Computer Misuse Act 1990

Definition

The Computer Misuse Act 1990 is UK legislation that criminalises unauthorised access to computer systems and data, as well as actions that impair the operation of computers.

The Three Main Offences

Key Point

CMA section	Offence	Example	Maximum penalty
Section 1	Unauthorised access	Using someone else's login credentials	Up to 2 years
Section 2	Unauthorised access with intent to commit further offences	Hacking a bank to steal money	Up to 5 years
Section 3	Unauthorised modification of computer material	Deploying ransomware / deleting files / malware	Up to 10 years

Worked Example

Worked Example: Applying the Computer Misuse Act

Scenario: Alex finds that their colleague's password is written on a sticky note. Alex logs in to view their colleague's emails.

Analysis:
• Alex accessed a computer system (email)
• Alex did not have authorisation
• Even though Alex didn't damage anything, this is still illegal

Offence: Section 1 - Unauthorised Access
Potential Penalty: Up to 2 years imprisonment

Exam Tip

Remember the escalation:
• Section 1: Just accessing (no intent) = 2 years
• Section 2: Accessing with criminal intent = 5 years
• Section 3: Actually modifying/damaging = 10 years

Card 1 of 520%

Question

Computer Misuse Act (1990)

Click or drag to flip

Answer

UK law that criminalises hacking. Its three offences are unauthorised access to a computer system, unauthorised access with intent to commit further offences, and unauthorised modification of computer material.

Click or drag to flip back

Browse all 5 flashcards on Computer Misuse Act 1990

Computer Misuse Act (1990)
UK law that criminalises hacking. Its three offences are unauthorised access to a computer system, unauthorised access with intent to commit further offences, and unauthorised modification of computer material.
Unauthorised Access
The basic offence under the Computer Misuse Act: knowingly gaining entry to a computer system or its data without permission, for example by using someone else's password, even if nothing is changed or stolen.
Cybercrimes
Illegal acts carried out using computers or networks, such as hacking, spreading malware, denial-of-service attacks and online fraud. The Computer Misuse Act is the main UK law aimed at them.
Electronic Vandalism
The Computer Misuse Act offence of unauthorised modification of computer material: deliberately changing, deleting or corrupting programs or data without permission, for example by releasing a virus or altering files.
Information Theft
Entering a system without permission to obtain confidential data such as login or bank details. When the data is wanted for a further crime such as fraud, this is the Computer Misuse Act offence of access with intent to commit further offences.

Exam questions on Computer Misuse Act 1990

1 OCR past paper question (9 marks) with mark schemes

Question 1H446/01 · June 20219 marks
'The Computer Misuse Act means that computer users are criminalised for simply trying to learn how systems work.' Discuss whether or not you agree with this statement.
Your answer (optional, saved in this browser)
Show mark scheme
Levels of response (9 marks) Key points: CMA makes unauthorized access illegal regardless of intent. Three offences: unauthorized access, unauthorized access with intent, unauthorized modification. Security researchers may be affected. However, the Act protects systems from malicious actors. Ethical hackers need permission. Bug bounty programs provide legal alternatives.
Mark yourself: how many marks did you get?
/ 9

The Three Main Offences

Exam questions on Computer Misuse Act 1990

Past paper questions