‘Unauthorised Use’ and Section 1 of the Computer Misuse Act 1990
| Published date | 01 February 1996 |
| DOI | https://doi.org/10.1108/eb025735 |
| Date | 01 February 1996 |
| Pages | 359-361 |
| Author | Stanley Lai |
| Subject Matter | Accounting & finance |
Journal of Financial Crime — Vol. 3 No. 4 — Computer Security
'Unauthorised Use' and Section 1 of the Computer
Misuse Act 1990
Stanley Lai
The withdrawal of charges against a reporter of the
Independent,
following the failed prosecution of a
British Telecom employee1 illustrates the limita-
tions of the carefully defined offence of 'unau-
thorised access', as provided by s. 1 of the
Computer Misuse Act 1990 (the 1990 Act). It
remains an oddity that the 1990 Act does little to
regulate 'unauthorised use', as opposed to 'unau-
thorised access'.
The
Independent
had reported on the case with
which confidential information that was stored on
British Telecom (BT) computers could be
accessed. This was rigorously denied by BT. One
of BT's employees subsequently contacted the
Independent
and offered a demonstration on com-
puter to show that access of confidential informa-
tion could indeed be done with little difficulty,
thereby substantiating the
Independent's
earlier alle-
gations. Arrangements were made for a reporter to
observe the BT employee accessing sensitive infor-
mation on the computer. Portions of data were
printed out for the reporter to verify his story to
his editors. BT investigated and reported the
matter to the police. Both the employee and
reporter were subsequently charged with gaining
unauthorised access contrary to s. 1 of the 1990
Act.2
Section 1 of the 1990 Act contains the basic
offence; which involves the act of obtaining unau-
thorised access to a program or data held on a
computer. In its report, the Law Commission
referred to an offence of this nature as being
designed to criminalise computer hacking.3 A
person is guilty of an offence under s. 1 if:
(a) he causes a computer to perform any function
with intent to secure access to any program or
data held in any computer;
(b) the access he intends to secure is unauthor-
ised; and
(c) he knows at the time when he causes the com-
puter to perform the function that that is the
case.
In common with other statutory interventions in
the computer field, little attempt is made to define
any of the more technical terms referred to above.
Page 359
To continue reading
Request your trial