Summary and Background
126.Sections 1 to 3A of the Computer Misuse Act 1990 (“the 1990 Act”) provide for a number of criminal offences to tackle cyber crime, as follows:
Section 1 - unauthorised access to computer material or data (commonly known as “hacking”);
Section 2 - unauthorised access with intent to commit or facilitate commission of further offences;
Section 3 - unauthorised acts with intent to impair the operation of a computer (this offence includes circulating viruses, deleting files and inserting a “Trojan Horse” to steal data as well as effectively criminalising all forms of denial of service attacks in which the attacker denies the victim(s) access to a particular resource, typically by preventing legitimate users of a service accessing that service, for example by overloading an Internet Service Provider of a website with actions, such as emails);
Section 3A - making, adapting, supplying or offering to supply an article (“hacker tools”) intending it to be used to commit, or to assist in the commission of, an offence under sections 1 or 3; supplying or offering to supply an article believing that it is likely to be used in this way; and obtaining an article with a view to its being supplied for use in this way.
Other provisions of the 1990 Act make limited provision for extra-territorial jurisdiction and a saving for certain law enforcement powers so that relevant conduct by law enforcement agencies does not fall within the section 1 offence.
127.The Government’s UK Cyber Security Strategy(7) included a commitment to “review existing legislation, for example the 1990 Act, to ensure that it remains relevant and effective”. Following that review, this Part introduces a new offence in respect of unauthorised acts in relation to computers causing serious damage.
128.On 12 August 2013, the European Parliament and European Council adopted Directive 2013/40/EU on attacks against information systems(8) (“the Directive”) and replacing Council Framework Decision 2005/222/JHA. The Act makes two amendments to the 1990 Act to ensure that the UK law is fully compliant with the Directive. The Government announced that it intended to opt in to the Directive in an oral statement on 3 February 2011 (Official Report, House of Commons, columns 1051 to 1058).
