Computer misuse and the law
The Computer Misuse Act 1990, the Data Protection Act 2018 and the Copyright, Designs and Patents Act 1988.
Do this lesson in the simulatorComputers made some old crimes easier and created some new ones. The UK has laws for both. This lesson covers the three laws an exam expects you to name, and what each one makes illegal, so that you can say which applies to a given situation.
The Computer Misuse Act 1990
This is the law against hacking. It created three main offences:
| Offence | Example |
|---|---|
| Unauthorised access to computer material | logging into someone else's account by guessing their password |
| Unauthorised access with intent to commit a further offence | breaking in to steal money or blackmail someone |
| Unauthorised acts with intent to impair a computer | planting malware, deleting files, or a denial of service attack |
Two things to notice. Unauthorised is the key word: testing security on a system you own or have written permission to test is legal, which is why penetration testers get permission in writing (lesson F11.7). And the first offence does not require you to damage anything, or even to succeed: trying to get in is enough.
The Data Protection Act 2018
The law about personal data, from lesson F12.2. It governs how organisations collect, store and use data about people, and gives people rights over their own data.
The Copyright, Designs and Patents Act 1988
This protects original work: writing, music, film, images and software. The person who created it owns the copyright, and copying, sharing or adapting it without permission is illegal. That covers copying a program's code, pirating a game, and using an image from the web in a product without a licence.
Copyright is automatic: a program you write is protected as soon as you write it, with no forms to fill in. A patent protects an invention and must be applied for, and a trademark protects a name or logo.
Which law applies?
Exam questions describe something and ask which law covers it. Match the action to what each law protects:
# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()
def which_law(action):
a = action.lower()
if "password" in a or "hack" in a or "malware" in a:
return "Computer Misuse Act 1990"
if "personal" in a or "customer details" in a:
return "Data Protection Act 2018"
if "copy" in a or "pirate" in a:
return "Copyright, Designs and Patents Act 1988"
return "no law matched"
for action in ["Guessing a teacher's password", "Selling customer details", "Pirating a game"]:
print(action, "->", which_law(action))
Real cases are rarely so neat: stealing a database of customers breaks the Computer Misuse Act (getting in) and the Data Protection Act (what was taken). An answer that names both, and says why, is a strong one.
Task: which law?
Write which_law(action) using the rules in the lesson: an action mentioning password, hack or malware is the Computer Misuse Act 1990; one mentioning personal or customer details is the Data Protection Act 2018; one mentioning copy or pirate is the Copyright, Designs and Patents Act 1988; anything else is no law matched. Check each action in actions, ignoring capital letters, and print <action>: <law>. At the end print unmatched: <n>.
# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()
actions = [
"Guessing a teacher's password",
"Selling customer details to an advertiser",
"Sharing a pirate copy of a game",
"Writing your own program",
"Installing malware on a school PC",
]
Challenges
- Some actions break two laws. Change the function to return every law that matches, joined by
and. - Is penetration testing illegal? Explain your answer using the word unauthorised.
- Why does copyright not need to be applied for, when a patent does?