Murdering a computer is now as serious as murdering a person ... in some cases

This article was produced by Nabarro LLP, which joined CMS on 1 May 2017.

On the 3rd of May 2015 the Computer Misuse Act 1990 will be amended in three important respects:

For acts of computer misuse (essentially: impairing the operation of a computer without authorisation) resulting in material damage or risk of material damage there will be a maximum penalty of life imprisonment. To attract that penalty, the damage must be serious and the risk must be significant. Whether the damage or risk of damage is material falls within four classes: human welfare, the economy, the environment and national security.

The offence carries a mental element meaning that there must have been an intention to carry out the unauthorised act or the person must have acted recklessly i.e. wanton indifference to a clear and obvious risk. For cases involving the environment or the economy the sentence is capped at 14 years imprisonment; for the other two, however, the maximum term is life. Hackers who are UK nationals are not safe even if they act abroad and the effects are felt abroad. As long as the act carried out in the other jurisdiction was a criminal act there, then they can be prosecuted in the UK.

Those acquiring computer damaging software (such as hacking software or virus writing software) will commit an offence by the mere act of acquisition of that software. Their intention in doing so must have been to commit a misuse offence or to assist others to do so. Previously the rule was that the acquisition had to have been made with the intention of supplying the software to others to commit an offence or assist in an offence being committed. The new state of mind is marginally easier to prove.