Section 36: Unauthorised acts with intent to impair operation of computer, etc
298.The existing section 3 of the Computer Misuse Act 1990 makes unauthorised modification of computer material an offence, for which the penalty for conviction is imprisonment for a maximum of five years or a fine or both. Section 36 of the Act substitutes a new section 3.
299.The effect of the new section 3(1) to (4) is that a person commits an offence if he does any unauthorised act in relation to a computer, knowing it to be unauthorised, and if he intends by doing the act to do one of the things set out in subsection (2), or if he is reckless as to whether by doing the act he will do one of the things set out in subsection (2). Subsection (2) refers to impairing the operation of any computer, preventing or hindering access to programs or data, impairing the operation of programs or the reliability of data and to enabling any of these things to be done.
300.New section 3(6) increases the maximum penalty for an offence under section 3 to an unlimited fine and/or ten years imprisonment. (The maximum period of imprisonment that may be imposed for an offence under the existing section 3 is five years.)
301.This amendment is designed to ensure that adequate provision is made to criminalise all forms of denial of service attacks in which the attacker denies the victim(s) access to a particular resource, typically by preventing legitimate users of a service accessing that service, for example by overloading an Internet Service Provider of a website with actions, such as emails. Article 5 of the Council of Europe Cybercrime Convention 2001 (http://conventions.coe.int/Treaty/EN/Treaties/Html/185.htm) and Article 3 of the EU Framework Decision on Attacks Against Information Systems detail an offence of illegal system interference. This requires the criminalisation of the intentional serious hindering of a computer system by the inputting, transmitting, damaging, deleting, deteriorating, altering, suppressing, or rendering inaccessible of computer data. Such serious hindering is intended to cover programmes that generate denial of service attacks, or malicious code such as viruses.
