Computing related legislation: Computer Misuse Act 1990

Overview

Recall questions on the Computer Misuse Act 1990, why it was needed, its offences of unauthorised access, access with intent and impairing a computer, exceeding authorised access, penetration testing, hacking tools, ransomware and proving intent.

What you need to know

Answer each one before you reveal it.

Questions from this subtopic

Each one with the model answer underneath.

1. 1

   Why was the Computer Misuse Act 1990 passed at all, given that theft, criminal damage and fraud were already crimes?

   Model answer

   Because the existing offences were a poor fit for conduct that neither took property nor damaged anything physical. The trigger was the prosecution of Robert Schifreen and Stephen Gold, who in the mid-1980s obtained a Prestel engineer's credentials and browsed accounts including a mailbox belonging to the Duke of Edinburgh. There was no offence of unauthorised access, so they were charged under the Forgery and Counterfeiting Act 1981 on the theory that the credentials they entered were a false instrument. The Court of Appeal quashed the convictions in 1987 and the House of Lords upheld that in 1988, holding that the forgery legislation had been stretched beyond what it could bear. Following a Law Commission report, the Computer Misuse Act 1990 created purpose-built offences aimed at unauthorised access and at interference with the operation of computers.

2. 2

   Describe the first offence under the Computer Misuse Act 1990.

   Model answer

   Unauthorised access to computer material. It is committed where a person causes a computer to perform any function with intent to secure access to any program or data held in any computer, the access intended is unauthorised, and the person knows at the time that it is unauthorised. Three features catch students out. First, the intent need not be aimed at any particular program, data or computer, so speculative probing counts. Second, no data need be read, copied or changed; merely causing the machine to attempt the access is enough, so a failed login attempt made in the knowledge that you have no right to that account is within the offence. Third, the wrongdoing is the lack of authorisation, not the technical difficulty, so using a password left on a sticky note is as much an offence as defeating a firewall. It was originally summary only with a six-month maximum; the Police and Justice Act 2006 made it triable either way with a maximum of two years' imprisonment and a fine.

3. 3

   Describe the second offence under the Computer Misuse Act 1990 and explain what it adds to the first.

   Model answer

   Unauthorised access with intent to commit or facilitate the commission of a further offence. It requires everything the first offence requires, and adds an ulterior intent: at the time of the unauthorised access the person intends to commit a further offence, or to facilitate someone else committing one, where that further offence is one carrying a fixed sentence or for which an adult could be sentenced to five years or more. Two points give it reach. The further offence may be intended for the future rather than the same occasion, and it is still committed even if the further offence turns out to be impossible, so breaking into a bank system intending to transfer money is caught even if the account is empty. What it adds to the first offence is the aggravation of purpose, and the penalty reflects that: a maximum of five years' imprisonment and a fine.

4. 4

   Describe the third offence under the Computer Misuse Act 1990.

   Model answer

   Unauthorised acts with intent to impair, or with recklessness as to impairing, the operation of a computer. It is committed where a person does any unauthorised act in relation to a computer, knowing it is unauthorised, and intends by that act to impair the operation of any computer, prevent or hinder access to any program or data, impair the operation of a program or the reliability of data, or enable any of those things, or is reckless as to whether it will have such an effect. As originally enacted in 1990 it was framed narrowly as unauthorised modification of computer material; the Police and Justice Act 2006 broadened it to unauthorised acts so that denial-of-service attacks, which flood a machine without modifying anything on it, were plainly covered. The impairment may be temporary. The maximum sentence is ten years' imprisonment and a fine.

5. 5

   Use one scenario to show the difference between the three main Computer Misuse Act offences.

   Model answer

   Take an employee who resents her manager. She guesses the manager's password and reads his mailbox out of curiosity. That is the first offence: unauthorised access, knowing it is unauthorised, nothing more. Suppose instead she logs in to the payroll system with those credentials in order to redirect salary payments to her own account. That is the second offence, because the unauthorised access is committed with intent to commit a further serious offence, and it is complete at the moment of access even if she is locked out before moving any money. Suppose instead she logs in and deletes the manager's project files, or installs a script that slows the department's file server to a crawl. That is the third offence, because she has done an unauthorised act intending to impair the reliability of data or the operation of a computer. The ladder is: access alone, access as a stepping stone to a further crime, and interference with the machine or its data. The maximum penalties rise correspondingly through two, five and ten years.

6. 6

   A hospital administrator has a legitimate login to the patient records system. She looks up her neighbour's records out of curiosity. Has she broken the Computer Misuse Act 1990?

   Model answer

   Yes, on the first offence. Authorisation under the Act is not all-or-nothing at the level of the machine: it is judged against the access the person is actually entitled to. She is entitled to access records for the purposes of her job, and she knows that curiosity about a neighbour is not one of those purposes, so the access she secured is unauthorised and she knows it is. The fact that the system let her in is irrelevant, because the offence turns on entitlement rather than on whether a technical control blocked her. This kind of case, sometimes called insider snooping, is prosecuted in practice, historically often under data protection legislation but also under the Computer Misuse Act. It also engages data protection duties on the hospital as controller, since the seventh principle expects access controls and audit trails proportionate to the sensitivity of health data.

Other ways to work this

The same content, four other ways.

What is inside Levo

Six ways to work the same material.