Identifying Computer Misuse Act Offences

When a scenario describes a computer-related action, work through two questions in order. First, was the access or the act authorised — carried out with the owner's permission? Second, if it was not, what did the person intend? The intention decides which offence applies.

Step 1: check permission

If permission was given, the action is lawful under the Act, however suspicious it looks. A youth club leader asking a volunteer to update the membership spreadsheet on the club laptop is not computer misuse. Checking your own systems for weaknesses, with permission, is allowed too. Permission only stretches as far as it was given, so using an account you already hold for something nobody agreed to is still unauthorised access.

Step 2: read the intention

Access without permission on its own is Offence 1, even if nothing is changed or taken.

Telling Offence 2 and Offence 3 apart

These are the two most easily confused, because both usually follow unauthorised access. Offence 2 looks outward to another crime; Offence 3 looks at the computer itself. Spreading malware to disrupt a machine is Offence 3, not Offence 2.

One incident can break more than one offence: getting in without permission is already Offence 1, and anything done afterwards that stops the system working properly adds Offence 3 — so name the offence that matches the facts you are given.