Ransomware is illegal

Ransomware continues to be the most significant, serious and organised cyber crime threat encountered by the UK. Ransomware is malware which locks the victims device and encrypts the data and files stored on that device. Criminals will demand the victim pays a ransom in exchange for decryption and access to their data and files. This crime can have substantial negative effects on victims including effects on organisations share value, reputation and customer confidence.

Writing and selling ransomware falls under Section 3A of the Computer Misuse Act (CMA) (1990) while the individual(s) conducting the attack are subject to Section 3 or 3ZA (depending on the impact).

Please visit www.nomoreransom.org/en/index.html to find out more.

Helping you choose the

right and legal path.

The Cyber Choices programme was created to help people make informed choices and to use their cyber skills in a legal way.

This is a national programme co-ordinated by the National Crime Agency and delivered by Cyber Choices teams within Regional Organised Crime Units and Local Police Force Cyber Teams.

The aims of the programme are:

Explaining the difference between legal and illegal cyber activity
Encouraging individuals to make informed choices in their use of technology
Increasing awareness of the Computer Misuse Act 1990
Promoting positive, legal cyber opportunities

What you need to know

Cyber offences are committed when someone is using a computer or other digital technology. There are two main types of cyber offences - cyber-enabled crime and cyber-dependent crime. Cyber-enabled crime is where technology has been used to enhance another crime, like fraud. Cyber Choices deals with cyber-dependent crimes which are offences that can only be committed through the use of technology, where the devices are both the tool for committing the crime and the target of the crime.

The Computer Misuse Act 1990 outlines the law around cyber-dependent crime. Examples of this legislation include:

Section 1

Unauthorised access to computer material.

Adam watches a friend entering their username and password. Adam remembers their login details and without their permission, later logs in and reads all their messages.

Section 2

Unauthorised access with intent to commit or facilitate commission of further offences.

Raj’s teacher leaves their tablet on their desk. Without their permission, Raj accesses their online shopping account and buys items with the attached credit card.

Section 3

Unauthorised acts with intent to impair, or with recklessness as to impairing, operation of a computer.

Sarah is playing an online game with a friend who scores higher than her. Sarah uses a 'Booter' tool knowing it will knock them offline, so she can win the game.

Section 3ZA

Unauthorised acts causing, or creating risk of, serious damage.

Kim hacks a phone company. This hack stops some people phoning the Police when they are in danger. They didn’t mean for this to happen but they were reckless.

Section 3A

Making, supplying or obtaining articles for use in offence under Sections 1, 3 or 3ZA.

Robin downloads software so they can bypass login credentials and hack into a friend’s laptop, however they’ve not had a chance to use it yet.

For young people

Those with a real interest in how tech works could have a bright future ahead. Skills in coding, gaming, cyber security or anything digital-related, are in high demand, not just in the UK but also abroad which means that young people may have an opportunity to travel to interesting places whilst learning new cyber skills.

Unfortunately, the digital world can also be tempting for young people for the wrong reasons. Many are getting involved in cyber crime without realising that they are breaking the law. This can have serious consequences for someone’s broader future and not just their career.