# The Computer Misuse Act 1990 ## What is the Computer Misuse Act?

The Computer Misuse Act (CMA) is legislation concerning the malicious use of computers

- The act was originally created to ensure that computer **hacking was covered within the law** - It has been **updated regularly** to ensure it remains relevant in the face of evolving technology - Features can be deployed to minimise the threat from unauthorised access: - **Digital signatures** or certificates - **Firewalls** to prevent external people accessing the system - Firewalls are key in preventing **DoS** or **DDoS** attacks ## Primary Offences Under the CMA - The Computer Misuse Act defines **3 primary offences**: ### 1. Unauthorised access to computer materials - Simply accessing a computer system without permission - Example: A library assistant discovers the head librarian's password written on a sticky note and uses it to log into their account and browse through confidential personnel files ### 2. Unauthorised access with intent to commit further offences - Accessing a computer system without permission with the **intention** of committing additional crimes - Example: The library assistant discovers the head librarian's password and accesses their account with the specific plan to modify upcoming shift schedules to give themselves more desirable working hours ### 3. Unauthorised modification of computer files - Accessing a computer system without permission and **actually changing** data or files - Example: The library assistant discovers the head librarian's password, accesses their account, and actually changes the shift schedules, giving themselves prime weekend slots

The consequences of each offence worsen from 1 to 3, with each being punishable by prison time

## Case Study: Theft of Data Under the CMA **Two individuals were sentenced under the Computer Misuse Act for data theft:** - The Information Commissioner's Office (ICO) successfully prosecuted 2 individuals for violating the CMA by stealing personal information to facilitate scam calls - Kim Doyle, a former employee of the RAC, was found guilty of transferring personal data to an accident claims firm without permission - Data included: - Road traffic accident data - Names - Phone numbers - Vehicle registration numbers - She pleaded guilty to conspiracy to secure unauthorised access to computer data, and selling unlawfully obtained personal data - Kim Doyle and William Shaw were handed an 8-month prison sentence, suspended for 2 years ## Exam Tips

Always relate the Computer Misuse Act to the scenario in the question—describe how the law affects the company and what the consequences would be

- When answering questions on the Computer Misuse Act: - **Don't just describe the law** in isolation - Apply it to the relevant scenario asked in the question - Explain how the CMA affects the company or individual in the scenario - Discuss the consequences of the actions taken ## Worked Example **Question:** "The Computer Misuse Act means that computer users are criminalised for simply trying to learn how systems work" Discuss whether or not you agree with this statement. (9 marks) **How to answer this question:** 1. Describe your knowledge of the Computer Misuse Act 2. Mention the three main offences 3. Apply to a scenario (create your own if none is given) 4. Keep the argument balanced—speak about both sides 5. Write your conclusion using your own opinion **Example answer that gets full marks:** The Computer Misuse Act (CMA) is a provision for securing computer material against unauthorised access or modification to the system. Under the CMA there are three main offences that you can be prosecuted for: The unauthorised access to a computer system, the unauthorised access to the computer system with intent to make changes, and unauthorised access to the computer system and making changes. Users can still investigate how computer systems work; they would just need to get authorisation before doing so. For example you could ask the owner of the computer system to allow access first or you could create a virtual computer system and use this to investigate. The CMA could however be broken by accessing an email account of somebody without permission. Ultimately users need to make sure that they are aware of the law when accessing any computer system. In conclusion I disagree with the statement "The Computer Misuse Act means that computer users are criminalised for simply trying to learn how systems work" as users are able to educate themselves on the details of the CMA easily online and therefore should know the consequences of accessing a computer system without the right authorisation. There are plenty of online platforms, programs and systems that are accessible to access virtually and would not be in breach of the CMA.