Computer Misuse Act 1990

This article or section has multiple issues. Please help improve the article or discuss these issues on the talk page.

Computer Misuse Act 1990
United Kingdom Parliament
Long title:	An Act to make provision for securing computer material against unauthorised access or modification; and for connected purposes.
Statute book chapter:	1990 (c. 18)
Introduced by:	Michael Colvin
Territorial extent:	England and Wales; Scotland; Northern Ireland
Dates
Date of Royal Assent:	29 June 1990
Commencement:	29 August 1990
Other legislation
Amendments:	Criminal Justice and Public Order Act 1994, Criminal Justice (Terrorism and Conspiracy) Act 1998
Status: Substantially amended
Text of statute as originally enacted
Official text of the statute as amended and in force today within the United Kingdom, from the UK Statute Law Database

The Computer Misuse Act 1990 is an Act of the UK Parliament. The Act's introduction followed the decision in R v Gold (1988) 1 AC 1063, with the bill's critics charging that it was introduced hastily and was poorly thought out. Intention, they said, was often difficult to prove, and that the bill inadequately differentiated "joyriding" crackers like Gold and Schifreen from serious computer criminals. The Act has nonetheless become a model upon which several other countries including Canada and the Republic of Ireland, have drawn inspiration when subsequently drafting their own information security laws. More generally, see computer crimes and internet fraud.

R v Gold & Schifreen

In R v Gold & Schifreen, Robert Schifreen and Stephen Gold, using a conventional home computer and modem in late 1984 and early 1985, gained unauthorised access to British Telecom's Prestel interactive viewdata service. While at a tradeshow, Gold had observed (doing what latterly became known as shoulder surfing) the password of a Prestel engineer (the username was 22222222 and the password was 1234, giving rise to subsequent accusations that BT had not taken security seriously). Armed with this information, the pair explored the system, even gaining access to the personal message box of Prince Philip. Prestel installed traps which monitored suspect accounts. Acting on information thus obtained, the defendants were arrested and charged under section 1 of the Forgery and Counterfeiting Act 1981, with defrauding BT by manufacturing a "false instrument", namely the internal condition of BT's equipment after it had processed Gold's eavesdropped password. Tried in the Southwark Crown Court, they were convicted on specimen charges (five against Schifreen, four against Gold) and fined.

Although the fines imposed were modest, they elected to appeal to the Criminal Division of the Court of Appeal. Their counsel cited the lack of evidence showing the two had attempted to obtain material gain from their exploits, and claimed the Counterfeiting Act had been misapplied to their conduct. They were acquitted by the Lord Justice Lane and the prosecution appealed to the House of Lords in 1988 which affirmed the acquittal. Lord David Brennan said:

"We have accordingly come to the conclusion that the language of the Act was not intended to apply to the situation which was shown to exist in this case. The submissions at the close of the prosecution case should have succeeded. It is a conclusion which we reach without regret. The Procrustean attempt^[1] to force these facts into the language of an Act not designed to fit them produced grave difficulties for both judge and jury which we would not wish to see repeated. The appellants' conduct amounted in essence, as already stated, to dishonestly gaining access to the relevant Prestel data bank by a trick. That is not a criminal offence. If it is thought desirable to make it so, that is a matter for the legislature rather than the courts"

The Law Lords' ruling led many legal scholars to believe that hacking was not unlawful as the law then stood. The English Law Commission (ELC) and its counterpart in Scotland both considered the matter. The Scottish Law Commission concluded that intrusion was adequately covered in Scotland under the common law related to deception, but the ELC believed a new law was necessary.

The Computer Misuse Act

Based on the ELC's recommendations, a Private Member's Bill was introduced by Conservative MP Michael Colvin. The bill, supported by the government, came into effect in 1990. The Act introduces three criminal offences:

1(1) A person is guilty of an offence if:

a) he causes a computer to perform any function with intent to secure access to any program or data held in a computer;

b) the access he intends to secure is unauthorized; and

c) he knows at the time when he causes the computer to perform the function that this is the case.

1(2) the intent a person has to commit an offence under this section need not be directed at

a) any particular program or data

b) a program or data of any particular kind; or

c) a program or data held in any particular computer.

1(3) a person guilty of an offence under this section shall be liable on summary conviction to imprisonment for a term not exceeding six months or to a fine not exceeding level 5, on the standard scale or both.

2(1) a person is guilty of an offence under this section if he commits an offence under section 1 above ("the unauthorized access offence") With intent

a) to commit an offence to which this section applies; or

b) to facilitate the commission of such an offence (whether by himself or by any other person) and the offence he intends to commit or facilitate is referred to below in this section as the further offence.

2(2) this section applies to offences

a) for which the sentence is fixed by law; or

b) for which a person of twenty one years of age or over (not previously convicted) may be sentenced to imprisonment for a term of five years (or in England and Wales might be so sentenced but for the restrictions imposed by section 33 of the Magistrates Courts Act 1980).

2(5) a person guilty of an offence under this section shall be liable

a) on summary conviction, to imprisonment for a term not exceeding six months or to a fine not exceeding the statutory maximum or both; and

b) on conviction on indictment, to imprisonment for a term not exceeding five years, or to a fine, or both.

3(1) A person is guilty of an offence if

a) he does any act in a way which causes the unauthorized modification of the contents of any computer; and

b) at the time when he does so the act he has the requisite intent and the requisite knowledge.

3(2) for the purposes of subsection 3(1)b above the requisite intent is an intent to cause a modification of the contents of any computer and by so doing

a) to impair the operation of any computer;

b) to prevent or hinder access to any program or data held in any computer; or

c) to impair the operation of any such program or the reliability of any such data.

3(3) the intent need not be directed at

a) any particular computer;

b) any particular program or data or a program or data of any particular kind; or

c) any particular modification or a modification of any particular kind.

3(4) For the purpose of subsection 1b above, the requisite knowledge is knowledge that any modification he intends to cause is unauthorized. 3(5) it is immaterial for the purposes of this section whether an unauthorized modification or any intended effect of it of a kind mentioned in subsection (2) above is, or is intended to be, permanent or merely temporary.

The Act was created to criminalize unauthorized access to computer systems (the s1 offence) and to deter the more serious criminals from using a computer to assist in the commission of a criminal offence or from impairing or hindering access to data stored in a computer (the ss2 and 3 offences). The basic offence is to attempt or achieve access to a computer or the data it stores, by inducing a computer to perform any function with intent to secure access. Hackers that program their computers to search through password permutations are therefore liable, even though all their attempts to log on are rejected by the target computer. The only precondition to liability is that the hacker should be aware that the access attempted is unauthorized. Thus, using another person's username or identifier (ID) and password without proper authority to access data or a program, or to alter, delete, copy or move a program or data, or simply to output a program or data to a screen or printer, or to impersonate that other person using e-mail, online chat, web or other services, constitute the offence. Even if the initial access is authorized, subsequent exploration if there is a hierarchy of privileges in the system, may lead to entry to parts of the system for which the requisite privileges are lacking and the offence will be committed. But looking over a user's shoulder or using sophisticated electronic equipment to monitor the electromagnetic radiation emitted by VDUs ("electronic eavesdropping") is outside the scope of this offence.

The ss2 and 3 offences are aggravated offences, requiring a specific intent to commit another offence (for these purposes, the other offences are to be arrestable, and so include all the major common law and statutory offences of fraud and dishonesty). So a hacker who obtains access to a system intending to transfer money or shares, intends to commit theft, or to obtain confidential information for blackmail or extortion. Thus, the s1 offence is committed as soon as the unauthorized access is attempted, and the s2 offence overtakes liability as soon as specific access is made for the criminal purpose. The s3 offence is specifically aimed at those who write and circulate a computer virus (see Simon Vallor) or worm, whether on a LAN or across networks. Similarly, using phishing techniques or a Trojan to obtain identity data or to acquire any other data from an unauthorized source, or modifying the operating system files or some aspect of the computer's functions to interfere with its operation or prevent access to any data, including the destruction of files, or deliberately generating code to cause a complete system malfunction, are all criminal "modifications". In 2004 John Thornley pleaded guilty to four offences under s3 having mounted a hack attack on a rival site, and introduced a Trojan form of virus to bring it down on several occasions, but it is recognized that the wording of the offence should be clarified to confirm that all forms of denial of service attack are included.^[2]

Latest situation

In 2004 the All Party Internet Group published its review of the law and highlighted areas for development. Their recommendations led to the drafting of the Computer Misuse Act 1990 (Amendment) Bill. which sought to amend the CMA to comply with the European Convention on Cyber Crime [1]. Under its terms, the maximum sentence of imprisonment for breaching the act changed from six months to two years. It also sought to explicitly criminalise denial-of-service attacks and other crimes facilitated by denial-of-service. The Bill did not receive Royal Assent because Parliament was prorogued.

Sections 35 to 38 of the Police and Justice Act 2006 contains amendments to the Computer Misuse Act 1990.

Section 37 (entitled Making, supplying or obtaining articles for use in computer misuse offences) inserts a new section 3A into the 1990 Act and has drawn considerable criticism.

Robert Schifreen now works as a Web developer and trainer at a UK university. In 2006 his book, Defeating The Hacker, was published by John Wiley & Sons (ISBN 0470025557). Gold works as an independent computer security consultant.

References

• Yaman Akdeniz, Section 3 of the Computer Misuse Act 1990: an Antidote for Computer Viruses! (1996) 3 Web JCLI [2] including reference to the case of Christopher Pile (aka 'the Black Baron') in November 1995.
• Derek Wyatt, Computer Misuse Act (amendment) speech. [3]
• The Law Lords' ruling
• Data Protection Act

Notes

1. ^ Here Lord Brandon alludes to the classical myth of Procrustes, who would stretch his victims to fit a bed for which they were ill suited.
2. ^ Computer misuse act

External links

• The Internet Crime Forum [4]
• EURIM – IPPR E-Crime Study [5]
• Text of the Act
• Wording of the 2004 amendment bill
• Recent potential additions to the Computer Misuse Act
• Amendments to the Computer Misuse Act 1990 covered by the .Open Rights Group