Library › Fraud and financial crime
Computer Misuse Act offences: hacking, unauthorised access and DDoS
Unauthorised access to a computer or account is an offence under the Computer Misuse Act 1990 s.1 (maximum 2 years), rising to 5 years with intent to commit a further offence (s.2), 10 years for acts that impair a computer such as DDoS (s.3) and life for the most serious damage (s.3ZA). Employees and ex-partners commit the offence if they knowingly go beyond what they are allowed to access.
The offences (Computer Misuse Act 1990)
- Unauthorised access (s.1): making a computer perform a function to access a program or data, knowing the access is unauthorised. Maximum 2 years.
- Access with intent to commit or facilitate a further offence (s.2), such as fraud or blackmail, even if it never happens. Maximum 5 years.
- Unauthorised acts impairing a computer, intentionally or recklessly (s.3): deleting data, locking users out, malware or flooding a server; temporary effects count. Maximum 10 years.
- Acts causing or risking serious damage to human welfare, the environment, the economy or national security (s.3ZA): 14 years, or life where life, health or national security is at risk. Crown Court only.
- Making, supplying or obtaining tools for these offences (s.3A): 2 years. Mere possession is not an offence.
Sections 1, 2, 3 and 3A are triable either way (magistrates' maximum 12 months).
What "unauthorised" means
Access is unauthorised without the consent of a person entitled to control it (s.17(5)), and the defendant must know it is unauthorised. In R v Bow Street Metropolitan Stipendiary Magistrate, ex parte Government of the USA (Allison) [2000] 2 AC 216 the House of Lords held that an employee who accessed accounts she had not been assigned committed s.1: authority relates to the particular data. It said DPP v Bignell [1998] 1 Cr App R 1 (police officers who had an operator run checks for private reasons) was probably right on its facts but rejected its wider reasoning. Clear employer limits are central.
Common scenarios
- An ex-partner's accounts: logging in with a known password is s.1; changing passwords or deleting content may be s.3 (see Harassment, stalking and controlling or coercive behaviour).
- Employees taking data: s.1, or Data Protection Act 2018 s.170 (obtaining or retaining personal data without the controller's consent), which carries a fine only.
- DDoS and mail-bombing: consent to receive email does not cover emails sent to disrupt a system (DPP v Lennon [2006] EWHC 1201 (Admin)); this is s.3.
- Phishing: often charged as fraud instead (see Fraud: the three ways of committing fraud).
Jurisdiction
Only a significant link with England and Wales is needed, such as the defendant or the target computer being here (ss.4-5).
Sentencing
There is no Sentencing Council guideline. R v Mangham [2012] EWCA Crim 973 lists the factors: planning, persistence, damage to systems, privacy and confidence, cost of remediation, revenge, financial gain and passing data on; the offender's psychological profile deserves close attention. R v Martin [2013] EWCA Crim 1420 called for deterrence: for large-scale offending, sentences measured in years.
Reform
The King's Speech on 13 May 2026 announced a National Security Bill to update the Act, including a limited defence for some security research. No amending law had been passed as at 5 November 2026.
In practice
Logs, IP evidence and what the person believed they were allowed to do usually decide these cases.
Read the full guide on theodorous.uk
Authorities: Computer Misuse Act 1990 ss.1, 2, 3, 3ZA, 3A, 4, 5, 17 (as amended by Police and Justice Act 2006 ss.35-38 and Serious Crime Act 2015 ss.41-44); Data Protection Act 2018 ss.170, 196; R v Bow Street Metropolitan Stipendiary Magistrate, ex parte Government of the USA (Allison) [2000] 2 AC 216, [1999] UKHL 31; DPP v Bignell [1998] 1 Cr App R 1; DPP v Lennon [2006] EWHC 1201 (Admin); R v Mangham [2012] EWCA Crim 973; R v Martin [2013] EWCA Crim 1420; CPS Legal Guidance, Computer Misuse Act; King's Speech 13 May 2026 (National Security Bill)