Offences Under the Computer Misuse Act 1990
Section 1 (unauthorised access) carries a maximum of two years. Section 2 (unauthorised access with intent to commit further offences) carries five years. Section 3 (unauthorised acts impairing computer operation — including malware, ransomware, and DDoS attacks) carries ten years. Section 3ZA (acts causing or risking serious damage to human welfare, the environment, the economy, or national security) carries 14 years rising to life. Section 3A (making or supplying articles for use in offences) carries two years.
| Offence | Section | Maximum |
|---|---|---|
| Unauthorised access | s.1 CMA 1990 | 2 years |
| Unauthorised access — further offences | s.2 CMA 1990 | 5 years |
| Impairing computer operation (DDoS, malware) | s.3 CMA 1990 | 10 years |
| Causing or risking serious damage | s.3ZA CMA 1990 | 14 years / life |
| Making / supplying articles for offences | s.3A CMA 1990 | 2 years |
Identity Theft, Phishing, and Fraud
Identity theft is not a specific offence but the conduct gives rise to charges under the Fraud Act 2006 or Theft Act 1968. Common methods include phishing, smishing, vishing, and trashing. Charges may include fraud by false representation, possession of articles for use in fraud, and obtaining services dishonestly.
Dark Web Offences
The anonymity offered by the dark web does not prevent investigation or prosecution. Law enforcement agencies have developed significant capability in identifying those responsible for dark web offences. The offences alleged are the same as those applicable to offline conduct — what distinguishes them is the technical complexity and the international dimension.
Jurisdiction and International Investigations
Under section 4 of the Computer Misuse Act, the courts have jurisdiction where there is at least one significant link with England and Wales — established by the presence of the suspect, the location of the victim, or the involvement of a UK server. Investigations may be conducted by UK agencies alongside international counterparts under mutual legal assistance treaties.
What to Do if You Are Under Investigation
If you are arrested, have had devices seized, or have been asked to attend a voluntary interview in connection with a cybercrime investigation, do not speak to investigators without a solicitor present. Cybercrime investigations involve technically complex digital evidence that requires careful scrutiny by specialists. Early legal intervention allows representations to be made to the CPS before a charging decision is taken.