1
Serious Crime Act 2015
Fact sheet: Part 2: Computer misuse
Background
1. In 2010 the National Security Strategy identified hostile attacks on UK cyber
space by other states and large scale cyber crime as a ātier oneā threat to national
security. In response, the National Cyber Security Programme (āNCSPā) was
established to help meet the objectives of the strategy. It is underpinned by Ā£860
million of government investment over five years to 2016, around 10% of which
has been invested to build law enforcement capabilities to tackle cyber crime. A
coordinated approach is needed to tackle serious and organised crime, including
cyber crime. The Government set out how we plan to achieve this in the Serious
and Organised Crime Strategy, published in October 2013. It is essential that in
tackling cyber crime the right framework of offences is in place and that there is
clarity in how the powers that are used to investigate cyber crime interact with the
offences designed to catch cyber criminals.
The Computer Misuse Act 1990 as amended
2. The Computer Misuse Act 1990 (āthe 1990 Actā) sets out the offences associated
with interfering with a computer (that is, hacking) and the associated tools (such
as malware) that enable computer systems to be breached. It does not contain
any powers. The 1990 Act, which applies UK-wide, makes unauthorised access
to, or modification of, computer material unlawful.
3. Part 2 of the Serious Crime Act 2015 amends the 1990 Act to:
ļ§ create a new offence of unauthorised acts causing serious damage;
ļ§ implement the EU Directive on Attacks against Information Systems; and
ļ§ clarify the savings provision for law enforcement agencies.
New offence of unauthorised acts causing serious damage
4. The new offence in section 3ZA of the 1990 Act addresses the most serious
cyber attacks, for example those on essential systems controlling power supply,
communications, food or fuel distribution. A major cyber attack of this nature
could have a significant impact, resulting in loss of life, serious illness or injury,
severe social disruption or serious damage to the economy, the environment or
national security. However, hitherto the most serious offence under the Act was
the section 3 offence of unauthorised access to impair the operation of a
computer. The maximum sentence of 10 yearsā imprisonment which this offence
carried did not sufficiently reflect the level of personal and economic harm that a
major cyber attack on critical systems could cause.
5. The new offence applies where an unauthorised act in relation to a computer
results, directly or indirectly, in serious damage to the economy, the environment,
