Accused of Distributing Malware or Ransomware: What Are the Charges and Penalties?

What It Means To Be Accused of a Computer Misuse Offence

The Computer Misuse Act 1990 is the main legislation covering unauthorised access to computer systems and interference with their operation.

It includes offences involving accessing files or accounts without permission, disrupting computer systems and creating or supplying tools intended for criminal computer activity.

Where malware or ransomware is involved, more than one offence may apply. For example, someone accused of accessing a company’s network without permission and then deploying ransomware may face separate charges for both actions.

The prosecution must establish the legal requirements of each offence.

Why malware and ransomware allegations are treated seriously

Malware can interfere with computer systems, damage files or allow unauthorised access to sensitive information. Ransomware is commonly used to restrict access to systems or data while demanding payment for their release.

These activities can cause financial losses and disrupt businesses, public services and individuals.

The seriousness of an allegation depends on factors such as the damage caused, the number of people affected and the defendant’s involvement.

Where several offences are alleged, the prosecution may bring multiple charges arising from the same incident.

What happens between police contact and a charging decision

Being contacted or interviewed by police does not automatically mean criminal charges will follow. Police may examine devices, communications, account records and other digital evidence before deciding how to proceed.

Where the Crown Prosecution Service (CPS) makes the charging decision under its usual test, it considers whether there is sufficient evidence for a realistic prospect of conviction and whether prosecution is in the public interest.

If the evidence does not support the allegation, the investigation may end without charges.

What Charges Apply to Malware and Ransomware?

The Computer Misuse Act 1990 covers several forms of computer-related offending. The charge depends on what the person is accused of doing and whether the prosecution can prove the required elements.

Unauthorised computer access

Accessing computer files, accounts or systems without permission can amount to a criminal offence. For example, an employee may be authorised to use a workplace computer but not to access restricted customer records.

The prosecution must prove that the person intended to gain access and knew the intended access was unauthorised. The maximum sentence on conviction in the Crown Court is two years’ imprisonment.

Unauthorised access intended to facilitate another crime

More serious charges may arise where someone accesses a computer without permission intending to commit or help another person commit a further serious offence.

For example, accessing financial information with the intention of committing fraud may fall within this offence. The intended further offence does not have to take place. However, the prosecution must establish both the unauthorised access and the required intention.

The maximum sentence is five years’ imprisonment.

Distributing malware or ransomware

Deploying ransomware, introducing malicious software or interfering with computer operations can result in criminal charges.

The prosecution must establish that the conduct was unauthorised, that the person knew this and that they intended or were reckless about interference with computer operations. Actual damage to the system is not always required.

The maximum sentence for the principal offence is ten years’ imprisonment. Particularly serious cases involving substantial damage or risk may lead to other charges carrying higher penalties.

Making or supplying malicious software

Making, supplying or obtaining software intended for use in computer misuse offences can also lead to prosecution. For example, supplying software intended to help someone gain unauthorised access to another person’s computer may constitute an offence.

However, tools used for legitimate security testing are not automatically unlawful. The prosecution must establish the required intention or belief concerning their criminal use.

The maximum sentence is two years’ imprisonment.

What Must Prosecutors Prove in Malware Cases?

The prosecution must prove the legal requirements of the specific offence beyond reasonable doubt.

These requirements differ depending on whether the allegation concerns unauthorised access, interference with computer systems or supplying software for criminal use.

Proving unauthorised access and knowledge

For an unauthorised access charge, the prosecution must establish that the person intended to access computer material and knew they did not have the necessary permission.

Permission may be an important issue where the person had a legitimate reason to use the system. For example, a security professional may have permission to test a company’s website but not to access other systems outside the agreed work. The prosecution must consider the scope of that authorisation rather than simply whether the person had a user account or password.

Charges involving interference with computer operations have related requirements concerning unauthorised acts. Charges involving the supply of malicious tools have different legal requirements.

Proving intent to commit another offence

Where unauthorised access is alleged to have been carried out to facilitate another crime, the prosecution must prove that intention.

Evidence may include messages, emails, records of activity and the type of information accessed. For example, communications suggesting a plan to obtain financial information for fraudulent use may be relevant.

The intended offence does not need to have occurred, but the necessary intention must be established.

Proving intent or recklessness when malware is involved

For allegations involving interference with computer systems, the prosecution must establish that the defendant intended the relevant interference or was reckless as to whether it would occur.

Investigators may examine the software’s purpose, how it was used and any communications relating to its deployment. For allegations involving the creation or supply of malicious tools, the prosecution must establish the required intention or belief about their criminal use.

The existence of malware-related software on a device does not automatically establish an offence.

How the CPS decides whether to bring malware charges

Where the CPS applies the Full Code Test, it considers the strength of the evidence and whether prosecution is in the public interest.

Factors may include the seriousness of the alleged conduct, financial losses, disruption to services and the number of people affected.

The defendant’s role and the wider circumstances may also be relevant.

The decision depends on the evidence supporting the particular allegation, not simply the presence of malware or a suspected cyberattack.

What to Do If the Police Contact You About Malware?

If police contact you about malware or ransomware allegations, seek legal advice before attending an interview or providing a detailed account.

Police contact may involve a voluntary interview, arrest or a request for information relating to an investigation.

Your rights and obligations depend on the circumstances.

Your right to legal advice before a police interview

In England and Wales, suspects are entitled to an independent legal advice at the police station.

This applies whether you have been arrested or are attending a voluntary interview under caution.

Requesting a solicitor is not an admission of guilt.

A solicitor can explain the allegation, consider the information disclosed by police and advise you before questioning.

What a PACE interview involves

A police interview under caution is a formal interview conducted under the Police and Criminal Evidence Act 1984 (PACE) and its Codes of Practice.

Interviews are normally recorded, and police will explain the caution before questioning begins.

You have the right to remain silent. However, failing to mention something during questioning that you later rely on in court may have consequences in certain circumstances.

Anything you say may also be used as evidence.

A solicitor can advise whether to answer questions, provide a prepared statement or make no comment, depending on the allegation and available evidence.

If you are under investigation, avoid taking actions that could affect potentially relevant evidence.

Do not delete files, messages or records connected to the allegation. Avoid accessing relevant systems without permission or contacting others involved to coordinate accounts.

Preserve material that may support your position, including employment records, written permissions, client agreements and communications relating to legitimate technical work.

Do not alter devices or remove software in an attempt to demonstrate that you did nothing wrong.

A solicitor can advise on preserving digital evidence and responding to police requests.

What Evidence Can Help Defend Malware Charges?

Computer misuse investigations often involve technical records and questions about the person’s permission to access a system.

Evidence of legitimate work, disputed identity or the purpose of particular software may be relevant, depending on the charge.

Authorisation and consent

Documents showing that someone had permission to access a system or carry out particular activities may help establish the circumstances.

Relevant evidence can include employment contracts, client agreements, written instructions and security testing permissions.

For example, a penetration tester may have been authorised to assess a company’s network within an agreed scope.

However, permission to carry out security testing does not necessarily extend to every system or activity.

A solicitor can review whether the alleged conduct fell within the permission given.

Challenging intent

The prosecution may rely on messages, software functionality or other circumstances to establish criminal intent.

Evidence showing that the activity had a legitimate professional purpose may be relevant.

This could include project documents, agreed testing procedures or communications with the system owner.

Such evidence does not automatically establish a defence. Its significance depends on the allegation and the circumstances.

Technical and forensic considerations

Digital evidence may include computer logs, account records, timestamps, IP addresses and information recovered from devices.

These records can help establish what happened, but they do not always identify who was responsible.

For example, activity linked to a particular account may not prove who used it.

Evidence of shared access, compromised credentials or unauthorised remote access by another person may therefore be relevant.

Where necessary, a solicitor can instruct an independent digital forensic specialist to examine the evidence.

What Are the Penalties for Malware and Ransomware?

The penalties for malware and ransomware offences depend on the charge, the seriousness of the conduct and the circumstances of the case.

Unauthorised computer access carries a maximum sentence of two years’ imprisonment, while unauthorised access intended to facilitate another serious crime carries up to five years.

More serious offences involving interference with computer operations, including certain malware and ransomware activity, carry a maximum sentence of ten years’ imprisonment.

Making, supplying or obtaining tools for criminal computer use carries a maximum sentence of two years. Certain particularly serious offences involving substantial damage or risk can attract higher penalties.

These are maximum sentences on conviction in the Crown Court, not automatic penalties.

Courts consider factors such as financial losses, disruption caused, the number of victims and the defendant’s involvement.

Mitigating circumstances, including an early guilty plea and relevant personal circumstances, may also affect sentencing.

Depending on the case, the outcome may include a fine, community sentence or imprisonment.

A conviction can also have consequences beyond the criminal sentence. These may include confiscation proceedings, civil claims, employment difficulties or professional regulatory action.

How Can a Solicitor Help with Malware Charges?

A criminal defence solicitor can explain the malware or ransomware allegation and what the prosecution must prove.

They can advise you before a police interview, review available evidence and identify documents that may be relevant to your defence.

Where there are questions about authorisation, identity or the purpose of particular software, a solicitor can assess the evidence and advise on the available options.

If technical evidence is disputed, an independent digital forensic specialist may be instructed. A solicitor can also represent you if criminal proceedings follow.

If police have contacted you about malware or ransomware allegations, speak to our cyber crime solicitor for advice about your circumstances and the next steps.

Find out more about our cyber crime defence services or send us an online enquiry.