The Computer Misuse Act explained
The Computer Misuse Act 1990 is the UK’s main hacking law. It criminalises unauthorised access to computers, unauthorised acts that impair or seriously damage them, and supplying tools for those offences. The Cyber Security and Resilience Bill (CSRB) does not amend it, and proposed reform has not yet become law.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
What the Act does
The Computer Misuse Act 1990 is the UK's main anti-hacking law. It makes it a crime to access a computer without authorisation, to carry out certain harmful acts against computers, and to make or supply tools intended for those crimes.
It is separate from the Cyber Security and Resilience Bill (CSRB). The Bill places duties on regulated organisations to protect their systems and report incidents. The Computer Misuse Act criminalises what attackers, and anyone else acting without authority, do.
The offences
| Section | Offence, in plain English | Maximum sentence on indictment |
|---|---|---|
| Section 1 | Accessing, or trying to access, computer material knowing that you are not authorised | 2 years |
| Section 2 | Section 1 access with intent to commit or help commit a further serious offence | 5 years |
| Section 3 | Knowingly carrying out an unauthorised act intending, or reckless as to, impairing a computer, program or data | 10 years |
| Section 3ZA | An unauthorised act causing, or creating a significant risk of, serious damage of a material kind | 14 years, or life where there is a significant risk of serious damage to human welfare or national security |
| Section 3A | Making, adapting, supplying or offering articles intending them to be used for these offences. The full section also covers related conduct, such as obtaining an article for supply | 2 years |
Fines can also apply. This table is a simplified summary. Read the sections themselves for the exact tests.
Common examples
These are general illustrations. Whether an offence is committed always depends on the facts.
- Logging in with someone else's password without permission can be a section 1 offence, even if you change nothing.
- Reading a former employer's system after you left, using access that was never removed, can be a problem. Having technical access is not the same as being authorised.
- Ransomware or a denial of service attack typically points towards section 3.
- Selling malware intending it to be used in an offence can fall under section 3A.
- An attack on critical services that risks serious harm could fall under section 3ZA.
Motive does not automatically help. Curiosity or trying to be helpful is not a general defence under the Act today.
What "unauthorised" means
Section 1 requires that you intended to secure access to a program or data, that the access was unauthorised, and that you knew it was. The Act's interpretation section explains that access is unauthorised where you are not entitled to control it and do not have consent from someone who is.
That is why written permission matters so much in security testing. See is penetration testing legal in the UK?.
Does it apply outside the UK?
It can. Sections 4 and 5 deal with territorial scope and "significant links with domestic jurisdiction". An attacker abroad, or a target in the UK, does not automatically take a case outside the Act. Anyone with a cross-border question should take specific legal advice.
Why people want it changed
The Act was written in 1990. Security researchers argue that some good-faith work, such as checking for vulnerabilities in systems they do not own, can carry legal risk because the Act has no general public interest or research defence.
Where reform stands, as far as we can confirm:
- In December 2025, a minister committed to introducing a statutory defence for researchers who follow specific safeguards.
- In May 2026, reports said reform would move forward in a new National Security Bill.
- In September 2026, a minister told the Lords that the Home Office had finished its review and was proposing a section 1 defence for accredited cyber security researchers undertaking certain activities.
- Critics argue that this is too narrow. One report, relying on unnamed sources, said it could cover only a small group of professionals.
None of this is law yet. Check for the current position before relying on any proposed defence.
The Cyber Security and Resilience Bill does not amend the Act. An amendment seeking a review was withdrawn at Lords Committee Stage in September 2026.
What this means for organisations
- Remove access when people leave, and review who holds what access. That helps both security and any later prosecution.
- Write authorisation down. That applies to security testers, suppliers and staff using admin tools.
- Report crime. An incident may need reporting to a regulator under other laws, and may also be a criminal matter for the police.
- Make it easy to report vulnerabilities. A vulnerability disclosure policy gives researchers a clearer route.
Sources
Frequently asked questions
It makes it a crime to access computers without authorisation, carry out unauthorised acts that impair or seriously damage them, and make or supply tools for those crimes.
It depends on the offence. Section 1 carries up to 2 years on indictment and section 3 up to 10 years. Section 3ZA carries up to 14 years, or life where there is a significant risk of serious damage to human welfare or national security.
It can be a section 1 offence if you use it to access a computer knowing that you are not authorised. It depends on the facts, including whether you had valid permission.
No. An amendment seeking a review was withdrawn at Lords Committee Stage in September 2026. Reform is being pursued separately.