The Computer Misuse Act 1990 is an Act of the Parliament of the United Kingdom, introduced partly in response to the decision in R v Gold & Schifreen 1 AC 1063. Critics of the bill complained that it was introduced hastily and was poorly thought out. Intention, they said, was often difficult to prove, and that the bill inadequately differentiated "joyriding" hackers like Gold and Schifreen from serious computer criminals. The Act has nonetheless become a model from which several other countries, including Canada and the Republic of Ireland, have drawn inspiration when subsequently drafting their own information security laws, as it is seen "as a robust and flexible piece of legislation in terms of dealing with cybercrime”. Several amendments have been passed to keep the Act up to date.
''R v Gold & Schifreen''
and Stephen Gold, using conventional home computers and modems in late 1984 and early 1985, gained unauthorised access to British Telecom's Prestel interactive viewdata service. While at a trade show, Schifreen, by doing what latterly became known as shoulder surfing, had observed the password of a Prestel engineer. The engineer's username was 22222222 and the password used was 1234. This later gave rise to accusations that British Telecom had not taken security seriously. Armed with this information, the pair explored the system, even gaining access to the personal message box of Prince Philip. Prestel installed monitors on the suspect accounts and passed information thus obtained to the police. The pair were charged under section 1 of the Forgery and Counterfeiting Act 1981 with defrauding BT by manufacturing a "false instrument", namely the internal condition of BT's equipment after it had processed Gold's eavesdropped password. Tried at Southwark Crown Court, they were convicted on specimen charges and fined, respectively, £750 and £600. Although the fines imposed were modest, they elected to appeal to the Criminal Division of the Court of Appeal. Their counsel cited the lack of evidence showing the two had attempted to obtain material gain from their exploits, and claimed that the Forgery and Counterfeiting Act had been misapplied to their conduct. They were acquitted by the Lord Justice Lane, but the prosecution appealed to the House of Lords. In 1988, the Lords upheld the acquittal. Lord Justice Brandon said: The Law Lords' ruling led many legal scholars to believe that hacking was not unlawful as the law then stood. The English Law Commission and its counterpart in Scotland both considered the matter. The Scottish Law Commission concluded that intrusion was adequately covered in Scotland under the common law related to deception, but the English Law Commission believed a new law was necessary. Since the case, both defendants have written extensively about IT matters. Gold, who detailed the entire case at some length in The Hacker's Handbook, has presented at conferences alongside the arresting officers in the case.
The Computer Misuse Act
Based on the ELC's recommendations, a private member's bill was introduced by Conservative MPMichael Colvin. The bill, supported by the government, came into effect in 1990. Sections 1-3 of the Act introduced three criminal offences:
unauthorised access to computer material, punishable by twelve months' imprisonment and/or a fine "not exceeding level 5 on the standard scale" ;
unauthorised access with intent to commit or facilitate commission of further offences, punishable by twelve months/maximum fine on summary conviction and/or five years/fine on indictment;
unauthorised modification of computer material, punishable by twelve months/maximum fine on summary conviction and/or ten years/fine on indictment;
The sections 2 and 3 offences are intended to deter the more serious criminals from using a computer to assist in the commission of a criminal offence or from impairing or hindering access to data stored in a computer. The basic section 1 offence is to attempt or achieve access to a computer or the data it stores, by inducing a computer to perform any function with intent to secure access. Hackers who program their computers to search through password permutations are therefore liable, even if their attempts to log on are rejected by the target computer. The only precondition to liability is that the hacker should be aware that the access attempted is unauthorised. Thus, using another person's username or identifier and password without proper authority to access data or a program, or to alter, delete, copy or move a program or data, or simply to output a program or data to a screen or printer, or to impersonate that other person using e-mail, online chat, web or other services, constitute the offence. Even if the initial access is authorised, subsequent exploration, if there is a hierarchy of privileges in the system, may lead to entry to parts of the system for which the requisite privileges are lacking and the offence will be committed. Looking over a user's shoulder or using sophisticated electronic equipment to monitor the electromagnetic radiation emitted by VDUs is outside the scope of this offence. The §§2–3 offences are aggravated offences, requiring a specific intent to commit another offence. So a hacker who obtains access to a system intending to transfer money or shares, intends to commit theft, or to obtain confidential information for blackmail or extortion. Thus, the §1 offence is committed as soon as the unauthorised access is attempted, and the §2 offence overtakes liability as soon as specific access is made for the criminal purpose. The §3 offence is specifically aimed at those who write and circulate a computer virus or worm, whether on a LAN or across networks. Similarly, using phishing techniques or a Trojan horse to obtain identity data or to acquire any other data from an unauthorised source, or modifying the operating system files or some aspect of the computer's functions to interfere with its operation or prevent access to any data, including the destruction of files, or deliberately generating code to cause a complete system malfunction, are all criminal "modifications". In 2004, John Thornleypleaded guilty to four offences under §3, having mounted an attack on a rival site, and introduced a Trojan horse to bring it down on several occasions, but it was recognised that the wording of the offence needed to be clarified to confirm that all forms of denial of service attack are included.
Implications for industry practices
Although the Act ostensibly targets those who wish to gain unauthorised access to computer systems for various purposes, its implications on previously relatively widespread or well-known industry practices such as the "time-locking" of software have been described in various computing industry publications. Time-locking is the practice of disabling functionality or whole programs in order to ensure that software, potentially delivered on condition of further payment, will "expire" and thus no longer function.
Latest situation
Schedule 1 Part II of the Criminal Justice Act 1998 amended Section 8, Section 9 and Section 16. In 2004, the All-Party Internet Group published its review of the law and highlighted areas for development. Their recommendations led to the drafting of the Computer Misuse Act 1990 Bill which sought to amend the CMA to comply with the European Convention on Cyber Crime. Under its terms, the maximum sentence of imprisonment for breaching the Act changed from six months to two years. It also sought to explicitly criminalise denial-of-service attacks and other crimes facilitated by denial-of-service. The Bill did not receive Royal Assent because Parliament was prorogued. Sections 35 to 38 of the Police and Justice Act 2006 contain amendments to the Computer Misuse Act 1990. Section 37 inserts a new section 3A into the 1990 Act and has drawn considerable criticism from IT professionals, as many of their tools can be used by criminals in addition to their legitimate purposes, and thus fall under section 3A. After the News International phone hacking scandal in 2011, there were discussions about amending the law to define "smart" phones as computers under the Act. Such an amendment might also introduce a new offence of making information available with intent, i.e. publicly disclosing a password for someone's phone or computer so that others can access it illegally. In 2015, the Act was further amended by Part 2 sections 41 to 44 of the Serious Crime Act 2015.
The amendments
The amendments to the Computer Misuse Act 1990 by Part 5 of the Police and Justice Act 2006 are
Section 35. Unauthorised access to computer material, punishable by up to two years in prison or a fine or both.
Section 36. Unauthorised acts with intent to impair operation of computer, etc. punishable by up to ten years in prison or a fine or both.
Section 37. Making, supplying or obtaining articles for use in computer misuse offences, punishable by up to two years in prison or a fine or both.
Section 38. Transitional and saving provision.
The amendments to the Computer Misuse Act 1990 by Part 2 of the Serious Crime Act 2015. are
Section 41. Unauthorised acts causing, or creating risk of, serious damage – punishable by up to 14 years in prison or a fine or both, possible life imprisonment where human welfare or national security were endangered.
Section 42. Obtaining articles for purposes relating to computer misuse – amendments to
Section 3A.
Section 43. Territorial scope of computer misuse - amendments to
Sections 4, 5 and 10 making the primary territorial scope the United Kingdom but can be worldwide especially if the perpetrator is British and broke local law.
Section 44. Savings – covers seizure and enactment amendments to
Sections 10 and 16.
Section 47. Serious Crime Prevention Orders: meaning of "Serious Offence" - adds Computer Misuse to list of serious crimes in the
Serious Crime Act 2007 including being grounds for compulsory winding up of a company.
Section 86. Transition and savings provisions – requires Sections 42 and 43 to be brought into force before they can be used.
Schedule 1. Amendments to
Serious Crimes Act 2007: Scotland – similar changes to Scottish law.
Schedule 4. Minor and consequential amendments – changes
In April 2020, Matt Hancock issued directions giving GCHQ temporary powers over NHS information systems until the end of 2020 for the purposes of the Act to support and maintain the security of any network and information system which supports, directly or indirectly, the provision of NHS services or public health services intended to address coronavirus and coronavirus disease.
