Computer Misuse Act 1990

This lesson covers the Computer Misuse Act 1990 for the OCR A-Level Computer Science (H446) specification, section 1.5. This is the primary UK law that criminalises unauthorised access to computer systems and data.

---

Background

The Computer Misuse Act 1990 was introduced to criminalise hacking and other forms of unauthorised computer access. Before this Act, there was no specific UK law against hacking -- a gap highlighted by the case of Robert Schifreen and Steve Gold, who accessed BT's Prestel system in 1984 but could not be convicted under existing laws.

---

The Three Main Offences

Section 1: Unauthorised Access to Computer Material

Aspect	Detail
Offence	Intentionally accessing a computer system without authorisation.
Intent required	The person must know that the access is unauthorised.
Example	Guessing or stealing someone's password to read their emails.
Penalty	Up to 2 years imprisonment and/or an unlimited fine.

This is the "basic hacking" offence. It does not require any intent to commit further crimes -- merely accessing the system without permission is enough.

Section 2: Unauthorised Access with Intent to Commit Further Offences

Aspect	Detail
Offence	Gaining unauthorised access to a computer with the intent to commit or facilitate a further offence (e.g., fraud, theft, blackmail).
Intent required	The person must intend to use the access to commit another crime.
Example	Hacking into a bank's system to transfer money to your own account.
Penalty	Up to 5 years imprisonment and/or an unlimited fine.

This is a more serious version of Section 1, where the unauthorised access is a stepping stone to another crime.

Section 3: Unauthorised Acts with Intent to Impair, or with Recklessness

Aspect	Detail
Offence	Performing unauthorised acts that impair (or risk impairing) the operation of a computer, the reliability of data, or access to any program or data.
Intent required	The person must intend to impair the computer's operation, or be reckless as to whether it would be impaired.
Examples	Distributing malware, conducting a DDoS attack, deleting or modifying data, deploying ransomware.
Penalty	Up to 10 years imprisonment and/or an unlimited fine.

This section covers the most serious offences: actively damaging or disrupting computer systems.

---

Summary of Offences

Section	Offence	Maximum Penalty
Section 1	Unauthorised access to computer material	2 years / unlimited fine
Section 2	Unauthorised access with intent to commit further offence	5 years / unlimited fine
Section 3	Unauthorised acts with intent to impair or with recklessness	10 years / unlimited fine

---

Amendments

The Computer Misuse Act has been amended several times:

Police and Justice Act 2006