criminal-law united-kingdom england-and-wales common-law computer-misuse-act
Computer Misuse Act 1990 vs Police and Justice Act 2006
<p>I am studying towards a qualification called <strong>CREST CPSA</strong>, reading through their syllabus guide <a href="https://www.crest-approved.org/wp-content/uploads/crest-crt-cpsa-technical-syllabus-2.4.pdf" rel="nofollow noreferrer">here</a>. It covers some sections on Law that I was hoping to clarify on here.</p>
<p>On PDF page <strong><code>6/20</code></strong> it covers the following:</p>
<pre><code>Knowledge of pertinent UK legal issues:
• Computer Misuse Act 1990
• Human Rights Act 1998
• Data Protection Act 1998
• Police and Justice Act 2006
Impact of this legislation on penetration testing
activities.
Awareness of sector-specific regulatory issues.
</code></pre>
<p>I had not previously heard of the <strong>Police and Justice Act 2006</strong>, and after doing some digging online I could not understand the difference between that and the <strong>Computer Misuse Act 1990</strong>.</p>
<p>They both seem to cover computer crimes, albeit one has a slightly lower maximum sentence...</p>

<p>Part of the 2006 Act (<a href="https://www.legislation.gov.uk/ukpga/2006/48/part/5/crossheading/computer-misuse" rel="nofollow noreferrer">sections 35-38</a>) amends the 1990 Act. You can read more about the effect and purpose of the changes in the <a href="https://www.legislation.gov.uk/ukpga/2006/48/notes/contents" rel="nofollow noreferrer">explanatory notes</a>. Some particular highlights:</p>
<ul>
<li>The changes were made to reflect EU law, a Framework Decision of 2005 on information security, and to be compatible with a Council of Europe agreement on the same topic.</li>
<li>There is extra coverage to make sure it is an offense to do something to enable unauthorized access at a later date, or by someone else.</li>
<li>There is also extra coverage to catch denial-of-service attacks.</li>
<li>There is a new offense for creating hacking tools, as opposed to doing any actual hacking with them. This also covers distribution of lists of login credentials and the like.</li>
</ul>
<p>These reflect the changed landscape of computer security now that we have more pervasive Internet connectivity than in 1990, and a generally more sophisticated marketplace for computer crime.</p>
