text:
Computer Misuse Act 1990
From Wikipedia, the free encyclopedia
Jump to navigation Jump to search
This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. (January 2009) (Learn how and when to remove this template message)
Computer Misuse Act 1990
United Kingdom Parliament
Long title
An Act to make provision for securing computer material against unauthorised access or modification; and for connected purposes.
Citation
1990 (c. 18)
Introduced by
Michael Colvin
Territorial extent
England and Wales; Scotland; Northern Ireland
Dates
Royal assent
29 June 1990
Commencement
29 August 1990
Other legislation
Amended by
Criminal Justice and Public Order Act 1994,
Criminal Justice (Terrorism and Conspiracy) Act 1998,
Police and Justice Act 2006
and Serious Crime Act 2015
Status: Amended
Text of statute as originally enacted
Revised text of statute as amended
The Computer Misuse Act 1990 is an Act of the Parliament of the United Kingdom, introduced partly in response to the decision in R v Gold & Schifreen (1988) 1 AC 1063 (see below). Critics of the bill complained that it was introduced hastily and was poorly thought out.[who?] Intention, they said, was often difficult to prove, and that the bill inadequately differentiated "joyriding" hackers like Gold and Schifreen from serious computer criminals. The Act has nonetheless become a model from which several other countries, including Canada and the Republic of Ireland, have drawn inspiration when subsequently drafting their own information security laws, as it is seen "as a robust and flexible piece of legislation in terms of dealing with cybercrime”.[1] Several amendments have been passed to keep the Act up to date.
Contents
[hide]
1 R v Gold & Schifreen
2 The Computer Misuse Act
3 Implications for industry practices
4 Latest situation
4.1 The amendments
5 See also
6 References
7 Notes
8 External links
R v Gold & Schifreen[edit]
Robert Schifreen and Stephen Gold, using conventional home computers and modems in late 1984 and early 1985, gained unauthorised access to British Telecom's Prestel interactive viewdata service. While at a trade show, Schifreen, by doing what latterly became known as shoulder surfing, had observed the password of a Prestel engineer:[citation needed] the username was 22222222 and the password was 1234.[2][3] This later gave rise to subsequent accusations that BT had not taken security seriously. Armed with this information, the pair explored the system, even gaining access to the personal message box of Prince Philip.
Prestel installed monitors on the suspect accounts and passed information thus obtained to the police. The pair were charged under section 1 of the Forgery and Counterfeiting Act 1981 with defrauding BT by manufacturing a "false instrument", namely the internal condition of BT's equipment after it had processed Gold's eavesdropped password. Tried at Southwark Crown Court, they were convicted on specimen charges (five against Schifreen, four against Gold) and fined, respectively, £750 and £600.
Although the fines imposed were modest, they elected to appeal to the Criminal Division of the Court of Appeal. Their counsel cited the lack of evidence showing the two had attempted to obtain material gain from their exploits, and claimed the Forgery and Counterfeiting Act had been misapplied to their conduct. They were acquitted by the Lord Justice Lane, but the prosecution appealed to the House of Lords. In 1988, the Lords upheld the acquittal.[4] Lord Justice Brandon said:
We have accordingly come to the conclusion that the language of the Act was not intended to apply to the situation which was shown to exist in this case. The submissions at the close of the prosecution case should have succeeded. It is a conclusion which we reach without regret. The Procrustean attempt[5] to force these facts into the language of an Act not designed to fit them produced grave difficulties for both judge and jury which we would not wish to see repeated. The appellants' conduct amounted in essence, as already stated, to dishonestly gaining access to the relevant Prestel data bank by a trick. That is not a criminal offence. If it is thought desirable to make it so, that is a matter for the legislature rather than the courts.
The Law Lords' ruling led many legal scholars to believe that hacking was not unlawful as the law then stood. The English Law Commission (ELC) and its counterpart in Scotland both considered the matter. The Scottish Law Commission (SLC) concluded that intrusion was adequately covered in Scotland under the common law related to deception, but the ELC believed a new law was necessary.
Since the case, both defendants have written extensively about IT matters. Gold, who detailed the entire case at some length in the Hacker's Handbook, has presented at conferences alongside the arresting officers in the case.[6]
The Computer Misuse Act[edit]
Based on the ELC's recommendations, a private member's bill was introduced by Conservative MP Michael Colvin. The bill, supported by the government, came into effect in 1990. Sections 1-3 of the Act introduced three criminal offences:[7]
unauthorised access to computer material, punishable by 12 months' imprisonment (or 6 months in Scotland) and/or a fine "not exceeding level 5 on the standard scale" (since 2015, unlimited);[8]
unauthorised access with intent to commit or facilitate commission of further offences, punishable by 12 months/maximum fine (or 6 months in Scotland) on summary conviction and/or 5 years/fine on indictment;[9]
unauthorised modification of computer material, punishable by 12 months/maximum fine (or 6 months in Scotland) on summary conviction and/or 10 years/fine on indictment;[10]
(For other offences see The amendments below)
§§2–3 They intended to deter the more serious criminals from using a computer to assist in the commission of a criminal offence or from impairing or hindering access to data stored in a computer. The basic offence is to attempt or achieve access to a computer or the data it stores, by inducing a computer to perform any function with intent to secure access. hackers that program their computers to search through password permutations are therefore liable, even if their attempts to log on are rejected by the target computer. The only precondition to liability is that the hacker should be aware that the access attempted is unauthorised. Thus, using another person's username or identifier (ID) and password without proper authority to access data or a program, or to alter, delete, copy or move a program or data, or simply to output a program or data to a screen or printer, or to impersonate that other person using e-mail, online chat, web or other services, constitute the offence. Even if the initial access is authorised, subsequent exploration, if there is a hierarchy of privileges in the system, may lead to entry to parts of the system for which the requisite privileges are lacking and the offence will be committed. Looking over a user's shoulder or using sophisticated electronic equipment to monitor the electromagnetic radiation emitted by VDUs ("electronic eavesdropping") is outside the scope of this offence.
The §§2–3 offences are aggravated offences, requiring a specific intent to commit another offence (for these purposes, the other offences are to be arrestable, and so include all the major common law and statutory offences of fraud and dishonesty). So a hacker who obtains access to a system intending to transfer money or shares, intends to commit theft, or to obtain confidential information for blackmail or extortion. Thus, the §1 offence is committed as soon as the unauthorised access is attempted, and the §2 offence overtakes liability as soon as specific access is made for the criminal purpose. The §3 offence is specifically aimed at those who write and circulate a computer virus or worm, whether on a LAN or across networks. Similarly, using phishing techniques or a Trojan horse to obtain identity data or to acquire any other data from an unauthorised source, or modifying the operating system files or some aspect of the computer's functions to interfere with its operation or prevent access to any data, including the destruction of files, or deliberately generating code to cause a complete system malfunction, are all criminal "modifications". In 2004, John Thornley pleaded guilty to four offences under §3, having mounted an attack on a rival site, and introduced a Trojan horse to bring it down on several occasions, but it was recognised that the wording of the offence needed to be clarified to confirm that all forms of denial of service attack are included.[citation needed]
Implications for industry practices[edit]
Although the Act ostensibly targets those who wish to gain unauthorised access to computer systems for various purposes, its implications on previously relatively widespread or well-known industry practices such as the "time-locking" of software have been described in various computing industry publications.[11] Time-locking is the practice of disabling functionality or whole programs in order to ensure that software, potentially delivered on condition of further payment, will "expire" and thus no longer function.
Latest situation[edit]
The Schedule 1 Part II 'Conspiracy' of the Criminal Justice (Terrorism and Conspiracy) Act 1998 amended Section 8 (relevance of external law), Section 9(2)(b) (British citizenship immaterial: conspiracy) and Section 16 (application to Northern Ireland). For text see reference.[12]
In 2004, the All-Party Internet Group published its review of the law and highlighted areas for development. Their recommendations led to the drafting of the Computer Misuse Act 1990 (Amendment) Bill which sought to amend the CMA to comply with the European Convention on Cyber Crime.[13] Under its terms, the maximum sentence of imprisonment for breaching the Act changed from six months to two years. It also sought to explicitly criminalise denial-of-service attacks and other crimes facilitated by denial-of-service. The Bill did not receive Royal Assent because Parliament was prorogued.
Sections 35 to 38 of the Police and Justice Act 2006 contain amendments to the Computer Misuse Act 1990.
Section 37 (Making, supplying or obtaining articles for use in computer misuse offences) inserts a new section 3A into the 1990 Act and has drawn considerable criticism from IT professionals, as many of their tools can be used by criminals in addition to their legitimate purposes, and thus fall under section 3A.
After the News International phone hacking scandal in 2011, there are ongoing discussions about amending the law to define "smart" phones (i.e. those with Internet browsers and other connectivity features) as computers under the Act. This amendment may also introduce a new offence of making information available with intent, i.e. publicly disclosing a password for someone's phone or computer so that others can access it illegally.[14]
In 2015, the Act was further amended by Part 2 sections 41 to 44 (plus others) of the Serious Crime Act 2015[15]
The amendments[edit]
The amendments to the Computer Misuse Act 1990 by Part 5 of the Police and Justice Act 2006[16] are
Section 35. Unauthorised access to computer material, punishable by up to two years in prison or a fine or both.[17]
Section 36. Unauthorised acts with intent to impair operation of computer, etc. punishable by up to ten years in prison or a fine or both.[18]
Section 37. Making, supplying or obtaining articles for use in computer misuse offences, punishable by up to two years in prison or a fine or both.[19]
Section 38. Transitional and saving provision.[20]
The amendments to the Computer Misuse Act 1990 by Part 2 of the Serious Crime Act 2015[15] are
Section 41. (New Section 3ZA of the Computer Misuse Act 1990). Unauthorised acts causing, or creating risk of, serious damage - punishable by up to 14 years in prison or a fine or both, possible life imprisonment where human welfare or national security were endangered.[21]
Section 42. Obtaining articles for purposes relating to computer misuse - amendments to Section 3A.[22]
Section 43. Territorial scope of computer misuse - amendments to Sections 4, 5 and 10 making the primary territorial scope the United Kingdom but can be worldwide especially if perpetrator (or conspirators) is British and broke local law.[23]
Section 44. Savings - covers seizure and enactment amendments to Sections 10 and 16.[24]
Section 47. Serious Crime Prevention Orders: meaning of "Serious Offence" - adds Computer Misuse to list of serious crimes in the Serious Crime Act 2007 including being grounds for compulsory winding up of a company.[25]
Section 86. Transition and savings provisions - requires Sections 42 and 43 to be brought into force before they can be used.[26]
Schedule 1. Amendments to Serious Crimes Act 2007: Scotland - similar changes to Scottish law.[27]
Schedule 4. Minor and consequential amendments - changes Computer Misuse Act 1990 and the Armed Forces Act 2006.[28]
See also[edit]
Computer crime
Internet fraud
Data Protection Act 1998
References[edit]
Neil MacEwan, "The Computer Misuse Act 1990: lessons from its past and predictions for its future" (2008), Criminal Law Review 955.
Stefan Fafinski, Computer Misuse: Response, Regulation and the Law (Cullomption, Willan 2009)
Yaman Akdeniz, Section 3 of the Computer Misuse Act 1990: an Antidote for Computer Viruses! (1996) 3 Web JCLI [2] including reference to the case of Christopher Pile (aka 'the Black Baron') in November 1995.
Derek Wyatt, Computer Misuse Act (amendment) speech
The Law Lords' ruling
Notes[edit]
Jump up ^ IISS Global Perspectives – Power in Cyberspace. Q&A with Nigel Inkster, Director, Transnational Threats and Political Risk, IISS. 18 January 2011.
Jump up ^ Lee, Mark (Autumn 2014). "Lecture 2: Legal Perspectives" (PDF). School of Computer Science. Professional Computing. University of Birmingham. p. 13. Retrieved 19 May 2017.
Jump up ^ Murray, Andrew (2016). Information Technology Law: The Law and Society (3rd ed.). Oxford University Press. p. 358. ISBN 978-0-19-873246-4. Retrieved 19 May 2017.
Jump up ^ HL 21 April 1988, [1988] AC 1063 summary at [1]
Jump up ^ Here Lord Brandon alludes to the classical myth of Procrustes, who would stretch his victims (or cut off their legs) in order to fit a bed for which they were ill suited.
Jump up ^ John Leyden (13 January 2015). "'80s hacker turned journo, IT crime ace Steve Gold logs off". The Register. Retrieved 14 January 2015.
Jump up ^ Computer Misuse Act 1990, s1 - s3
Jump up ^ http://www.legislation.gov.uk/ukpga/1990/18/section/1
Jump up ^ http://www.legislation.gov.uk/ukpga/1990/18/section/2
Jump up ^ http://www.legislation.gov.uk/ukpga/1990/18/section/3
Jump up ^ Naylor, Chris (July 1994). "Locked up". Personal Computer World.
Jump up ^ "Criminal Justice (Terrorism and Conspiracy) Act 1998 Schedule 1". legislation.gov.uk. The National Archives. Retrieved 24 March 2015.
Jump up ^ http://conventions.coe.int/Treaty/en/Treaties/Html/185.htm
Jump up ^ https://publications.parliament.uk/pa/cm201011/cmselect/cmstnprv/628/62805.htm
^ Jump up to: a b "Serious Crime Act of 2015" (PDF). UK Government. Retrieved 30 December 2015.
Jump up ^ Police and Justice Act 2006
Jump up ^ Police and Justice Act 2006, section 35
Jump up ^ Police and Justice Act 2006, section 36
Jump up ^ Police and Justice Act 2006, section 37
Jump up ^ Police and Justice Act 2006, section 38
Jump up ^ Serious Crime Act 2015, Section 41
Jump up ^ Serious Crime Act 2015, Section 42
Jump up ^ Serious Crime Act 2015, Section 43
Jump up ^ Serious Crime Act 2015, Section 44
Jump up ^ Serious Crime Act 2015, Section 47
Jump up ^ Serious Crime Act 2015, Section 86
Jump up ^ Serious Crime Act 2015, Schedule 1
Jump up ^ Serious Crime Act 2015, Schedule 4
External links[edit]
The Internet Crime Forum
EURIM – IPPR E-Crime Study
Wording of the failed 2004 amendment bill
Amendments to the Computer Misuse Act 1990 covered by the Open Rights Group
A list of Computer Misuse Act cases compiled by Michael J L Turner
show
v
t
e
United Kingdom legislation
Pre-Parliamentary legislation
List of English statutes
Charter of Liberties
Magna Carta
Acts of Parliament by states preceding
the Kingdom of Great Britain
Parliament of England
to 1483
1485–1601
1603–1641
Interregnum (1642–1660)
1660–1699
1700–1706
Parliament of Scotland
to 1707
Acts of Parliament of the
Kingdom of Great Britain
1707–1719
1720–1739
1740–1759
1760–1779
1780–1800
Acts of the Parliament of Ireland
to 1700
1701–1800
Acts of Parliament of the United Kingdom of
Great Britain and Ireland and the United
Kingdom of Great Britain and Northern Ireland
1801–1819
1820–1839
1840–1859
1860–1879
1880–1899
1900–1919
1920–1939
1940–1959
1960–1979
1980–1999
2000 to date
Halsbury's Statutes
Legislation.gov.uk
Short titles
relating to the European Union
1972 to date
Church of England measures
List
Church of England Assembly (Powers) Act 1919
Legislation of devolved institutions
Acts of the Scottish Parliament
List
Acts and Measures of the National Assembly for Wales
List
Acts of the Northern Ireland Assembly
Acts of the Parliament of Northern Ireland
Orders in Council
1994 to date
for Northern Ireland
1972–2009
Secondary legislation
United Kingdom statutory instruments
Scottish statutory instruments
Acts of Sederunt
Acts of Adjournal
Retrieved from "https://en.wikipedia.org/w/index.php?title=Computer_Misuse_Act_1990&oldid=840835360"
Categories:
United Kingdom Acts of Parliament 1990
Computing legislation
Hacking (computer security)
Hidden categories:
Articles needing additional references from January 2009
All articles needing additional references
All articles with specifically marked weasel-worded phrases
Articles with specifically marked weasel-worded phrases from January 2013
All articles with unsourced statements
Articles with unsourced statements from January 2013
Articles with unsourced statements from January 2009
Navigation menu
Personal tools
Not logged in
Talk
Contributions
Create account
Log in
Namespaces
Article
Talk
Variants
Views
Read
Edit
View history
More
Search
Navigation
Main page
Contents
Featured content
Current events
Random article
Donate to Wikipedia
Wikipedia store
Interaction
Help
About Wikipedia
Community portal
Recent changes
Contact page
Tools
What links here
Related changes
Upload file
Special pages
Permanent link
Page information
Wikidata item
Cite this page
Print/export
Create a book
Download as PDF
Printable version
Languages
Simple English
Edit links
This page was last edited on 12 May 2018, at 13:44.
Text is available under the Creative Commons Attribution-ShareAlike License; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc., a non-profit organization.
Privacy policy
About Wikipedia
Disclaimers
Contact Wikipedia
Developers
Cookie statement
Mobile view
Enable previews

key: html

type: local

value: div

attrs: id class

values: mw-page-base noprint

values: mw-head-base noprint

value: a

attrs: id class lang

values: firstHeading firstHeading en

values: siteSub noprint

attrs: class href

values: mw-jump-link #mw-head

values: mw-jump-link #p-search

value: img

attrs: alt src width height srcset data-file-width data-file-height

attrs: href class

value: td

attrs: href title

values: Help:Introduction to referencing with Wiki Markup/1

value: span

value: i

value: small

values: plainlinks metadata ambox ambox-content ambox-Refimprove

values:
/wiki/United_Kingdom_Parliament
mw-redirect
United Kingdom Parliament

values: text-align:center;border-top: 1px solid #aaa;

values: Criminal Justice and Public Order Act 1994

values: Criminal Justice (Terrorism and Conspiracy) Act 1998 (page does not exist)

values:
/wiki/Serious_Crime_Bill_2014
mw-redirect
Serious Crime Bill 2014

values: The material near this tag possibly uses too-vague attribution or weasel words. (January 2013)

values: Wikipedia:Manual of Style/Words to watch

values:
/wiki/Hacker_(term)
mw-redirect
Hacker (term)

values:
/wiki/BT_Group_plc
mw-redirect
BT Group plc

values: This claim needs references to reliable sources. (January 2013)

values:
noprint Inline-Template Template-Fact
white-space:nowrap;

values: Judicial functions of the House of Lords

values: Henry Brandon, Baron Brandon of Oakbrook

values:
/wiki/English_Law_Commission
mw-redirect
English Law Commission

values:
/wiki/Hacker_(computer_security)
mw-redirect
Hacker (computer security)

values:
/wiki/Summary_conviction
mw-redirect
Summary conviction

values:
/wiki/Visual_display_unit
mw-redirect
Visual display unit

values:
/wiki/Denial_of_service
mw-redirect
Denial of service

values: This claim needs references to reliable sources. (January 2009)

values: Edit section: Implications for industry practices

values:
/wiki/Royal_Assent
mw-redirect
Royal Assent

values: News International phone hacking scandal

values:
/wiki/Computer_crime
mw-redirect
Computer crime

values: -moz-column-width: 30em; -webkit-column-width: 30em; column-width: 30em; list-style-type: decimal;

values:
nofollow
external text
http://www.internetcrimeforum.org.uk

values: List of Acts of the Parliament of England to 1483

values: List of Acts of the Parliament of England, 1485–1601

values: List of Acts of the Parliament of England, 1603–1641

values: List of Ordinances and Acts of the Parliament of England, 1642–1660

values: List of Acts of the Parliament of England, 1660–1699

values: List of Acts of the Parliament of England, 1700–1706

values: List of Acts of the Parliament of Scotland to 1707

values: List of Acts of the Parliament of Great Britain, 1707–1719

values: List of Acts of the Parliament of Great Britain, 1720–1739

values: List of Acts of the Parliament of Great Britain, 1740–1759

values: List of Acts of the Parliament of Great Britain, 1760–1779

values: List of Acts of the Parliament of Great Britain, 1780–1800

values: List of Acts of the Parliament of Ireland to 1700

values: List of Acts of the Parliament of Ireland, 1701–1800

values: United Kingdom of Great Britain and Ireland

values: List of Acts of the Parliament of the United Kingdom, 1801–1819

values: List of Acts of the Parliament of the United Kingdom, 1820–1839

values: List of Acts of the Parliament of the United Kingdom, 1840–1859

values: List of Acts of the Parliament of the United Kingdom, 1860–1879

values: List of Acts of the Parliament of the United Kingdom, 1880–1899

values: List of Acts of the Parliament of the United Kingdom, 1900–1919

values: List of Acts of the Parliament of the United Kingdom, 1920–1939

values: List of Acts of the Parliament of the United Kingdom, 1940–1959

values: List of Acts of the Parliament of the United Kingdom, 1960–1979

values: List of Acts of the Parliament of the United Kingdom, 1980–1999

values: List of Acts of the Parliament of the United Kingdom, 2000–present

values: List of Acts of the Parliament of the United Kingdom relating to the European Communities (1957–1993) & European Union (1993–present)

values: Church of England Assembly (Powers) Act 1919

values: List of Acts of the Scottish Parliament from 1999

values: Measure of the National Assembly for Wales

values: List of Acts and Measures of the National Assembly for Wales

values: List of Acts of the Northern Ireland Assembly

values: List of Acts of the Parliament of Northern Ireland

values: List of Orders in Council for Northern Ireland

values: Delegated legislation in the United Kingdom

values: nowraplinks collapsible collapsed navbox-inner mw-collapsible mw-collapsed mw-made-collapsible

values: Category:United Kingdom Acts of Parliament 1990

values: Category:Articles needing additional references from January 2009

values: Category:All articles needing additional references

values: Category:All articles with specifically marked weasel-worded phrases

values: Category:Articles with specifically marked weasel-worded phrases from January 2013

values: Category:All articles with unsourced statements

values: Category:Articles with unsourced statements from January 2013

values: Category:Articles with unsourced statements from January 2009

values: Discussion about edits from this IP address [ctrl-alt-n]

values: A list of edits made from this IP address [ctrl-alt-y]

values: You are encouraged to create an account and log in; however, it is not mandatory

values: You're encouraged to log in; however, it's not mandatory. [ctrl-alt-o]

values:
/wiki/Computer_Misuse_Act_1990
View the content page [ctrl-alt-c]
c

values: Discussion about the content page [ctrl-alt-t]

values: p-namespaces navigation vectorTabs p-namespaces-label

values:
p-variants
navigation
vectorMenu emptyPortlet
p-variants-label

values: Past revisions of this page [ctrl-alt-h]

values: p-views navigation vectorTabs p-views-label

values:
p-cactions
navigation
vectorMenu emptyPortlet
p-cactions-label

values:
mw-wiki-logo
/wiki/Main_Page
Visit the main page

values:
/wiki/Main_Page
Visit the main page [ctrl-alt-z]
z

values: Featured content – the best of Wikipedia

values: Find background information on current events

values:
suggestions
display: none; font-size: 13px;

values: mediawiki ltr sitedir-ltr mw-hide-empty-elt ns-0 ns-subject page-Computer_Misuse_Act_1990 rootpage-Computer_Misuse_Act_1990 skin-vector action-view