Computer Misuse Act 1990

Computer misuse act 1990 law relates to electronic records in that it creates three crimes of illegal access to computer software. Unauthorized access to computer materials. Unauthorized access for the purpose of committing or facilitating further criminal activity. Acts of intentionally or carelessly interfering with the operation of computers, etc.

Unauthorized Access to Computer Material:

If a Normal Person used any computer material to harm any other person or any organization then he comes under this offense. Like a normal person used any software or data to access secure access to any other program then it is not acceptable. The secure access for this person is unauthorized, and he tries to access it in an illegal way. So, a normal person can be prosecuted for this offense.

• Scenario 1: Mark is an employee in Hex Tell Inc. working in the Operations department. While visiting the HR office of one of his clients for submitting his company’s sales documents he found that the HR was not present at his seat with his system not locked. Out of his curiosity, he decided to view and surf through the ‘Pictures’ folder on the system. While doing this he was caught by the person who is using that system. In this scenario, Mark shall be charged under section 1 of the Computer Misuse Act 1990 since he had accessed the computer of someone without his and the company’s consent.
• Scenario 2: Jason was appointed as a penetration tester by QPR Securities and as part of his one-client engagement was asked to remove a malicious virus file from the laptop and return it to the client. After removing the malicious file Jason checked the information about the installed software on the client’s system and also access files related to the client’s trade. His act falls under the crime under section 1 of the Computer Misuse Act as he accessed information that was out of the scope of the requirement. 

Penalty:  If someone is liable for this offense then he carries out 6 months of imprisonment or a fine of 5000 euros or both.

Unauthorized Access With Intent to Commit Commission of Offense:

This act cover more serious offense with hacking intent. If a Normal Person is trying to access some authorized thing in an illegal way with the intent of harming someone then it will become under this section. Like, if someone gets unauthorized access to a system and gets all the sensitive or private data and illegally uses that information to facilitate some commission then it is a critical offense.

• Scenario 1: Rennie while invited to one of their office colleague’s birthday parties was given computer system access to start and stop the music as part of the musical chair contest. While doing this activity he downloaded malicious spyware on his colleague’s system for spying purposes. After some time during an investigation by a Forensic expert, it was found that this was installed on the system with the timestamp. Later Rennie was found guilty under section 2 of the Computer Misuse Act 1990 as after having authorized access Rennie showcased malicious intent of harming his colleague with unauthorized access to information stolen via spyware.
• Scenario 2: Nick was working with one of the clients as a penetration tester and was tasked to access the security of a client’s internal domain-connected laptop and not compromise or gain access to any other resource. While conducting the assessment activity Nick found that the system is connected to several other company resources including other employees’ machines, printers, fax machines,s, etc. After completing his activity accessed the client’s printer connected to the compromised machine to print the information about the client’s network and other users’ passwords. After the incident was reported to the Information Security head of the client, it was found that Nick will be charged under section 2 of CMA 1990. This was because he did an illegal attempt of leaking information about the client after being asked to work in limited scope.

Penalty: If someone is found guilty of this offense, then he carries out 5 years of imprisonment or an unlimited fine or both.

Unauthorized Modification of Computer Material:

It comes when someone the modification is computer material. If a Normal Person has access to a program, function, or computer system, and he did some modification to that function, or program then it will be a serious offense because if he has access then that access will be to use the system, not to perform any modification in them. He is not allowed to make modifications to any computer material in an unauthorized way. He is not allowed to spreading viruses that can modify the computer material.

• Scenario 1: Josh was working in the Sales department of HexaTell Inc. Due to some reason he missed the targets set by his Senior Manager for his team. To check the reports his Senior Manager gave him his laptop to ensure all employees had submitted reports. Josh while checking the reports swapped the information of his team’s reports with some other team. This offense is under section 3 of CMA 1990 as Josh modified the contents of a file he was not asked for.
• Scenario 2: Alice was tasked to conduct P.T for a client’s infrastructure. During the P.t exercise, she founds that there is a weakness related to one of the client’s servers which allows arbitrary file uploading over the server. Although Alice makes a note of this and added it to the report she also changed some log files of the server after which some important activities were found missing from the server log files. Since only Alice was provided the access to the server she was charged under section 3 of CMA 1990 as her actions led to unauthorized change/modification of her client’s computer data leading to loss of information.

Penalty: If someone is found guilty of this offense, then he carries out 5 years of imprisonment or an unlimited fine.