Offence 3: Unauthorised Acts to Impair

Offence 3 of the Computer Misuse Act 1990 is committed when a person carries out an unauthorised act — something they do not have permission to do — and intends to impair the operation of a computer. Impairing means damaging or interfering with how a computer, system or service works, for example slowing it down or stopping it working. The offence was originally called unauthorised modification of computer material; it was renamed because it covers disruption, not only changing stored data.

Offence 3 also applies when the person knows there is a risk that their unauthorised act will impair a computer. They do not have to be certain the damage will happen, and the act does not have to succeed. For example, a pupil who is not allowed to install software puts a program on a library computer that stops it connecting to the printer, intending to disrupt lessons. That is Offence 3. If they did not actually want printing to fail but knew the program might have that effect, the offence can still apply.

Acts covered

Offence 3 is not only about wiping stored information. These unauthorised acts count when the aim is to disrupt:

• deleting or altering data so a system stops working properly
• spreading malware that makes computers malfunction
• installing spyware on someone else's computer
• a denial of service attack, flooding a system so genuine users cannot get on
• changing a website's content without the owner's permission

Smaller disruptions count too: putting a script on a shared tablet so it restarts whenever someone tries to log in, or altering a sports centre's booking terminal so it rejects valid memberships.

Sending malware is not automatically Offence 2, which is about intending to commit another crime. The key question is whether the act was unauthorised and whether the person intended, or knew of the risk of, impairing a computer.