The Computer Misuse Act

The Computer Misuse Act 1990 is UK legislation that protects computer systems, and the data stored on them, from unauthorised access and deliberate damage or disruption. It is a criminal law, so a person who breaks it can be taken to court.

Its purpose is to make it a criminal offence to access or change computer material — the programs and data held on a computer — without permission. The Act puts into writing what counts as misuse of a computer, so that the courts have a clear rule to apply instead of judging each case from scratch.

The Act provides the legal framework for deciding whether an action involving a computer is unlawful. It names the kinds of behaviour that are not allowed, such as accessing computer material without permission or causing deliberate damage to a computer or the service it provides. For example, a garden centre keeps its plant stock list on a computer. If someone outside the garden centre accesses that list without permission, the Act is what makes it a criminal offence. The same idea applies to any computer system and the data on it, whether it belongs to a business, a school or a public service.

Unauthorised means using a computer, or the data held on it, when the person or organisation that owns or controls it has not given permission for that use. Every offence under the Computer Misuse Act 1990 comes back to one question: did this person have permission for this action on this system?

Permission is what separates legal from illegal

The same action can be completely lawful for one person and a criminal offence for another. Nothing about the action itself changes — only the authorisation behind it. That is why authorised access and authorised actions are legal under the Act, while identical steps taken without permission are not.

Knowing a password is not the same as being allowed to use it, and having an account does not give unlimited rights. Permission covers a particular system and a particular action: a pupil given a temporary editor account to fix a broken link on the school prom page cannot use that same account to download the guest list.

Who gives permission, and how far it reaches

Only the owner, or the organisation in control of the computer or data, can give permission, and they can set limits on it. Where permission covers what was done, no offence has been committed.

A penetration tester is someone an organisation gives permission to try to break into its systems: the testing is lawful only because that permission came first and stated which systems could be tested. Network administrators may access the systems they are responsible for, but only within the permissions their employer gives — a school technician can reset staff passwords, but reading a colleague's personal messages is outside what the school authorised.

The club's permission, given in advance and limited to the fixture page, is what keeps the first row lawful: the account being able to reach more does not widen it.

Offence 1 of the Computer Misuse Act 1990 is unauthorised access to computer material. This means knowingly opening, viewing or using programs or data on a computer when you do not have the owner's permission. The key word is unauthorised: the access happens without permission. Permission must cover the particular files or programs you open.

The offence is complete at the moment of access. Nothing has to be changed, damaged, copied or stolen. Suppose a pupil at a youth club knows that the committee's trip budget is private, but opens the folder on the club laptop and reads the figures. They then close the folder without editing anything. They have still committed Offence 1, because they accessed data they were not allowed to see. The same is true of opening someone else's program just to look at how it works.

This is why it is wrong to think that hacking, meaning accessing a computer without permission, is only illegal if data is stolen or damaged. The question is whether the access was authorised, not whether harm was caused. Offence 1 is the basic offence; Offence 2 and Offence 3 involve additional intentions or effects.

Offence 2 of the Computer Misuse Act 1990 is committed when a person gets into a computer, or into data held on one, without permission and does so intending to carry out a further crime of their own — or to help somebody else carry one out. Two things must both be true: the access is unauthorised, and the reason for getting in is criminal. Because the unauthorised access always happens too, Offence 2 also includes Offence 1.

The further offence can be almost any other crime, including fraud, theft, identity theft, blackmail or burglary. For example, imagine a person gets into a courier company's computer system without permission and studies its delivery records to work out which houses will be empty on a particular day, planning to burgle one of them. The access is unauthorised, and the burglary they intend to commit is the further offence.

Intention is enough

For Offence 2, the person's intention is enough. The further offence does not have to be completed, or even started beyond the access. If the person is caught before they ever get inside the house, they can still be guilty of Offence 2 because they accessed the system with that criminal purpose in mind. Intending to help somebody else commit their crime counts too: this is called facilitating the offence.

This is different from Offence 1, which is unauthorised access on its own with no further criminal purpose. It is also different from Offence 3, which is about intending to damage or interfere with how a computer operates. Offence 2 points towards another crime, such as fraud or blackmail, rather than at breaking the computer's operation.

Offence 3 of the Computer Misuse Act 1990 is committed when a person carries out an unauthorised act — something they do not have permission to do — and intends to impair the operation of a computer. Impairing means damaging or interfering with how a computer, system or service works, for example slowing it down or stopping it working. The offence was originally called unauthorised modification of computer material; it was renamed because it covers disruption, not only changing stored data.

Offence 3 also applies when the person knows there is a risk that their unauthorised act will impair a computer. They do not have to be certain the damage will happen, and the act does not have to succeed. For example, a pupil who is not allowed to install software puts a program on a library computer that stops it connecting to the printer, intending to disrupt lessons. That is Offence 3. If they did not actually want printing to fail but knew the program might have that effect, the offence can still apply.

Acts covered

Offence 3 is not only about wiping stored information. These unauthorised acts count when the aim is to disrupt:

• deleting or altering data so a system stops working properly
• spreading malware that makes computers malfunction
• installing spyware on someone else's computer
• a denial of service attack, flooding a system so genuine users cannot get on
• changing a website's content without the owner's permission

Smaller disruptions count too: putting a script on a shared tablet so it restarts whenever someone tries to log in, or altering a sports centre's booking terminal so it rejects valid memberships.

Sending malware is not automatically Offence 2, which is about intending to commit another crime. The key question is whether the act was unauthorised and whether the person intended, or knew of the risk of, impairing a computer.

When a scenario describes a computer-related action, work through two questions in order. First, was the access or the act authorised — carried out with the owner's permission? Second, if it was not, what did the person intend? The intention decides which offence applies.

Step 1: check permission

If permission was given, the action is lawful under the Act, however suspicious it looks. A youth club leader asking a volunteer to update the membership spreadsheet on the club laptop is not computer misuse. Checking your own systems for weaknesses, with permission, is allowed too. Permission only stretches as far as it was given, so using an account you already hold for something nobody agreed to is still unauthorised access.

Step 2: read the intention

Access without permission on its own is Offence 1, even if nothing is changed or taken.

Telling Offence 2 and Offence 3 apart

These are the two most easily confused, because both usually follow unauthorised access. Offence 2 looks outward to another crime; Offence 3 looks at the computer itself. Spreading malware to disrupt a machine is Offence 3, not Offence 2.

One incident can break more than one offence: getting in without permission is already Offence 1, and anything done afterwards that stops the system working properly adds Offence 3 — so name the offence that matches the facts you are given.