1.5.1 - Computer misuse, copyright and interception

Unauthorised access and intent

The Computer Misuse Act 1990 (CMA), named in OCR 1.5.1(b), addresses misuse of computers. Under section 1, a person causes a computer to perform a function intending to gain access to programs or data, knows that the intended access is unauthorised, and has no authorisation for it. Access need not include alteration or damage. Opening records can be the relevant action even if the person later says they were only curious. CMA, section 1

Authorisation is permission for the access in question. Possessing a working password is evidence of technical ability, not necessarily permission. A payroll assistant authorised to open staff pay records is in a different position from a visitor using an unattended payroll session knowing they have no permission. In applying the law, identify what access was intended, who authorised it and what the person knew; avoid assuming any accidental error is a deliberate offence.

Section 2 concerns unauthorised access with intent to commit or facilitate a further qualifying offence. For example, knowingly accessing a protected account with the intention of carrying out fraud raises more than simple unauthorised access. A later offence need not actually be completed for that intention to matter. CMA, section 2

An organisation can define roles, remove old access and agree a clear scope for security testing. A tester's permission might cover a test server for one week but exclude the live customer system. Staying within that scope matters. An ethical motive, such as wanting to find a weakness, does not by itself grant access permission.

Impairment and misuse tools

The CMA also addresses actions that disrupt a system. Section 3 concerns a person knowingly performing an unauthorised act with intent to impair, or recklessness as to impairing, computer operation, access to material or the operation or reliability of material. Deleting records, introducing malicious code or deliberately overwhelming a service may fit this kind of impairment. A denial-of-service attack can hinder legitimate users without changing a stored file; temporary disruption can still matter. CMA, section 3, CPS: CMA guidance

Compare an administrator performing an authorised maintenance shutdown with an outsider knowingly flooding a booking service to stop customers booking. Both can make the system unavailable, but the permission and intended action differ. The law is not simply "a computer stopped, therefore an offence occurred". A genuine accident is also different from deliberately or recklessly impairing a system.

Section 3A concerns making, adapting, supplying or obtaining articles, including programs or data, for specified computer misuse offences, with the relevant intent or belief. A tool can have legitimate and harmful uses. The existence of a security-testing tool alone does not prove the offence; supplying it intending to assist unauthorised attacks is different from using it within an authorised test. CMA, section 3A

The practical consequence is to combine technical controls with explicit permission: define testing targets, avoid attacks on live services, keep evidence of agreed scope and stop when a requested action exceeds it. These measures prevent disruption and help distinguish legitimate testing from misuse.

Copyright ownership and licensing

The Copyright, Designs and Patents Act 1988 (CDPA) protects qualifying creative works, including computer programs, photographs, music and written material. Copyright generally arises automatically; the UK has no register that a programmer must join to obtain it. Protection concerns the work's expression, rather than ownership of every general idea or function it implements. OCR's 1.5.1(c) uses the wording "Copyright Design and Patents Act 1988"; the statutory title includes Designs. UK government: copyright