Computer misuse and the law

The Computer Misuse Act 1990, the Data Protection Act 2018 and the Copyright, Designs and Patents Act 1988.

F12.3Technology and societyGCSE15 min

Covers OCR J277 1.6.1 Ethical, legal, cultural and environmental impact · AQA 8525 3.8 Ethical, legal and environmental impacts of digital technology on wider society, including issues of privacy · Edexcel 1CP2 5.2.3 Intellectual property

Do this lesson in the simulator

Print it: worksheet (PDF) · answers (PDF) · as a web page

Computers made some old crimes easier and created some new ones. The UK has laws for both. This lesson covers the three laws an exam expects you to name, and what each one makes illegal, so that you can say which applies to a given situation.

The Computer Misuse Act 1990

This is the law against hacking. It created three main offences:

Offence Example
Unauthorised access to computer material logging into someone else's account by guessing their password
Unauthorised access with intent to commit a further offence breaking in to steal money or blackmail someone
Unauthorised acts with intent to impair a computer planting malware, deleting files, or a denial of service attack

Two things to notice. Unauthorised is the key word: testing security on a system you own or have written permission to test is legal, which is why penetration testers get permission in writing (lesson F11.7). And the first offence does not require you to damage anything, or even to succeed: trying to get in is enough.

The Data Protection Act 2018

The law about personal data, from lesson F12.2. It governs how organisations collect, store and use data about people, and gives people rights over their own data.

The Copyright, Designs and Patents Act 1988

This protects original work: writing, music, film, images and software. The person who created it owns the copyright, and copying, sharing or adapting it without permission is illegal. That covers copying a program's code, pirating a game, and using an image from the web in a product without a licence.

Copyright is automatic: a program you write is protected as soon as you write it, with no forms to fill in. A patent protects an invention and must be applied for, and a trademark protects a name or logo.

The three Acts side by side, with what each one protects and an example of breaking ita computerComputer MisuseAct 1990it coversgetting into or harminga computer withoutpermissionfor exampleguessing a password,planting malwarea person's dataData ProtectionAct 2018it covershow personal data iscollected, storedand usedfor exampleselling customerdetailssomeone's workCopyright, Designs andPatents Act 1988it coversoriginal work: writing,music, film, imagesand softwarefor examplecopying a program's code,pirating a game
To say which law applies, ask what was harmed: a computer, a person's data, or someone's work. The words at the top are the three answers; the red lines are the lesson's examples of breaking each law.

Which law applies?

Exam questions describe something and ask which law covers it. Match the action to what each law protects:

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

def which_law(action):
    a = action.lower()
    if "password" in a or "hack" in a or "malware" in a:
        return "Computer Misuse Act 1990"
    if "personal" in a or "customer details" in a:
        return "Data Protection Act 2018"
    if "copy" in a or "pirate" in a:
        return "Copyright, Designs and Patents Act 1988"
    return "no law matched"

for action in ["Guessing a teacher's password", "Selling customer details", "Pirating a game"]:
    print(action, "->", which_law(action))

Run this in the simulator

Look at the last line: Pirating a game -> no law matched, because the word pirating does not contain pirate. Keyword rules are only as good as their keywords. Real cases are rarely so neat either: stealing a database of customers breaks the Computer Misuse Act (getting in) and the Data Protection Act (what was taken). An answer that names both, and says why, is a strong one.

Stealing a database of customers, split into getting in and what was taken, each linked to a different Actstealing adatabase ofcustomersgetting inwhat was taken:personal dataComputer MisuseAct 1990Data ProtectionAct 2018
One act, two laws. Getting into the system breaks the Computer Misuse Act; what was taken, people's personal data, brings in the Data Protection Act. A strong answer names both and says why.

Task: which law?

Write which_law(action) using the rules in the lesson: an action mentioning password, hack or malware is the Computer Misuse Act 1990; one mentioning personal or customer details is the Data Protection Act 2018; one mentioning copy or pirate is the Copyright, Designs and Patents Act 1988; anything else is no law matched. Check each action in actions, ignoring capital letters, and print <action>: <law>. At the end print unmatched: <n>.

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

actions = [
    "Guessing a teacher's password",
    "Selling customer details to an advertiser",
    "Sharing a pirate copy of a game",
    "Writing your own program",
    "Installing malware on a school PC",
]

Challenges

  1. Some actions break two laws. Change the function to return every law that matches, joined by and.
  2. Is penetration testing illegal? Explain your answer using the word unauthorised.
  3. Why does copyright not need to be applied for, when a patent does?