Unauthorised Access to a Computer System: Could You Face Prosecution?

When Is Accessing a Computer Without Permission Illegal?

The Computer Misuse Act 1990 is the main legislation covering unauthorised computer access in England and Wales. It creates three main offences: unauthorised access to computer material.

Unauthorised access with intent to commit a further offence; and unauthorised acts with intent to impair the operation of a computer system.

The basic unauthorised access offence is the most commonly encountered. It applies where a person accessed a system, account or file without permission, knowing that the access is unauthorised. It does not require any malicious intent, data theft or damage. 

A common misconception is that not using or copying the information provides a defence. It does not. The prosecution does not need to prove that data was stolen, altered or misused.

Even an unsuccessful attempt to gain access can amount to an offence where the person has caused a computer to perform a function with the required intention and knowledge.

What must the prosecution prove?

For the basic unauthorised access offence, the prosecution must establish three things. 

• First, that the person caused a computer to perform a function with the intention of securing access to a program or data. 
• Second, that the access was unauthorised. 
• Third, that the person knew at the time that the access was unauthorised.

Knowledge is an essential requirement. Recklessness alone is not enough to satisfy the mental element of the offence. 

The intent does not need to be directed at specific data or a particular machine; a general intention to gain unauthorised access is sufficient. 

Browsing files without downloading or altering anything can satisfy the offence. However, simply reading a printed document or looking at information already displayed on a screen, without interacting with the computer, is not covered by this particular offence.

What Counts as Permission to Access a System?

Under the Computer Misuse Act, access is unauthorised where the person is not entitled to control access and has not obtained permission from someone who is entitled to grant it.

Permission must be genuine and must extend to the specific type of access actually carried out. General access to a system does not automatically cover access to every part of it. 

For example, a person authorised to use one section of a database is not thereby authorised to view a different section, even using the same credentials. The important question is whether someone with the authority to grant permission allowed the particular access.

Authorisation may be expressly given or implied through an employee’s role, workplace practice or company policy. However, implied permission also has limits.

Where those limits are unclear, this may be relevant to whether the prosecution can prove that the person knew their access was unauthorised.

Does Having a Password Mean You Are Authorised?

Knowing or possessing a password does not automatically give you legal permission to access a computer system.

A person may hold a password because it was shared informally by a colleague, because they guessed it correctly, because a former employer never changed it after they left, or because they retained it after a role ended. None of these circumstances automatically creates legal authorisation against an unauthorised access allegation. 

For example, if a colleague shares their login details and you use them to view confidential files that neither of you is permitted to access, having a working password does not provide a defence.

What matters is whether someone entitled to grant permission authorised the access.

This distinction is important because people sometimes assume that being technically able to enter a system means they are legally allowed to do so.

Workplace Systems, Shared Accounts and Former Employees

The Computer Misuse Act applies to employees and other people with internal access, not just external hackers.

An employee who deliberately accesses files outside their permitted authority may commit an offence, even when using their own login credentials.

For example, an employee authorised to access their department’s records may exceed their permission by viewing confidential files belonging to another department. The issue is whether their authorisation covered the information they accessed.

Shared accounts can create similar concerns. Using a colleague’s credentials to access information unavailable through your own account does not automatically permit you.

Former employees face particular risks. Permission linked to employment will usually end when the employment relationship ends.

Logging into a former employer’s system using retained credentials may therefore constitute unauthorised access, even if the employer has not changed the password.

What if workplace policy was not clearly explained?

An employee would only be guilty of an unauthorised access offence if the employer had clearly defined the limits of the employee’s authority to access a program or data.

Where an employer has not clearly defined those limits, this is relevant to whether the employee knew their access was unauthorised.

Unclear policies do not automatically create a defence to an unauthorised access charge. 

The court may consider written policies, training, system warnings, instructions from managers and how access was handled in practice.

The key issue remains whether the employee knew that the particular access was unauthorised.

A solicitor can assess whether the evidence supports an argument that the employee genuinely believed permission existed.

Accidental Access and Belief in Permission

The basic unauthorised access offence requires intention and knowledge. A person who genuinely did not know they were accessing a system without permission may lack the required mental element.

For example, opening a restricted file or system through a misdirected click, an autofill error or a technical fault may not satisfy the knowledge requirement if there was no intention to secure access. 

However, the circumstances matter.

If a person who stumbles upon unauthorised access and then continues to browse through the material is unlikely to sustain a credible claim of accidental access.

The moment of initial access may have been unintentional, but continued exploration indicates awareness and intention.

A genuine belief in permission is a related but distinct point in unauthorised access cases. 

If a person genuinely believed they were authorised, for example because a manager told them verbally that access was permitted, this goes to the knowledge element and may undermine the prosecution’s case. 

That belief must be honest, though its credibility will be assessed against all the circumstances. The belief does not need to have been objectively reasonable, but an implausible belief is harder to sustain.

One important precaution is not to log back into the system to gather evidence supporting your explanation.

Doing so without clear permission could create a further allegation.

Instead, preserve any emails, messages or other records already in your possession that explain why you believed access was permitted.

When Unauthorised Access Involves an Alleged Further Offence

Where someone accesses a computer system intending to commit or help commit another serious offence, they may face a more serious charge under the Computer Misuse Act.

This can include situations involving fraud, theft or blackmail, where the intended further offence meets the statutory requirements.

The further offence does not need to have been completed, or even to have been possible at the time of access, for the more serious charge to apply. 

For example, accessing a former partner’s email account to obtain information intended to assist in another unlawful act could engage the more serious offence, even if no information was ultimately used.

The basic unauthorised access offence carries a maximum sentence of two years’ imprisonment on indictment. Unauthorised access with intent to commit or facilitate a qualifying further offence carries a maximum of five years.

Separate offences involving interference with computer systems may carry higher penalties. The reason for accessing the system can therefore affect both the charge and potential sentence.

A solicitor can explain which offence is alleged and whether the evidence supports the required intention.

What to Do if You Are Under Investigation for Unauthorised Access

If the police contact you about a suspected unauthorised access offence, whether by letter, telephone, arrest or a request for a voluntary interview, the most important immediate step is to obtain legal advice before saying anything substantive. Anything said in an interview under caution can be used in evidence.

Preserve any records that are relevant to your position. This includes emails, messages, system access logs, employment contracts, written policies and any communications about what access you were or were not permitted to have. 

These records may be important to demonstrating the scope of any authorisation you believed you had, or to establishing that access was accidental or that a belief in permission was genuine.

Do not log back into any system to retrieve records or to check what you accessed. Even where the purpose is to assist your own defence, accessing the system again without clear authorisation may create additional unauthorised access exposure and would be likely to undermine any argument about innocent original access.

Do not delete, alter or destroy any records, whether or not you believe they are unhelpful. Tampering with potential evidence is a separate and serious matter. 

A solicitor experienced in computer misuse allegations can advise on the investigation, police interviews and any evidence supporting your position.

How a Cyber Crime Solicitor Can Help with an Unauthorised Access Case

A cyber crime solicitor can assess whether the alleged conduct meets the legal requirements of an unauthorised access offence.

This includes reviewing what permission existed, whether the access exceeded that permission and what evidence shows about the person’s knowledge and intention.

Before charges are brought, a solicitor may make representations to the police or CPS about weaknesses in the evidence or whether prosecution is appropriate. If proceedings continue, they can advise on available defences, including accidental access or genuine belief in permission.

They can also consider the relevance of workplace policies, shared credentials and any allegation that the access was intended to assist another offence.

Early advice can help you understand your options before an interview or charging decision.

Speak to our Criminal Defence solicitor for advice about your circumstances and the next steps.