united-kingdom computer-misuse-act
Section 3A of the United Kingdom&#39;s Computer Misuse Act 1990
<p>Section 3A of the United Kingdom's computer misuse act states you are not allowed to produce, obtain or supply articles which can be used for computer misuse.</p>

<p>How do UK information security bloggers and conference speakers go about this, as technically, even with non-malicious intent, there is a violation of the CMA?</p>

<p>The legislation in question is <a href="http://www.legislation.gov.uk/ukpga/1990/18/section/3A" rel="nofollow noreferrer">section 3A of the Computer Misuse Act 1990</a> (this section was added to the original text of the CMA by section 37 of the Police and Justice Act 2006):</p>

<blockquote>
  <p><strong>3A Making, supplying or obtaining articles for use in offence under section 1 or 3</strong></p>
  
  <p>(1) A person is guilty of an offence if he makes, adapts, supplies or
  offers to supply any article intending it to be used to commit, or to
  assist in the commission of, an offence under section 1 or 3.</p>
  
  <p>(2) A person is guilty of an offence if he supplies or offers to
  supply any article believing that it is likely to be used to commit,
  or to assist in the commission of, an offence under section 1 or 3.</p>
  
  <p>(3) A person is guilty of an offence if he obtains any article with a
  view to its being supplied for use to commit, or to assist in the
  commission of, an offence under section 1 or 3.</p>
  
  <p>(4) In this section “article” includes any program or data held in
  electronic form.</p>
</blockquote>

<p>(Sections 1 and 3 refer to unauthorised access and impairing the operation of computer)</p>

<p>In England and Wales, prosecutions are brought by the Crown Prosecution Service, there are  <a href="http://www.cps.gov.uk/legal/a_to_c/computer_misuse_act_1990/#an10" rel="nofollow noreferrer">guidelines produced by the CPS</a> for section 3A:</p>

<blockquote>
  <p>Prosecutors should be aware that there is a legitimate industry
  concerned with the security of computer systems that generates
  'articles' (this includes any program or data held in electronic form)
  to test and/or audit hardware and software. Some articles will
  therefore have a dual use and prosecutors need to ascertain that the
  suspect has a criminal intent.</p>
</blockquote>

<p>...</p>

<blockquote>
  <p>Prosecutors dealing with dual use articles should consider the
  following factors in deciding whether to prosecute:</p>
  
  <p>Does the institution, company or other body have in place robust and
  up to date contracts, terms and conditions or acceptable use polices?</p>
  
  <p>Are students, customers and others made aware of the CMA and what is
  lawful and unlawful? </p>
  
  <p>Do students, customers or others have to sign a
  declaration that they do not intend to contravene the CMA?</p>
</blockquote>

<p>For Section 3A (2):</p>

<blockquote>
  <p>In determining the likelihood of an article being used (or misused) to
  commit a criminal offence, prosecutors should consider the following: </p>
  
  <p>Has the article been developed primarily, deliberately and for the
  sole purpose of committing a CMA offence (i.e. unauthorised access to
  computer material)?  </p>
  
  <p>Is the article available on a wide scale commercial basis and sold through
  legitimate channels?  </p>
  
  <p>Is the article widely used for legitimate purposes?  </p>
  
  <p>Does it have a substantial installation base?  </p>
  
  <p>What was the context in which the article was used to commit the offence 
  compared with its original intended purpose?</p>
</blockquote>

<p><a href="https://security.stackexchange.com/questions/88913/section-37-of-the-united-kingdoms-computer-misuse-act">Original answer from Sec.SE by Tom77</a></p>
