statute-of-limitations computer-misuse-act england-and-wales
What is the limitation period for a violation of the Computer Misuse Act of 1990&#39;s provision(s) on phishing?
<p>I came across a story about a twenty-something year old male who setup a fake website in order to 'phish' for usernames and passwords for a popular game.</p>

<p>After acquiring the credentials he would then login in to these accounts and remove the in-game currency and transfer it over to his own account.</p>

<p>After a number of years he was finally found out after admitting to friends what he had done.</p>

<p>He was found guilty in court, even though the last time he did it was around 6 years ago.</p>

<p> </p>

<p>I'm curious as to how this would play out in the UK. I believe the act would be covered under the Computer Misuse Act 1990, but i am un-sure if there would be a time limit for a trial under the Limitations Act 1980.</p>

<p> </p>

<p>My question is how long would it take for this offence to 'expire' and no longer be punishable under UK law?</p>

<p>If I am misunderstanding the limitation act please let me know. </p>

<p>The offences found in the Computer Misuse Act 1990 are <em>criminal</em> offences. The Limitations Act 1980 deals with <em>civil</em> offences and is thus not relevant. Apparently, there is <a href="http://www.solicitorsjournal.com/comment/should-there-be-%E2%80%98statute-limitations%E2%80%99-criminal-offences" rel="noreferrer">no general statute of limitations</a> for criminal offences in the UK (though for <a href="https://en.wikipedia.org/wiki/Summary_offence" rel="noreferrer">summary</a> proceedings, the limit is in general 6 months). </p>

<p>The Computer Misuse Act 1990 contained, until 1 October 2008, its own limitation:</p>
<blockquote>
<ol start="11">
<li>Proceedings for offences under section 1<br />
(1) A magistrates' court shall have jurisdiction to try an offence under section 1 above if—<br />
    (a) the accused was within its commission area at the time when he did the act which caused the computer to perform the function; or<br />
  (b) any computer containing any program or data to which the accused secured or intended to secure unauthorised access by doing that act was in its commission area at that time.<br />
(2) Subject to subsection (3) below, proceedings for an offence under section 1 above may be brought within a period of six months from the date on which evidence sufficient in the opinion of the prosecutor to warrant the proceedings came to his knowledge.<br />
(3) No such proceedings shall be brought by virtue of this section more than three years after the commission of the offence.<br />
...</li>
</ol>
</blockquote>
<p>That section was repealed in its entirety on 1 October 2008.</p>
<p>Legislation is not generally retrospective, so it may have continued to limit the prosecution of offences committed prior to 1 October 2008 (which would have expired on 30 September 2011). This could have meant that it was possible to try only those offences committed between October 2008 and when the series was discovered.</p>
<p>Given that the last offence occurred &quot;around six years ago&quot; in 2010, it is possible that at least some of the series — those offences more than three years old — would have been out of time.</p>
<p>However, there doesn't appear to be any saving or transitional provision, so it's more likely that the abolition of the limitation actually made it possible to prosecute all offences committed after 30 September 2005, regardless of when they came to light or reached court.</p>
