Computer Misuse Act 1990: Offences, Penalties and Jurisdiction

The Computer Misuse Act 1990 creates five criminal offences, and the offences and penalties under the Computer Misuse Act 1990 run from basic hacking (up to two years in prison) through system sabotage (up to ten years) to cyberattacks causing serious real-world harm (up to life imprisonment). Every offence also carries an unlimited fine. Which section applies turns on what you did, what you intended, and what harm followed.

Section 1: Unauthorized Access to Computer Material

Section 1 is the entry-level offence and covers what most people would call basic hacking. You commit it if you cause a computer to perform any function intending to access a program or data, knowing that access is unauthorized.¹ The prosecution does not have to show you were after a specific file. A general intent to access anything without permission is enough.

“Access” is defined broadly under Section 17. You secure access if you alter, erase, copy, move, or use the program or data, or have it output in any form. Running a program counts. Displaying data on screen counts.² Browsing files you had no right to see qualifies even if you downloaded or changed nothing.

Typical examples: using a colleague’s login without permission, bypassing a password, or reaching into parts of a system outside your role. No further harm needs to follow. Crossing the digital boundary is itself the offence.

Maximum penalties: 12 months’ imprisonment and an unlimited fine on summary conviction; two years and an unlimited fine on indictment.¹

Section 2: Unauthorized Access with Intent to Commit a Further Offence

Section 2 catches hackers who break in as a stepping stone to something worse. All the Section 1 elements apply, plus a specific intent to commit or help someone else commit a further offence carrying a fixed sentence or a maximum prison term of at least five years.³ Fraud and theft are the obvious candidates.

The further crime does not need to happen. If you access a customer database intending to steal card details, the offence is complete on entry, even if you download nothing. That lets police move before the downstream harm materialises.

Maximum penalties: 12 months and an unlimited fine on summary conviction; five years and an unlimited fine on indictment.³

Section 3: Unauthorized Acts Causing Impairment

Section 3 moves from snooping to sabotage. You commit the offence by carrying out an unauthorized act in relation to a computer, knowing it is unauthorized, either intending or being reckless as to impairing the operation of any computer, preventing or hindering access to any program or data, or impairing the reliability of any data.⁴ Viruses, ransomware, and denial-of-service attacks all fall within this section.

There is no financial damage threshold. The offence turns on impairment of function, not loss in pounds. Even temporary disruption qualifies. The Crown Prosecution Service has confirmed that denial-of-service attacks meet the standard because they make resources unavailable to legitimate users, whether or not data is permanently altered.⁵ Financial and reputational damage feed into the public interest test at the charging stage, and remediation costs are an aggravating factor at sentencing.

Maximum penalty on indictment: ten years’ imprisonment and an unlimited fine.⁴ That is a marked step up from Sections 1 and 2.

Section 3ZA: Unauthorized Acts Causing Serious Damage

Section 3ZA was inserted by the Serious Crime Act 2015 to deal with cyberattacks that cause or risk serious real-world harm.⁶ The offence requires an unauthorized act in relation to a computer that causes, or creates a significant risk of, serious damage of a “material kind.” The Act defines material damage as falling into four categories:

Human welfare: loss of life, illness or injury, or disruption of supplies of money, food, water, energy, fuel, communications, transport, or health services.
Environmental damage in any place.
Economic damage to any country.
National security of any country.

An attack that takes down a hospital network or cripples a power grid is the paradigm case.⁷

Penalties come in two tiers. For most Section 3ZA offences, the maximum on indictment is 14 years and an unlimited fine. Where the offence causes or risks serious damage to human welfare in the form of death or physical injury, or damages national security, the maximum is life imprisonment.⁷

Section 3A: Making, Supplying or Obtaining Tools for Computer Misuse

Section 3A targets the supply chain behind cybercrime. You commit an offence if you make, adapt, supply, or offer to supply any item believing it will be used to commit an offence under Section 1, 3, or 3ZA. Obtaining such an item with intent to use it for those offences is also criminal.⁸ “Articles” covers software, scripts, passwords, and any other data as well as physical devices.

The tension is obvious. A penetration testing toolkit looks identical to a hacking toolkit. The law resolves this by focusing on the intent or belief of the person making or distributing the item. A security researcher who builds a tool for authorized testing, with no belief it will be misused, does not commit the offence. In practice, that line depends heavily on context.

Maximum penalty on indictment: two years and an unlimited fine.⁸

Penalties at a Glance

“Summary” means a magistrates’ court trial; “indictment” means Crown Court. Since March 2015, the previous £5,000 cap on summary fines for either-way offences has been removed, so fines are effectively unlimited at both levels.⁹

When the Act Reaches Conduct Abroad

The Act was drafted with cross-border cybercrime in mind. Under Sections 4 and 5, the UK can prosecute offences committed from abroad provided a “significant link” exists to England and Wales (or Scotland, or Northern Ireland). A significant link includes any of the following:⁵

The accused was in the UK when the offence was committed.
The target computer was in the UK at the time.
Network activity passed through a UK-based server in connection with the offence.

For Section 3ZA, there is an additional ground: the serious damage caused or risked occurred in the UK, regardless of where the attacker or the target computer was located.⁷

No Statutory Defense for Ethical Hacking

One point catches people out: the Computer Misuse Act contains no statutory defense for security research or ethical hacking. The Act operates on a simple principle. Access must be authorized by the person responsible for the system. Without that authorization, the offence elements are met regardless of motive.¹⁰

The government has acknowledged this potentially criminalises activity much of the cybersecurity industry treats as legitimate, including vulnerability scanning and threat intelligence work. A formal consultation found the absence of a defense may inhibit growth of the UK’s cybersecurity sector, and further work is under way. No statutory defense has been introduced.¹⁰

The practical position: get explicit written authorization before testing any system. Bug bounty programs with clear scope offer some comfort because the owner has granted permission, which removes the “unauthorized” element. Testing outside the defined scope, or probing a system with no bounty program at all, remains legally risky regardless of intent. Ordinary criminal law defenses still apply. The prosecution must prove you knew your access was unauthorized, so a genuine and reasonable belief that you had permission could defeat a charge, but that is a factual argument to be made at trial rather than a guaranteed shield.

1
Legislation.gov.uk. Computer Misuse Act 1990 – Section 1 Unauthorised Access to Computer Material
2
Legislation.gov.uk. Computer Misuse Act 1990 – Section 17 Interpretation
3
Legislation.gov.uk. Computer Misuse Act 1990 – Section 2 Unauthorised Access with Intent to Commit or Facilitate Commission of Further Offences
4
Legislation.gov.uk. Computer Misuse Act 1990 – Section 3 Unauthorised Acts with Intent to Impair, or with Recklessness as to Impairing, Operation of Computer, etc.
5
The Crown Prosecution Service. Computer Misuse Act
6
Legislation.gov.uk. Serious Crime Act 2015 – Part 2 Computer Misuse
7
Legislation.gov.uk. Computer Misuse Act 1990 – Section 3ZA Unauthorised Acts Causing, or Creating Risk of, Serious Damage
8
Legislation.gov.uk. Computer Misuse Act 1990 – Section 3A Making, Supplying or Obtaining Articles for Use in Offence Under Section 1, 3, or 3ZA
9
Legislation.gov.uk. Legal Aid, Sentencing and Punishment of Offenders Act 2012 (Fines on Summary Conviction) Regulations 2015
10
GOV.UK. Review of the Computer Misuse Act 1990 – Consultation and Response to Call for Information