Unauthorised Acts with Intent to Impair Operation of Computer (Section 3 Computer Misuse Act 1990)

Unauthorised Acts with Intent to Impair Operation of Computer is an offence under s.3 Computer Misuse Act 1990. A person is guilty of the offence if he does any unauthorised act in relation to a computer, at the time he does the act he knows that it is unauthorised, and either he intends by doing the act to impair the operation of any computer, to prevent or hinder access to any program or data held in any computer, or to impair the operation of any such program or the reliability of any such data (s.3(1) and (2)), or he is reckless as to whether the act will do any of those things (s.3(3)). The intention or recklessness need not relate to any particular computer, program or data (s.3(4)); doing an act includes causing an act to be done, "act" includes a series of acts, and impairing, preventing or hindering includes doing so temporarily (s.3(5)). Maximum sentence: on conviction on indictment, imprisonment for a term not exceeding ten years, a fine or both; on summary conviction in England and Wales, imprisonment for a term not exceeding the general limit in a magistrates' court (12 months in the case of an offence triable either way: Sentencing Act 2020, s.224(1A)(b)), a fine not exceeding the statutory maximum or both (s.3(6)(a) and (c)).

In practice

This is an either-way offence: it may be tried at the magistrates' court or the Crown Court. The charging decision rests with the CPS (not police). This is the most serious Computer Misuse Act offence and covers malware distribution, ransomware, and DDoS attacks. Referral to the National Cyber Crime Unit (NCA) should be considered for all serious cases. Digital forensic examination is essential. Preserve all evidence of the attack: logs, malware samples, network traffic captures, damage assessments. Victim organisations should be advised to preserve their own records. The suspect must be cautioned in accordance with Code C PACE 1984 before any questions about the offence are put to them. Interviews must be audio-recorded (Code E) or visually recorded (Code F).