Authorised and Unauthorised Access

Unauthorised means using a computer, or the data held on it, when the person or organisation that owns or controls it has not given permission for that use. Every offence under the Computer Misuse Act 1990 comes back to one question: did this person have permission for this action on this system?

Permission is what separates legal from illegal

The same action can be completely lawful for one person and a criminal offence for another. Nothing about the action itself changes — only the authorisation behind it. That is why authorised access and authorised actions are legal under the Act, while identical steps taken without permission are not.

Knowing a password is not the same as being allowed to use it, and having an account does not give unlimited rights. Permission covers a particular system and a particular action: a pupil given a temporary editor account to fix a broken link on the school prom page cannot use that same account to download the guest list.

Who gives permission, and how far it reaches

Only the owner, or the organisation in control of the computer or data, can give permission, and they can set limits on it. Where permission covers what was done, no offence has been committed.

A penetration tester is someone an organisation gives permission to try to break into its systems: the testing is lawful only because that permission came first and stated which systems could be tested. Network administrators may access the systems they are responsible for, but only within the permissions their employer gives — a school technician can reset staff passwords, but reading a colleague's personal messages is outside what the school authorised.

The club's permission, given in advance and limited to the fixture page, is what keeps the first row lawful: the account being able to reach more does not widen it.