Making or Supplying Hacking Tools 

Under section 3A of the Computer Misuse Act 1990, it is an offence to make, adapt, supply or offer to supply software or data intended to be used, or believed likely to be used, to commit offences such as unauthorised access or impairment of computers. The law includes programs and data in electronic form. 

Section 3A carries a maximum sentence of two years’ imprisonment on indictment, with lower penalties in summary proceedings. Sentencing depends on the facts, including harm, intent, previous record and any related offences. 

Yes. Some software has legitimate and unlawful uses. A tool can become criminally relevant if it is made or supplied with intent, or where the supplier believes it is likely to be used unlawfully. Context, communications and commercial channels can be central to the case. 

Mere possession is not always enough. Section 3A focuses on making, supplying or obtaining with a wrongful purpose. However, possession alongside evidence of intent, supply activity, marketplace listings or communications can lead to charges. 

Seek legal advice immediately. Do not hand over passwords or consent beyond what is legally required without advice. A solicitor can advise on warrants, searches and evidence preservation to protect your position. 

Forensic imaging and chain of custody are important. We instruct independent digital forensic experts to test provenance, timestamps, use patterns and whether code was deployed or held for legitimate research. 

Legitimate research and authorised penetration testing can form part of a defence, but you will need clear authorisation, benign intent and documented scope. Professional practice, permissions and remedial conduct can be important evidence. 

Timelines vary. Some matters conclude at pre-charge stage, while others proceed to Crown Court. Ashmans provides nationwide representation at police stations and courts across England and Wales and will keep you informed throughout.