Computer Misuse and Anti-Hacking Laws Guide: How UK, US, EU and Treaty Rules Compare

Security work routinely touches systems the practitioner does not own, and the same act can be a contracted test in one country and a criminal offence in another. Computer misuse laws decide whether a penetration test, a vulnerability probe, a threat intelligence crawl or an incident responder's "hack back" is lawful, and they differ on the points that matter most: what counts as authorisation, whether recklessness is enough, and whether tools are themselves illegal. This guide compares the UK Computer Misuse Act 1990, the US Computer Fraud and Abuse Act, EU Directive 2013/40/EU with a national example from Germany, and the two international treaties, then turns the comparison into working rules for testers, researchers and responders. It is written for security leaders, red teams, bug bounty and vulnerability disclosure owners, and incident responders. For each law in depth, see the UK Computer Misuse Act Guide and the US Computer Fraud and Abuse Act Guide.

Status: legal texts checked against the official sources listed below on 27 October 2026. Laws and prosecution policies change; confirm the current text before relying on any point.

Key takeaways

• Authorisation is the whole game. Every regime here turns on access or acts "without authorisation", so written permission from someone entitled to give it is the main legal control a security team has.
• The UK offence is broad and needs no security barrier. CMA section 1 is committed by knowingly unauthorised access to any program or data, while EU Directive 2013/40/EU and German law require that a security measure is overcome.
• The US narrowed "exceeds authorized access" in 2021. Van Buren v United States reads it as entering areas of a computer that are off-limits, not misusing data you are allowed to see, and the DOJ's May 2022 policy says good-faith security research should not be charged.
• Tool offences are intent based but not risk free. CMA section 3A covers supplying an article "believing that it is likely to be used" for an offence, so distributing dual-use tools needs care even where possession for testing is lawful.
• Hacking back is not a defence anywhere covered here. None of the texts gives victims a right to access an attacker's systems; responders should preserve evidence and use law enforcement and provider channels instead.

The laws at a glance

The table compares the core unauthorised access and interference offences. Penalties are the maxima stated in each text; national sentencing practice is usually far lower.

United Kingdom: Computer Misuse Act 1990

The CMA is short and broad. Its offences are cumulative layers on top of a simple access offence.

• Section 1, unauthorised access: the person causes a computer to perform any function intending to secure access to a program or data, the access is unauthorised and they know it. No security measure needs to be bypassed and no harm needs to follow. Trying a default password on a device you were not asked to test can meet the definition.
• Section 2, ulterior intent: section 1 access with intent to commit or facilitate the commission of further offences, such as fraud.
• Section 3, impairment: any unauthorised act done with intent to impair a computer, or reckless as to whether it does. Recklessness matters for testers: a scan that knocks over a fragile production system without authority falls in scope even if disruption was not the aim. Maximum ten years on indictment.
• Section 3ZA, serious damage: inserted by the Serious Crime Act 2015 from 3 May 2015. Up to 14 years, and life where the act causes or creates a significant risk of serious damage to national security, or loss of life, illness or injury.
• Section 3A, articles: making, adapting, supplying or offering any article intending it to be used for an offence, supplying it "believing that it is likely to be used" for one, or obtaining it for that use. The belief limb is what concerns researchers who publish exploit code or tooling.
• Territorial reach: sections 4 and 5 apply the Act where there is a significant link with the UK, such as the accused or the target computer being in the UK.

There is no statutory public interest or security research defence in the Act text as checked. The Home Office ran a call for information from 11 May to 8 June 2021 and published a response on 7 February 2023; treat reform as pending until legislation is passed. See the UK Computer Misuse Act Guide.

United States: Computer Fraud and Abuse Act

18 U.S.C. 1030 is both a criminal statute and a civil cause of action, which is why it appears in employment, scraping and competitor disputes as well as hacking prosecutions.

• Two access concepts: "without authorization" (no permission at all) and "exceeds authorized access", defined in (e)(6) as accessing with authorisation and using that access to obtain or alter information the person is not entitled to obtain or alter.
• Protected computer: under (e)(2) this includes any computer used in or affecting interstate or foreign commerce or communication, which in practice covers almost any internet-connected system.
• Van Buren v United States (3 June 2021, 6-3): the Supreme Court held that a person exceeds authorised access when they enter particular areas of a computer, such as files or databases, that are off-limits to them. Misusing information from an area you are permitted to access does not, by itself, meet the definition. Purpose-based workplace policies alone are therefore a weaker basis for CFAA claims than technical or contractual access boundaries.
• Civil action, subsection (g): anyone who suffers damage or loss may sue if one of the (c)(4)(A)(i) factors applies, most often loss of at least 5,000 US dollars in a one-year period. Actions must begin within two years of the act or the discovery of the damage.
• DOJ charging policy (19 May 2022): good-faith security research, meaning access solely for good-faith testing, investigation or correction of a security flaw in a way designed to avoid harm, should not be charged. Prosecutors must consult the Criminal Division's Computer Crime and Intellectual Property Section, and the policy says claimed research is no shield for bad-faith conduct such as extortion. It binds federal prosecutors only; it does not stop civil suits or state charges.

See the US Computer Fraud and Abuse Act Guide for the full offence list and case law.

European Union and member states

Directive 2013/40/EU on attacks against information systems set minimum rules that Member States had to transpose by 4 September 2015. Because it is a directive, the offence you can be charged with is always the national one.

• Security measure threshold: Article 3 requires illegal access "by infringing a security measure". German StGB 202a similarly requires that the data are specially secured and that the access protection is overcome. Accessing an openly exposed bucket may fall outside these offences where the UK section 1 offence could still apply, though data protection and other laws may still bite.
• Authorised testing and contractual breaches: recital 17 says there is no criminal liability where criminal intent is absent, giving the example of a person mandated by a company to test its security, and that breaching terms of service or workplace use rules should not, on that basis alone, be criminal.
• Minor cases: Articles 3 to 7 apply at least to cases which are not minor; recital 11 leaves the definition of minor to Member States.
• Tools: Article 7 covers tools designed or adapted primarily for an offence, with intent. Recital 16 confirms that tools produced for legitimate purposes, such as testing, are not to be criminalised on their nature alone. Germany's 202c covers programs whose purpose is the commission of an offence, with a maximum of two years.

NIS2 adds a separate obligation on Member States to run coordinated vulnerability disclosure through a designated CSIRT, which interacts with these offences in practice. See the NIS2 Directive Guide.

International treaties

• Budapest Convention on Cybercrime (ETS 185): opened for signature in Budapest on 23 November 2001. Articles 2 to 6 define illegal access, illegal interception, data interference, system interference and misuse of devices, and Article 6(2) states the devices offence does not apply where production or possession is for purposes such as authorised testing or protection of a computer system. It has additional protocols and an Article 35 24/7 network for urgent cooperation, and states outside Europe may accede under Article 37.
• UN Convention against Cybercrime: adopted by the UN General Assembly on 24 December 2024, opened for signature in Hanoi on 25 October 2025 and open at UN Headquarters until 31 December 2026. It enters into force once 40 States have become Parties; check the UN Treaty Collection for current status.
• What treaties mean for practitioners: they harmonise offence definitions and speed up evidence requests and extradition. They do not replace national law and do not authorise anything a national law forbids.

See the Budapest Convention and UN Cybercrime Convention Guide.

Security activities mapped to legal risk

The same activity carries different risk depending on authorisation and where the target sits. This table is a practitioner risk view, not a legal opinion.

Building authorisation that holds up

Because authorisation is the deciding fact, treat it as a controlled document, not an email thread.

1. Confirm the signatory is entitled to authorise. A business unit lead cannot authorise testing of a supplier's platform. For cloud and SaaS targets, check the provider's own penetration testing policy.
2. Define scope technically. List hostnames, IP ranges, account IDs, applications and excluded assets. State test windows, permitted techniques (for example, no denial of service, no social engineering of named staff) and data handling limits.
3. Name people and identities. Record the testers and the accounts, API keys and source IPs they will use, so the SOC can distinguish the test from an attack and so test credentials can be revoked at the end. See the Red Team Rules of Engagement Template.
4. Add a stop and escalation rule. Testers stop and report if they reach data or systems outside scope, including third parties reached through trust relationships.
5. Cover cross-border targets. Where testers or targets sit in several countries, take legal advice on each, since the UK and US both claim jurisdiction where the target is located in their territory.
6. Close down cleanly. Revoke test accounts and keys, remove implants and record what was accessed. See the Penetration Test Scoping Checklist.

For outside researchers, a vulnerability disclosure policy is the authorisation mechanism. Its safe harbour clause should say what testing is authorised, what is not (data exfiltration beyond proof, persistence, denial of service), and that the organisation will not pursue legal action for good-faith research within those limits. See the Vulnerability Disclosure Policy Template and the Bug Bounty and Vulnerability Disclosure Guide.

Where identity fits

Most real computer misuse cases involve credentials rather than exploits. Using a colleague's password, a leaked API key or a former employer's still-active service account is unauthorised access, even if the credential works. Two practical consequences follow. First, organisations that fail to revoke leaver and vendor credentials make prosecution harder, because evidence of what access was permitted becomes muddy; clean offboarding records support any later case. Second, testers must never use credentials found during a test against systems outside scope. See the Employee Offboarding Security Guide.

Framework mapping

Common failure patterns

• Authorisation from the wrong person: a client signs off testing of assets hosted by a third party it cannot authorise, leaving testers exposed to that third party.
• Scope drift during a test: credentials found in scope are tried against a supplier portal or a partner tenant. The test becomes unauthorised access at that moment.
• Assuming a bounty covers everything: researchers test assets outside the published programme scope, or keep data beyond what proof requires.
• Relying on US policy abroad: the DOJ good-faith research policy protects nothing in the UK or the EU, and does not prevent civil CFAA suits.
• Hack back after an incident: responders log into attacker infrastructure or a compromised intermediary to recover data, exposing themselves to the same offences.
• No record of permitted access: organisations cannot show what an insider or vendor was allowed to reach, weakening any criminal or civil claim.

Practitioner checklist

• Keep a register of the computer misuse laws that apply to each country where you test, operate or hold targets.
• Require signed scope and rules of engagement from an entitled signatory before any test, including internal red teams.
• Check cloud, SaaS and hosting provider testing policies for every third-party hosted target.
• Publish a vulnerability disclosure policy with clear scope and safe harbour wording, and route reports to a named owner.
• Record test identities, keys and source IPs, share them with the SOC and revoke them at close.
• Ban use of leaked or found credentials outside scope, and ban hack back in the incident response plan.
• Review tool and exploit publication against the UK s3A belief limb and equivalent national provisions.
• Take legal advice for cross-border testing and for any civil CFAA exposure in the US.
• Recheck the status of UK CMA reform and the UN Convention at least annually.

Standards and references

• legislation.gov.uk: Computer Misuse Act 1990
• Cornell Law School LII: 18 U.S. Code 1030, Fraud and related activity in connection with computers
• US Department of Justice: New policy for charging cases under the Computer Fraud and Abuse Act
• Supreme Court of the United States: Van Buren v. United States
• EUR-Lex: Directive 2013/40/EU on attacks against information systems
• Council of Europe: Convention on Cybercrime (ETS No. 185)
• UNODC: United Nations Convention against Cybercrime
• Gesetze im Internet: Strafgesetzbuch section 202a

Related NHI Mgmt Group resources: Regulations and Frameworks Guide · UK Computer Misuse Act Guide · US Computer Fraud and Abuse Act Guide · Budapest Convention and UN Cybercrime Convention Guide · Penetration Testing Guide. This guide summarises computer misuse laws in the UK, US, EU and international treaties and is not legal advice.