criminal-law england-and-wales computer-misuse-act
Computer Misuse Act 1990 - Definition of unauthorised
<p>My question is: What does &quot;Unauthorised&quot; mean? The legislation claims that it means not having &quot;Consent&quot; to access the system - does this refer to implicit or explicit? For example, would sending a username and password be considered consent, or would a contract be required? This is more focussed around web development and that kind of thing.</p>
<p>Moreover, if this were the case, would the absence of evidence of a password being sent be detrimental to a defence? Or would other evidence likely suffice, for example directions from the system's owner about how a developer should develop a certain script, or maybe a watermark on a website?</p>
<p>To conclude - what I'm really asking is how broad is the definition of &quot;Authorisation&quot;, and how difficult is it to prove (or prove a lack of) authorisation?</p>

<p>To answer the headline question, <em>unauthorised</em> is defined by <a href="https://www.legislation.gov.uk/ukpga/1990/18/section/17?timeline=false" rel="nofollow noreferrer">Section 17(8)</a>, Computer Misuse Act 1990 which states:</p>
<blockquote>
<p>An act done in relation to a computer is unauthorised if the person doing the act (or causing it to be done)—</p>
<ul>
<li><p>(a) <strong>is not himself a person who has responsibility for the computer and is entitled to determine whether the act may be done</strong>; and</p>
</li>
<li><p>(b) <strong>does not have consent to the act from any such person.</strong></p>
</li>
</ul>
<p>In this subsection “ act ” includes a series of acts. </p>
</blockquote>
<p>(As for how difficult it is to prove or disprove acts have been authorised will hinge on the particular circumstances and available evidence.)</p>
<hr />
<p>For completeness, there are four &quot;unauthorised&quot; offences within the Computer Misuse Act 1990.</p>
<ul>
<li><p><a href="https://www.legislation.gov.uk/ukpga/1990/18/section/1?timeline=false" rel="nofollow noreferrer">Section 1</a> - Unauthorised access to computer material</p>
</li>
<li><p><a href="https://www.legislation.gov.uk/ukpga/1990/18/section/2?timeline=false" rel="nofollow noreferrer">Section 2</a> - Unauthorised access with intent to commit or facilitate commission of further offences</p>
</li>
<li><p><a href="https://www.legislation.gov.uk/ukpga/1990/18/section/3?timeline=false" rel="nofollow noreferrer">Section 3</a> - Unauthorised acts with intent to impair, or with recklessness as to impairing, operation of computer, etc</p>
</li>
<li><p><a href="https://www.legislation.gov.uk/ukpga/1990/18/section/3ZA?timeline=false" rel="nofollow noreferrer">Section 3ZA</a> - Unauthorised acts causing, or creating risk of, serious damage</p>
</li>
</ul>

<p>I don't have any information on how UK law handles these situations, but the <a href="/questions/tagged/united-states" class="post-tag" title="show questions tagged &#39;united-states&#39;" aria-label="show questions tagged &#39;united-states&#39;" rel="tag" aria-labelledby="tag-united-states-tooltip-container">united-states</a> Supreme Court recently elaborated on the meaning of &quot;authorization&quot; in the <a href="https://casetext.com/statute/united-states-code/title-18-crimes-and-criminal-procedure/part-i-crimes/chapter-47-fraud-and-false-statements/section-1030-fraud-and-related-activity-in-connection-with-computers" rel="nofollow noreferrer">Computer Fraud and Abuse Act</a>:</p>
<blockquote>
<p>An individual &quot;exceeds authorized access&quot; when he accesses a computer with authorization but then obtains information located in particular areas of the computer—such as files, folders, or databases—that are off limits to him. The parties agree that Van Buren accessed the law enforcement database system with authorization. The only question is whether Van Buren could use the system to retrieve license-plate information. Both sides agree that he could. Van Buren accordingly did not &quot;excee[d] authorized access&quot; to the database, as the CFAA defines that phrase, even though he obtained information from the database for an improper purpose.</p>
</blockquote>
<p><a href="https://casetext.com/case/van-buren-v-united-states-5" rel="nofollow noreferrer"><em>Van Buren v. United States</em>, 141 S. Ct. 1648, 1662 (2021)</a></p>
