification of computer material — changing data, programs or settings without permission. Intentionally spreading malware is treated as unauthorised modification.

Criminal use also includes creating malware and intentionally spreading it. Creating malware intended for use in an offence can be prosecuted as making an article for computer misuse; deliberate spreading is unauthorised modification. Accidental infection is not intentional spreading.

Current penalties

A later amendment added a further offence: making, supplying or obtaining articles for computer misuse, punished with up to 2 years' imprisonment and/or an unlimited fine.

An unlimited fine means there is no maximum fine set by law, so a court can impose any amount. A person can be imprisoned, fined, or both.

Worked example

Suppose you help out at a local swimming club and use one of its tablets. A link on the club's system opens a page of members' contact details that is meant only for club staff, and you know this. Opening it is unauthorised access, carrying up to 2 years. Opening it planning to change another member's details is unauthorised access with intent to commit further offences, up to 5 years. Actually editing the details is unauthorised modification, up to 10 years. A program that automatically edits every record could be making an article for computer misuse, up to 2 years.