0

I am studying towards a qualification called CREST CPSA, reading through their syllabus guide here. It covers some sections on Law that I was hoping to clarify on here.

On PDF page 6/20 it covers the following:

Knowledge of pertinent UK legal issues:
• Computer Misuse Act 1990
• Human Rights Act 1998
• Data Protection Act 1998
• Police and Justice Act 2006
Impact of this legislation on penetration testing
activities.
Awareness of sector-specific regulatory issues.

I had not previously heard of the Police and Justice Act 2006, and after doing some digging online I could not understand the difference between that and the Computer Misuse Act 1990.

They both seem to cover computer crimes, albeit one has a slightly lower maximum sentence...

Improve this question

1 Answer 1

Reset to default
3

Part of the 2006 Act (sections 35-38) amends the 1990 Act. You can read more about the effect and purpose of the changes in the explanatory notes. Some particular highlights:

  • The changes were made to reflect EU law, a Framework Decision of 2005 on information security, and to be compatible with a Council of Europe agreement on the same topic.
  • There is extra coverage to make sure it is an offense to do something to enable unauthorized access at a later date, or by someone else.
  • There is also extra coverage to catch denial-of-service attacks.
  • There is a new offense for creating hacking tools, as opposed to doing any actual hacking with them. This also covers distribution of lists of login credentials and the like.

These reflect the changed landscape of computer security now that we have more pervasive Internet connectivity than in 1990, and a generally more sophisticated marketplace for computer crime.

Improve this answer
1
  • 1
    You might want to add this paragraph to your answer, as it covers hacking software used for legitimate purposes: Prosecutors should be aware that there is a legitimate industry concerned with the security of computer systems that generates 'articles' (this includes any program or data held in electronic form) to test and/or audit hardware and software. Some articles will therefore have a dual use and prosecutors need to ascertain that the suspect has a criminal intent. Guidelines: cps.gov.uk/legal/a_to_c/computer_misuse_act_1990/#an10
    – questioner
    Apr 9, 2022 at 15:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .