View source for Computer Misuse Act 1990

{{pp-pc1}}
{{Use British English|date=August 2023}}
{{Use dmy dates|date=April 2022}}
{{More citations needed|date=January 2009}}
{{Infobox UK legislation
|short_title=Computer Misuse Act 1990
|type=Act
|parliament=United Kingdom Parliament
|long_title=An Act to make provision for securing computer material against unauthorised access or modification; and for connected purposes.
|statute_book_chapter=1990 c. 18
|introduced_by=[[Michael Colvin]]
|territorial_extent={{ubli|England and Wales|Scotland|Northern Ireland}}
|royal_assent=29 June 1990
|commencement=29 August 1990 
|amendments={{ubli|[[Criminal Justice and Public Order Act 1994]]|[[Criminal Justice (Terrorism and Conspiracy) Act 1998]]|[[Police and Justice Act 2006]]|[[Serious Crime Bill 2014|Serious Crime Act 2015]]}}
|related_legislation= 
|status=Amended
|original_text=http://www.legislation.gov.uk/ukpga/1990/18/enacted
|revised_text=http://www.legislation.gov.uk/ukpga/1990/18
|}}
The '''Computer Misuse Act 1990''' (c. 18) is an act of the [[Parliament of the United Kingdom]], introduced partly in response to the decision in ''R v Gold & Schifreen'' (1988) 1 AC 1063. Critics of the bill{{who|date=January 2013}} complained that it was introduced hastily, was poorly thought out, and that [[intention (criminal law)|intention]] was often difficult to prove, with the bill inadequately differentiating "joyriding" [[Hacker (term)|hackers]] like [[Stephen Gold|Gold]] and [[Robert Schifreen|Schifreen]] from serious computer criminals. The Act has nonetheless become a model from which several other countries, including [[Canada]] and the [[Republic of Ireland]], have drawn inspiration when subsequently drafting their own [[information security]] laws, as it is seen "as a robust and flexible piece of legislation in terms of dealing with cybercrime".<ref>IISS Global Perspectives – Power in Cyberspace. Q&A with Nigel Inkster, Director, Transnational Threats and Political Risk, IISS. 18 January 2011.</ref> Several amendments have been passed to keep the Act up to date.

==''R v Gold & Schifreen''==
[[Robert Schifreen]] and [[Stephen Gold]], using conventional [[home computer]]s and [[modem]]s in late 1984 and early 1985, gained unauthorised access to [[BT Group plc|British Telecom]]'s [[Prestel]] interactive [[viewdata]] service. While at a trade show, Schifreen, by doing what latterly became known as [[Shoulder surfing (computer security)|shoulder surfing]], had observed the password of a Prestel engineer.{{citation needed|date=January 2013}} The engineer's username was 22222222 and the password used was 1234.<ref>{{cite web |url=http://www.cs.bham.ac.uk/~mgl/profcomp/lectures/lecture2.pdf |title=Lecture 2: Legal Perspectives |series=Professional Computing |first=Mark |last=Lee |department=School of Computer Science |publisher=[[University of Birmingham]] |date=Autumn 2014 |access-date=19 May 2017 |page=13}}</ref><ref name="Murray2016">{{cite book|last=Murray|first=Andrew|title=Information Technology Law: The Law and Society|url=https://books.google.com/books?id=C37ADAAAQBAJ&pg=PA358|access-date=19 May 2017|edition=3rd|year=2016|publisher=[[Oxford University Press]]|isbn=978-0-19-873246-4|page=358}}</ref> This later gave rise to accusations that British Telecom (BT) had not taken security seriously. Armed with this information, the pair explored the system, even gaining access to the personal message box of [[Prince Philip, Duke of Edinburgh|Prince Philip]].

Prestel installed monitors on the suspect accounts and passed information thus obtained to the police. The pair were charged under section 1 of the [[Forgery and Counterfeiting Act 1981]] with defrauding BT by manufacturing a "false instrument", namely the internal condition of BT's equipment after it had processed Gold's eavesdropped password. Tried at [[Southwark Crown Court]], they were convicted on [[specimen charges]] (five against Schifreen, four against Gold) and fined, respectively, £750 and £600.

Although the fines imposed were modest, they elected to appeal to the Criminal Division of the [[Court of Appeal (England and Wales)|Court of Appeal]]. Their counsel cited the lack of evidence showing the two had attempted to obtain material gain from their exploits, and claimed that the Forgery and Counterfeiting Act had been misapplied to their conduct. They were acquitted by the Lord Justice Lane, but the prosecution appealed to the [[Judicial functions of the House of Lords|House of Lords]]. In 1988, the Lords upheld the acquittal.<ref>HL 21 April 1988, [1988] AC 1063 summary at [http://swarb.co.uk/regina-v-gold-and-schifreen-hl-21-apr-1988/]</ref> [[Henry Brandon, Baron Brandon of Oakbrook|Lord Justice Brandon]] said:

{{quote|We have accordingly come to the conclusion that the language of the Act was not intended to apply to the situation which was shown to exist in this case. The submissions at the close of the prosecution case should have succeeded. It is a conclusion which we reach without regret. The Procrustean attempt<ref>Here Lord Brandon alludes to the classical myth of [[Procrustes]], who would stretch his victims (or cut off their legs) in order to fit a bed for which they were ill suited.</ref> to force these facts into the language of an Act not designed to fit them produced grave difficulties for both judge and jury which we would not wish to see repeated. The appellants' conduct amounted in essence, as already stated, to dishonestly gaining access to the relevant Prestel data bank by a trick. That is not a criminal offence. If it is thought desirable to make it so, that is a matter for the legislature rather than the courts.}}

The Law Lords' ruling led many legal scholars to believe that hacking was not unlawful as the law then stood. The English [[Law Commission (England and Wales)|Law Commission]] and its counterpart in Scotland both considered the matter. The [[Scottish Law Commission]] concluded that intrusion was adequately covered in Scotland under the [[Scots law|common law]] related to deception, but the English Law Commission believed a new law was necessary.

Since the case, both defendants have written extensively about IT matters. Gold, who detailed the entire case at some length in ''[[The Hacker's Handbook]]'', has presented at conferences alongside the arresting officers in the case.<ref name="thereg-20150113">{{cite news |url=https://www.theregister.co.uk/2015/01/13/steve_gold_obit/ |title='80s hacker turned journo, IT crime ace Steve Gold logs off | first = John | last = Leyden |newspaper=The Register |date=13 January 2015 |access-date=14 January 2015}}</ref>

{{Further|DPP v Lennon}}

==The Computer Misuse Act==
Based on the ELC's recommendations, a [[private member's bill]] was introduced by [[Conservative Party (UK)|Conservative]] MP [[Michael Colvin]]. The bill, supported by the government, came into effect in 1990. Sections 1-3 of the Act introduced three criminal offences:<ref>[http://www.opsi.gov.uk/acts/acts1990/UKpga_19900018_en_1.htm Computer Misuse Act 1990], s1 - s3</ref>{{Full citation needed|date=June 2021}}

# unauthorised access to computer material, punishable by twelve months' imprisonment (or six months in Scotland) and/or a fine "not exceeding level 5 on the [[standard scale]]" (since 2015, unlimited);<ref>{{cite web|url=http://www.legislation.gov.uk/ukpga/1990/18/section/1 |title=Computer Misuse Act 1990; 1990 c. 18 Computer misuse offences Section 1 |website=legislation.gov.uk |access-date=2 May 2019 }}</ref>
# unauthorised access with intent to commit or facilitate commission of further offences, punishable by twelve months/maximum fine (or six months in Scotland) on [[summary conviction]] and/or five years/fine on [[indictment]];<ref>{{Cite web|title=Computer Misuse Act 1990, section 2|url=http://www.legislation.gov.uk/ukpga/1990/18/section/2|url-status=live|access-date=14 June 2021|website=www.legislation.gov.uk|archive-url=https://web.archive.org/web/20100926163533/http://www.legislation.gov.uk:80/ukpga/1990/18/section/2 |archive-date=2010-09-26 }}</ref>
# unauthorised modification of computer material, punishable by twelve months/maximum fine (or six months in Scotland) on summary conviction and/or ten years/fine on indictment;<ref>{{Cite web|title=Computer Misuse Act 1990, section 3|url=http://www.legislation.gov.uk/ukpga/1990/18/section/3|url-status=live|access-date=14 June 2021|website=www.legislation.gov.uk|archive-url=https://web.archive.org/web/20100926163725/http://www.legislation.gov.uk:80/ukpga/1990/18/section/3 |archive-date=2010-09-26 }}</ref>

(For other offences see ''[[#The amendments|§ The amendments]]'' below)

The sections 2 and 3 offences are intended to deter the more serious criminals from using a computer to assist in the commission of a criminal offence or from impairing or hindering access to data stored in a computer. The basic section 1 offence is to attempt or achieve access to a computer or the data it stores, by inducing a computer to perform any function with intent to secure access. [[Hacker (computer security)|Hackers]] who program their computers to search through password permutations are therefore liable, even if their attempts to log on are rejected by the target computer. The only precondition to liability is that the hacker should be aware that the access attempted is unauthorised. Thus, using another person's [[username]] or [[identifier]] (ID) and [[password]] without proper authority to access data or a program, or to alter, delete, copy or move a program or data, or simply to output a program or data to a screen or printer, or to impersonate that other person using [[e-mail]], [[online chat]], web or other services, constitute the offence. Even if the initial access is authorised, subsequent exploration, if there is a hierarchy of privileges in the system, may lead to entry to parts of the system for which the requisite privileges are lacking and the offence will be committed. Looking over a user's shoulder or using sophisticated electronic equipment to monitor the [[electromagnetic radiation]] emitted by [[Visual display unit|VDUs]] ("electronic eavesdropping") is outside the scope of this offence.

The §§2–3 offences are aggravated offences, requiring a specific intent to commit another offence (for these purposes, the other offences are to be [[arrest]]able, and so include all the major [[common law]] and [[statutory]] offences of [[fraud]] and [[dishonesty]]). So a hacker who obtains access to a system intending to transfer money or shares, intends to commit [[theft]], or to obtain confidential information for [[blackmail]] or [[extortion]]. Thus, the §1 offence is committed as soon as the unauthorised access is attempted, and the §2 offence overtakes liability as soon as specific access is made for the criminal purpose. The §3 offence is specifically aimed at those who write and circulate a [[computer virus]] or [[computer worm|worm]], whether on a [[Local area network|LAN]] or across [[computer network|networks]]. Similarly, using [[phishing]] techniques or a [[Trojan horse (computing)|Trojan horse]] to obtain identity data or to acquire any other data from an unauthorised source, or modifying the operating system files or some aspect of the computer's functions to interfere with its operation or prevent access to any data, including the destruction of files, or deliberately generating code to cause a complete system malfunction, are all criminal "modifications". In 2004, John Thornley pleaded guilty to four offences under §3,<ref>{{Cite news |date=2004-06-22 |title=Hacker avoids jail |url=https://www.theguardian.com/technology/2004/jun/23/themilitary.uknews |access-date=2024-10-16 |work=The Guardian |language=en-GB |issn=0261-3077}}</ref><ref>{{Cite news |date=2004-05-27 |title=Armed forces net hacker guilty |url=http://news.bbc.co.uk/2/hi/uk_news/england/wiltshire/3753335.stm |access-date=2024-10-16 |language=en-GB}}</ref> having mounted an attack on a rival site, and introduced a Trojan horse to bring it down on several occasions, but it was recognized that the wording of the offence needed to be clarified to confirm that all forms of [[denial of service]] attack are included.{{Citation needed|date=January 2009}}

==Implications for industry practices==
Although the Act ostensibly targets those who wish to gain unauthorised access to computer systems for various purposes, its implications on previously relatively widespread or well-known industry practices such as the "time-locking" of software have been described in various computing industry publications. Time-locking is the practice of disabling functionality or whole programs in order to ensure that software, potentially delivered on condition of further payment, will "expire" and thus no longer function. In one featured case, a "developer of bespoke systems in the Midlands" activated a time lock on a piece of software over a dispute with a client about an unpaid bill. The client reported this to the police who charged the programmer under Section 3 of the Act, with the outcome being a conviction by a magistrates court, with a conditional discharge given by the magistrate meaning that no punishment was applied on condition that the programmer did not re-offend.<ref name="Naylor 1994">{{cite magazine | last=Naylor | first=Chris | title=Locked up | magazine=Personal Computer World | date=July 1994 | pages=470–471 }}</ref>

==Latest situation==
<!-- need a paragraph here about notable convictions under the act -->
Schedule 1 Part II of the [[Criminal Justice (Terrorism and Conspiracy) Act 1998]] ('Conspiracy') amended Section 8 (relevance of external law), Section 9(2)(b) (British citizenship immaterial: conspiracy) and Section 16 (application to Northern Ireland).<ref name=Justice_Act_1988>{{cite web |title=Criminal Justice (Terrorism and Conspiracy) Act 1998 Schedule 1 |url=http://www.legislation.gov.uk/ukpga/1998/40/schedule/1 |website=legislation.gov.uk |publisher=The National Archives |access-date=24 March 2015 }}</ref>

In 2004, the All-Party Internet Group published its review of the law and highlighted areas for development. Their recommendations led to the drafting of the Computer Misuse Act 1990 (Amendment) Bill which sought to amend the CMA to comply with the European Convention on Cyber Crime.<ref>{{Cite web|url=http://conventions.coe.int/Treaty/en/Treaties/Html/185.htm|title = Full list}}</ref> Under its terms, the maximum sentence of imprisonment for breaching the Act changed from six months to two years. It also sought to explicitly criminalise [[denial-of-service attack]]s and other crimes facilitated by denial-of-service. The Bill did not receive [[Royal Assent]] because Parliament was [[legislative session#Procedure in Commonwealth realms|prorogued]].

Sections 35 to 38 of the [[Police and Justice Act 2006]] contain amendments to the Computer Misuse Act 1990.

Section 37 ("Making, supplying or obtaining articles for use in computer misuse offences") inserts a new section 3A into the 1990 Act and has drawn considerable criticism from IT professionals, as many of their tools can be used by criminals in addition to their legitimate purposes, and thus fall under section 3A.

After the [[News International phone hacking scandal]] in 2011, there were discussions about amending the law to define "smart" phones (i.e. those with web browsers and other connectivity features) as computers under the Act.{{citation needed|date=May 2019}} Such an amendment might also introduce a new offence of "making information available with intent", i.e. publicly disclosing a password for someone's phone or computer so that others can access it illegally.<ref>{{Cite web|url=https://publications.parliament.uk/pa/cm201011/cmselect/cmstnprv/628/62805.htm|title = House of Commons - Privilege: Hacking of Members' mobile phones - Standards and Privileges Committee}}</ref>{{Failed verification|date=May 2019}}

In 2015, the Act was further amended by Part 2 sections 41 to 44 (plus others) of the [[Serious Crime Bill 2014|Serious Crime Act 2015]].<ref name=Serious_2015>{{cite web |title=Serious Crime Act of 2015 |url=http://www.legislation.gov.uk/ukpga/2015/9/pdfs/ukpga_20150009_en.pdf |publisher=UK Government |access-date=30 December 2015}}</ref>

===The amendments===
The amendments to the Computer Misuse Act 1990 by Part 5 of the Police and Justice Act 2006<ref>{{Cite web|title=Police and Justice Act 2006|url=http://www.legislation.gov.uk/ukpga/2006/48/contents|url-status=live|access-date=14 June 2021|website=www.legislation.gov.uk|archive-url=https://web.archive.org/web/20100926163659/http://www.legislation.gov.uk:80/ukpga/2006/48/contents |archive-date=2010-09-26 }}</ref> are

* Section 35. Unauthorised access to computer material, punishable by up to two years in prison or a fine or both.<ref>{{Cite web|title=Police and Justice Act 2006, section 35|url=http://www.legislation.gov.uk/ukpga/2006/48/section/35|url-status=live|access-date=14 June 2021|website=www.legislation.gov.uk|archive-url=https://web.archive.org/web/20101029023008/http://www.legislation.gov.uk:80/ukpga/2006/48/section/35 |archive-date=2010-10-29 }}</ref>
* Section 36. Unauthorised acts with intent to impair operation of computer, etc. punishable by up to ten years in prison or a fine or both.<ref>{{Cite web|title=Police and Justice Act 2006, section 36|url=http://www.legislation.gov.uk/ukpga/2006/48/section/36|url-status=live|access-date=14 June 2021|website=www.legislation.gov.uk|archive-url=https://web.archive.org/web/20101031100134/http://www.legislation.gov.uk:80/ukpga/2006/48/section/36 |archive-date=2010-10-31 }}</ref>
* Section 37. Making, supplying or obtaining articles for use in computer misuse offences, punishable by up to two years in prison or a fine or both.<ref>{{Cite web|title=Police and Justice Act 2006, section 37|url=http://www.legislation.gov.uk/ukpga/2006/48/section/37|url-status=live|access-date=14 June 2021|website=www.legislation.gov.uk|archive-url=https://web.archive.org/web/20101029025639/http://www.legislation.gov.uk:80/ukpga/2006/48/section/37 |archive-date=2010-10-29 }}</ref>
* Section 38. Transitional and saving provision.<ref>[http://www.legislation.gov.uk/ukpga/2006/48/section/38 Police and Justice Act 2006, section 38]</ref>

The amendments to the Computer Misuse Act 1990 by Part 2 of the Serious Crime Act 2015.<ref name=Serious_2015/> are

* Section 41 (new Section 3ZA of the Computer Misuse Act 1990). Unauthorised acts causing, or creating risk of, serious damage – punishable by up to 14 years in prison or a fine or both, possible life imprisonment where human welfare or national security were endangered.<ref>{{Cite web|title=Serious Crime Act 2015, section 41|url=http://www.legislation.gov.uk/ukpga/2015/9/section/41|url-status=live|access-date=14 June 2021|website=www.legislation.gov.uk|archive-url=https://web.archive.org/web/20150713094451/http://www.legislation.gov.uk:80/ukpga/2015/9/section/41 |archive-date=2015-07-13 }}</ref>
* Section 42. Obtaining articles for purposes relating to computer misuse – amendments to Section 3A.<ref>{{Cite web|title=Serious Crime Act 2015, section 42|url=http://www.legislation.gov.uk/ukpga/2015/9/section/42|url-status=live|access-date=14 June 2021|website=www.legislation.gov.uk|archive-url=https://web.archive.org/web/20160205142923/http://www.legislation.gov.uk:80/ukpga/2015/9/section/42 |archive-date=2016-02-05 }}</ref>
* Section 43. Territorial scope of computer misuse - amendments to Sections 4, 5 and 10 making the primary territorial scope the United Kingdom but can be worldwide especially if the perpetrator (or conspirators) is British and broke local law.<ref>{{Cite web|title=Serious Crime Act 2015, section 43|url=http://www.legislation.gov.uk/ukpga/2015/9/section/43|url-status=live|access-date=14 June 2021|website=www.legislation.gov.uk|archive-url=https://web.archive.org/web/20160710084808/http://www.legislation.gov.uk:80/ukpga/2015/9/section/43#section-43-3 |archive-date=2016-07-10 }}</ref>
* Section 44. Savings – covers seizure and enactment amendments to Sections 10 and 16.<ref>{{Cite web|title=Serious Crime Act 2015, section 44|url=http://www.legislation.gov.uk/ukpga/2015/9/section/44|url-status=live|access-date=14 June 2021|website=www.legislation.gov.uk|archive-url=https://web.archive.org/web/20160621002623/http://www.legislation.gov.uk:80/ukpga/2015/9/section/44#section-44-2-e |archive-date=2016-06-21 }}</ref>
* Section 47. Serious Crime Prevention Orders: meaning of "Serious Offence" - adds Computer Misuse to list of serious crimes in the [[Serious Crime Act 2007]] including being grounds for compulsory winding up of a company.<ref>{{Cite web|title=Serious Crime Act 2015, section 47|url=http://www.legislation.gov.uk/ukpga/2015/9/section/47|url-status=live|access-date=14 June 2021|website=www.legislation.gov.uk|archive-url=https://web.archive.org/web/20160328103554/http://www.legislation.gov.uk/ukpga/2015/9/section/47 |archive-date=2016-03-28 }}</ref>
* Section 86. Transition and savings provisions – requires Sections 42 and 43 to be brought into force before they can be used.<ref>{{Cite web|title=Serious Crime Act 2015, section 86|url=http://www.legislation.gov.uk/ukpga/2015/9/section/86|url-status=live|access-date=14 June 2021|website=www.legislation.gov.uk|archive-url=https://web.archive.org/web/20160106080417/http://www.legislation.gov.uk:80/ukpga/2015/9/section/86#section-86-10 |archive-date=2016-01-06 }}</ref>
* Schedule 1. Amendments to Serious Crimes Act 2007: Scotland – similar changes to Scottish law.<ref>{{Cite web|title=Serious Crime Act 2015, schedule 1|url=http://www.legislation.gov.uk/ukpga/2015/9/schedule/1|url-status=live|access-date=14 June 2021|website=www.legislation.gov.uk|archive-url=https://web.archive.org/web/20160911143637/http://www.legislation.gov.uk:80/ukpga/2015/9/schedule/1 |archive-date=2016-09-11 }}</ref>
* Schedule 4. Minor and consequential amendments – changes Computer Misuse Act 1990 and the [[Armed Forces Act 2006]].<ref>{{Cite web|title=Serious Crime Act 2015, section 4|url=http://www.legislation.gov.uk/ukpga/2015/9/schedule/4|url-status=live|access-date=14 June 2021|website=www.legislation.gov.uk|archive-url=https://web.archive.org/web/20150504050312/http://www.legislation.gov.uk:80/ukpga/2015/9/schedule/4 |archive-date=2015-05-04 }}</ref>

==Application to the NHS==
In April 2020, [[Matt Hancock]] issued directions giving [[GCHQ]] temporary powers over [[National Health Service]] information systems until the end of 2020 for the purposes of the Act to support and maintain the security of any network and information system which supports, directly or indirectly, the provision of NHS services or public health services intended to address [[Coronavirus disease 2019|COVID-19]].<ref>{{cite news|last=Carding|first=Nick|date=29 April 2020|title=Hancock grants GCHQ powers over NHS IT systems|journal=Health Service Journal|url=https://www.hsj.co.uk/technology-and-innovation/hancock-grants-gchq-powers-over-nhs-it-systems/7027528.article|access-date=8 June 2020}}</ref>

==Reform==
In May 2021, UK Home Secretary Priti Patel announced the formal review of the Computer Misuse Act.<ref>{{Cite web|date=11 May 2021|title=Home Secretary Priti Patel speech to CyberUK Conference|url=https://www.gov.uk/government/speeches/home-secretary-priti-patel-speech-to-cyberuk-conference|url-status=live|archive-url=https://web.archive.org/web/20210511154842/https://www.gov.uk/government/speeches/home-secretary-priti-patel-speech-to-cyberuk-conference|archive-date=11 May 2021|access-date=15 June 2021|website=GOV.UK|language=en}}</ref> She also launched a Call for Information on the Act that seeks views on whether there is activity causing harm in the area covered by the Act that is not adequately covered by the offences, including whether the legislation is fit for use following the technological advances since the CMA was introduced, and any other suggestions on how the legislative response to cyber crime could be strengthened.<ref>{{Cite web|date=11 May 2021|title=Computer Misuse Act 1990: call for information|url=https://www.gov.uk/government/consultations/computer-misuse-act-1990-call-for-information|url-status=live|archive-url=https://web.archive.org/web/20210511130135/https://www.gov.uk/government/consultations/computer-misuse-act-1990-call-for-information|archive-date=11 May 2021|access-date=15 June 2021|website=GOV.UK|language=en}}</ref>

The review of the Act follows growing calls, in recent year, for a complete government review of the Computer Misuse Act, in order to bring about new reforms.

In November 2019, [[Lynne Owens|Dame Lynne Owens]], Director General of the [[National Crime Agency]] (NCA), warned that "the Computer Misuse Act went through Parliament at a time when cyber wasn't the tool that it is now is to enable all sorts of crimes like fraud" and talked about plans to introduce reforms to make sure the law was "fit for purpose in the modern age".{{citation needed|date=January 2021}}

In January 2020, the Criminal Law Reform Now Network (CLRNN) published a comprehensive report highlighting the Act's shortcomings and making detailed recommendations for reform.<ref>{{cite web|title=Reforming the Computer Misuse Act 1990|url=http://www.clrnn.co.uk/publications-reports/|url-status=live|archive-url=https://web.archive.org/web/20210118095204/http://www.clrnn.co.uk/publications-reports/|archive-date=18 January 2021|access-date=15 June 2021|publisher=CLRNN}}</ref>

In the same month, the CyberUp Campaign was established with the intention of lobbying the UK government to "update and upgrade" the Act. The Campaign's launch was covered by ''[[The Guardian]]'' in an article that echoed the call for "urgent reform".<ref>{{cite news |title=Cybercrime laws need urgent reform to protect UK, says report |url=https://www.theguardian.com/technology/2020/jan/22/cybercrime-laws-need-urgent-reform-to-protect-uk-says-report|work=The Guardian|first=Owen | last = Bowcott|date=22 January 2020 |access-date=22 January 2021}}</ref> The CyberUp Campaign is made up of a wide coalition of supportive bodies from within the cyber security industry, including the large cyber consultancies [[NCC Group]] and [[F-Secure]] and the cyber industry trade body [[TechUK]]. In November 2020, the campaign gained the backing of the [[Confederation of British Industry]].

The coalition was formed based on the shared view that an update of the UK's cyber crime legislation is necessary to protect national security and to increase economic growth for the UK cyber security industry. The Campaign refers to Section 1 of the Act, "prohibiting unauthorised access to computers", stating that it inadvertently criminalises a large amount of cyber security and threat intelligence research and investigation which is frequently conducted by UK cyber security professionals.

The Campaign has called for two key amendments:
# Amend the law to allow cyber security and threat intelligence researchers acting in the public interest to explain and justify their actions and to allow the detection or prevention of crime.
# Create a set of clear legal definitions to ensure that cyber security and threat intelligence researchers who reasonably believe they have authorisation to act can legitimately do so.

On 29 June 2020, to celebrate the Act's 30th birthday, the CyberUp Campaign wrote an open letter to the prime minister on behalf of a number of cyber security industry figures to highlight the Act's outdatedness in a time of rapid digital advancement. This was published in ''[[The Daily Telegraph]]'', with the headline "Cyber security experts say they are being prevented from stopping computer fraud".<ref>{{cite news |title=Cyber security experts say they are being prevented from stopping computer fraud because criminals have to let them access machines |url=https://www.telegraph.co.uk/news/2020/06/28/cyber-security-experts-say-prevented-stopping-computer-fraud2/|work=The Daily Telegraph|first= Owen | last = Bowcott|date=29 June 2020 |access-date=22 January 2021}}</ref>{{Verify source|date=June 2021}}

In July 2020, the [[Intelligence and Security Committee of Parliament]], responsible for oversight of the UK intelligence services, published the [[Intelligence and Security Committee Russia report]] and recommended that "the Computer Misuse Act should be updated to reflect modern use of personal electronic devices". While the government response to the report said that the Act was regularly reviewed to determine the benefits of legislative change, the [[Shadow Foreign Secretary]], [[Lisa Nandy]], highlighted in January 2021 that no progress had been made towards implementing the recommendation.

In November 2020, the CyberUp Campaign and TechUK published a new report<ref>{{cite web|title=4 out of 5 cyber security professionals worry about breaking the law when defending UK, report finds|url=https://www.cyberupcampaign.com/news/4-out-of-5-cyber-security-professionals-worry-about-breaking-the-law-when-defending-uk-report-finds|url-status=live|archive-url=https://web.archive.org/web/20201119091706/https://www.cyberupcampaign.com/news/4-out-of-5-cyber-security-professionals-worry-about-breaking-the-law-when-defending-uk-report-finds|archive-date=19 November 2020|access-date=23 January 2021|publisher=CyberUp Campaign}}</ref>{{unreliable source?|date=January 2021}} on the Computer Misuse Act, which was the first piece of work to quantify and analyse the views of the wider UK security community. The report found that 80 per cent of cyber security professionals have worried about breaking the law when researching vulnerabilities or investigating cyber threat actors. Furthermore, 91 per cent of businesses that responded to the report’s survey suggested they had been put at a competitive disadvantage by the Act, and that reform would allow their organisation to reap significant productivity improvements, growth and resilience benefits. The report recommended that the government consider implementing the two above amendments.

==See also==
* [[Computer crime]]
* [[Internet fraud]]
* [[Data Protection Act 1998]]

==References==
* Neil MacEwan, [http://usir.salford.ac.uk/15815/7/MacEwan_Crim_LR.pdf "The Computer Misuse Act 1990: lessons from its past and predictions for its future"] (2008), ''Criminal Law Review'' '''955'''.
* Stefan Fafinski, ''Computer Misuse: Response, Regulation and the Law'' (Cullomption, Willan 2009)
* Yaman Akdeniz, ''Section 3 of the Computer Misuse Act 1990: an Antidote for Computer Viruses!'' (1996) 3 Web JCLI [http://webjcli.ncl.ac.uk/1996/issue3/akdeniz3.html] including reference to the case of Christopher Pile (aka 'the Black Baron') in November 1995.
* Derek Wyatt, [https://web.archive.org/web/20061009033525/http://www.derekwyattmp.co.uk/pages/news_item.asp?i_PageID=113214 ''Computer Misuse Act (amendment) speech'']
* [https://web.archive.org/web/20050319223534/http://www.underground-book.com/chapters/ccm/Gold.html The Law Lords' ruling]

==Notes==
{{reflist|30em}}

==External links==
{{wikisource}}
* [http://www.internetcrimeforum.org.uk The Internet Crime Forum]
* [http://www.eurim.org/consult/e-crime/dec03/ECS_WP6_web_031209.htm EURIM – IPPR E-Crime Study]
* [https://publications.parliament.uk/pa/cm200405/cmbills/102/05102.1-i.html Wording of the failed 2004 amendment bill]
* [http://www.openrightsgroup.org/orgwiki/index.php/Police_and_Justice_Bill_2006 Amendments to the Computer Misuse Act 1990] covered by the [[Open Rights Group]]
* [http://www.computerevidence.co.uk/Cases/CMA.htm A list of Computer Misuse Act cases compiled by Michael J L Turner]

[[Category:Computing legislation]]
[[Category:Computer security in the United Kingdom]]
[[Category:Hacking (computer security)]]
[[Category:United Kingdom Acts of Parliament 1990]]