The Information Commissioner’s Office (ICO) has led the successful prosecution of two individuals for violating the Computer Misuse Act (CMA) 1990 by stealing personal data to make nuisance calls.

Kim Doyle, a former RAC employee, was found guilty of transferring personal data to an accident claims management firm without permission, including road traffic accident data such as names, mobile phone numbers and registration numbers.

An ICO investigation found that Dyle transferred the data she had obtained to William Shaw, the director of TMS, with this data subsequently being used to make nuisance calls. This constituted a breach of the CMA, with Doyle pleading guilty to conspiracy to secure unauthorised access to computer data, and selling unlawfully obtained personal data.

Both Doyle and Shaw, as a result, have each been handed an eight-month prison sentence, suspended for two years.

“People’s data is being accessed without consent and businesses are putting resources into tracking down criminals,” said Mike Shaw, who heads up the UK data regulator’s criminal investigations team.

“Once the data is in the hands of claims management companies, people are subjected to unwanted calls which can in turn lead to fraudulent personal injury claims. Offenders must know that we will use all the tools at our disposal to protect people’s information and prevent it from being used to make nuisance calls.

“This case shows that we can, and will take action, and that could lead to a prison sentence for those responsible.”

This is only the latest in a handful of prosecutions made under the CMA, led by the ICO. In June 2020, for instance, a businesswoman was sentenced for illegally accessing a company’s servers and deleting files months after resigning as a director.

While only a few individuals are prosecuted under the CMA, historical research had found that more than a third of IT workers admitted to violating this legislation. The research from 2016 showed that roughly half of employees surveyed admitted to retaining access to their former employer’s network, while 36% admitted to accessing corporate systems after leaving their roles.

The act itself, however, is widely deemed out-of-date and counterintuitive by many working in the IT sector and in cyber security.

According to research published last year, the 30-year-old legislation is preventing cyber security professionals from doing their jobs. Many, in particular, are worried about whether may be breaking the law while researching vulnerabilities, or investigating threats. Specifically, 40% of those surveyed said the CMA has acted as a barrier to them or their colleagues and has prevented them from proactively safeguarding against breaches.

A coalition of businesses, trade bodies, lawyers and cyber security lobby groups also wrote to the prime minister, Boris Johnson, in June 2020 urging his government to reform the CMA for similar reasons. This group included techUK, F-Secure, McAfee and Trend Micro, among other organisations.

The Criminal Law Reform Now Network (CLRNN) has also reported on the shortcomings of the CMA, claiming in January last year that the legislation is putting critical UK infrastructure at risk.

Four in five UK cyber security professionals are worried about breaking the law due to confusion caused by the ageing Computer Misuse Act (CMA).

The 30-year-old legislation is restricting pen-testers and white hat hackers with strict and often out-dated definitions, according to a survey commissioned by teckUK and the CyberUp Campaign.

The survey, which was circulated between 46 respondents representing 11 organisations and some 25,120 employees, found that the legislation was stifling security teams in the UK, with 80% of respondents saying they have been worried about breaking the law when researching vulnerabilities or investigating cyber threat actors.

Around 40% of those surveyed said the CMA has acted as a barrier to them or their colleagues and had even prevented employees from proactively safeguarding against security breaches. Furthermore, 91% of businesses believed that the law puts UK consultancies at a competitive disadvantage with other countries.

Some of the answers also suggested confusion about what counts as a criminal offence under the CMA. In fact, in only three cyber incident examples - 'web scraping' (74%), 'open source internet scanning' (68%), and 'default credentials in login panels exposed to the internet' (74%) - did respondents reach a reasonable level of consensus.

The Computer Misuse Act was enshrined in 1990, long before the internet became the essential tool for businesses it is today. Although it has been updated a number of times, both techUK and the CyberUp Campaign are calling for the government to open a consultation within the industry to put the law through "rapid modernisation".

"I know from my time in this industry that there are now real concerns among the cyber security community that this law is impeding professionals ability to protect the nation from the ever-evolving range of cyber threats we face, and preventing the sector from establishing its leadership position on the international stage," Conservative MP Ruth Edwards wrote in the report.

"If ever there was going to be a time to prioritise the rapid modernisation of our cyber legislation, it is now, when our reliance on safe, reliable and resilient digital technologies has been brought into stark relief by the coronavirus pandemic."

Of 17,600 reported cases of hacking in the UK only 57 led to prosecution in 2019, according to a new report.

The numbers signify a 12% drop in convictions compared to 65 successful prosecutions the year before, according to legal firm RPC, which said police forces lack the resources to fully investigate all aspects of cyber crime.

Government resources are instead being focused on large scale cyber attacks that are deemed a threat to national security, the firm suggested. As such, small, more niche hacking cases have proved elusive for the UK's police and judicial system.

"Tracking down cybercriminals is a very resource-intensive task," said Richard Breavington, partner at RPC. "Hackers know how to cover their tracks, and doing so is relatively straightforward. Cyber criminals view hacking as a low-risk activity, with virtually zero risk of prosecution."

RPC said that the majority of hacking offences reported in the UK are most likely carried out overseas, making it difficult to identify and pursue attackers who can route attacks through other jurisdictions where co-operation between law enforcement agencies is not always guaranteed.

The results for prosecutions in 2019 will be a concern for the UK government, particularly as the pandemic has seen a rise in smaller hacking scams, such as relatively unsophisticated phishing campaigns.

The RPC report found that only an "extremely small proportion" of the 17,600 cases were able to be tried under the Computer Misuse Act. The legislation was first enshrined in 1990 and, despite regular updates to keep it in line with rapidly advancing digital technologies, many have argued the act provides a confusing framework with ambiguous terminology.

In June, an alliance of businesses and trade groups petitioned the government to scrap the law, largely due to a clause that forces cyber security researchers to seek consent from those they investigate before accessing their systems, effectively preventing work against active criminals.

However, Jake Moore, Eset security specialist and former cyber security advisor for Dorset Police, told IT Pro that more resources for the police and better collaboration with universities and businesses with higher digital skill sets would be a better use of time over ammending legislation.

"It's all well and good stating what is illegal in a misuse act but criminal hackers tend to be fully aware of the law," Moore said. "It's just they chose to carry on regardless in the knowledge of being capable of evading capture."

He argues that hackers are fully aware of the techniques to cover their tracks and evade capture, often making offences largely risk free.

"The labour-intensive nature of a cyber investigation often means that conviction is not possible," he added. "The amount of evidence requested to put criminal hackers behind bars is usually impossible to even locate let alone locating the offender in the first place. This decrease in prosecutions is likely to continue whilst policing remains in its current state."

A coalition of businesses, trade bodies, lawyers and cyber security lobby groups has urged the government to reform laws on cyber crime, which they say are "unfit for purpose".

The alliance has written a letter to the Prime Minister, according to SCUK, urging him to bring forward reforms to the Computer Misuse Act, which is now 30-years-old.

The legislation first came into effect in 1990 after two men hacked into Prince Philip's Prestel account. At the time, the two couldn't be found guilty as no laws on computer hacking existed, so one was created. However, 30-years-on, the law now affects research into cyber crime.

The coalition calling for it to be changed includes NCC Group, F-Secure, techUK, McAfee, Trend Micro and many more. In their letter, they state that section 1 of the Act prohibits the unauthorised access to any programme or data held in any computer and has not kept pace with advances in technology.

"With the advent of modern threat intelligence research, defensive cyber activities often involve the scanning and interrogation of compromised victims and criminals systems to lessen the impact of attacks and prevent future incidents," the letter reads. "In these cases, criminals are obviously very unlikely to explicitly authorise such access."

The reasoning is that the law hampers research into threats and therefore increases the risk to the UK's critical national infrastructure. Those who signed letter suggest the issue is very urgent, highlighting the nation's resilience on secure digital technologies, especially given the impact of the coronavirus.

The letter cites other examples from countries, such as the US and France, and suggests that the UK has fallen behind with its laws on cyber crime.

"This creates an advantage for competing cybersecurity sectors, which could see the UK lose out on as many as 4,000 additional high-skilled jobs by 2023 without reform," said the letter.

A woman has been prosecuted under the Computer Misuse Act (CMA) 1990 for deleting thousands of crucial files from the servers of a company that went into liquidation.

Danielle Bulley, former director of a property marketing firm, was found guilty of gaining unauthorised access to the servers of a new company that was created from its remains and deleting more than 5,000 documents.

The 58-year-old was charged with computer misuse offences and given an 18-month community order and unpaid work requirement when she appeared for sentence at York Crown Court, according to the North Yorkshire Police.

“During our investigation, it became clear that Bulley had left the original company on a bad note, but the deletion of thousands of files containing vital information was catastrophic for the victim. It dealt the new business a blow from which it never recovered,” said detective constable Steven Harris of the Cyber Crime Unit.

“Ex-employees can pose a serious risk to a business because they are familiar with the company’s IT infrastructure and procedures. This can make it easier for them to carry out cyber crimes against their former organisation.

“We encourage businesses to ensure they have policies in place for removing user accounts and changing passwords when an employee leaves an organisation.”

Bulley resigned as a director from the new property marketing business, which was launched using the assets of the old company after it went into liquidation. Several months later she gained access to the new company’s servers and permanently deleted all their data.

The individual who ran the new firm said her actions caused job losses and financial losses of nearly £100,000. The damage to the company was so extensive, he added, that the company could no longer operate and was forced to go under.

The North Yorkshire Police was approached and the Cyber Crimes Unit launched an investigation, with digital forensic investigations showing that company data had been remotely accessed by somebody using Bulley’s IP address.

She was questioned and admitted to deleting the files, which she believe she was entitled to do, though she said she knew so would disrupt the operations of the new company.

Only a handful of people are charged under the CMA 1990 each year, perhaps a few dozen according to the constabulary, and cases often tend to be isolated and localised. One example, from 2018, involves a motor industry employee being sentenced to six months in prison for accessing customer records using his colleague’s login details.

However, an organisation earlier this year branded the legislation as out-of-date and claimed it prevents cyber security professionals from properly doing their jobs. In a report published in January, the Criminal Law Reform Now Network (CLRNN) said the CMA imposed restrictions on journalists and academics investigating cyber threats in the public interest and is in dire need of reform.

The key piece of cyber security legislation in the UK is outdated, inadequate and prevents cyber security professionals from doing their jobs.

With the Computer Misuse Act 1990 (CMA) turning 30 years-old this year, a collective of academics, legal practitioners and experts have branded the piece of legislation a danger to the UK’s general cyber resilience.

The CMA, in particular, is preventing cyber security professionals from carrying out threat intelligence research against cyber criminals and internationally-based hackers, according to a report by the Criminal Law Reform Now Network (CLRNN).

The legislation also imposes restrictions on journalists and academics from researching cyber threats that are in the public interest.

“The Computer Misuse Act is crying out for reform,” said Simon McKay, a barrister specialising in civil liberties and human rights who led the CLRNN research.

“It needs to be future- and technology-proofed to ensure it can meet the challenges of protecting the embedded internet-based culture we all live in and depend on.

“This report delivers a blueprint for the government to use and develop to make the law more effective in policing and prosecuting cybercrime.”

The CMA has been used by law enforcement agencies over the past 30 years to penalise people who attempt to access or modify data on a computer without appropriate authorisation.

Conventionally, this covers the broad scope of malware infections and cyber attacks, as well hacking into systems to obtain information or data for future misuse.

A recent example of a prosecution under the CMA arose in 2018, when a motor industry employee was given a six-month prison sentence for accessing thousands of customers’ personal records without permission.

One of the arguments made by the CLRNN against the CMA in its current form is that it offers a confused legal framework, with outdated and ambiguous terminology, and is too broad in its application. The inappropriate nature of this scope may serve to penalise or deter individuals carrying out cyber research that may benefit the UK’s cyber resilience but could be interpreted as criminal.

The CLRNN report has outlined a host of recommendations for lawmakers to take into account. These include introducing a public interest defence that allows cyber security professionals, journalists and academics to carry out work that could potentially prevent future cyber attacks.

There should also be a set of new targeted guidance for prosecutors, including a laxer sentencing regime for younger offenders, as part of a wider overhaul in the sentencing guidelines.

“The legal case for reform of the Computer Misuse Act 1990 is overwhelming,” said senior lecturer in criminal law at Birmingham Law School and CLRNN’s co-director, Dr John Child."

“Experts from academia, legal practice and industry have collaborated to identify the best route to ensure proper penalties are enforced to enable prosecution of hackers and companies who benefit from their activities, whilst permitting responsible cyber security experts to do their job without fear of prosecution.”

The UK's police forces have disciplined 237 serving officers and members of staff for computer misuse, according to a Freedom of Information (FOI) request.

Six employees have resigned and 11 have been sacked due to failing basic IT best practices.

23 police forces responded to the FOI request made by think tank Parliament Steet. Of those, the Surrey and London Metropolitan police recorded the most disciplinary action over computer misuse.

The offences range from using police systems without legitimate purposes to sharing sensitive information over social media, and raise concerns over the privacy and security standards of the UK's law enforcement.

Over two financial years, the Surrey police force recorded 50 individual cases of IT abuse, with the majority of the incidents relating to misuse of email. The Met recorded 18 disciplinary accounts, with one sacking over the misuse of the Crime Reporting System.

The Met also disciplined four members of staff for misusing social media. Two employees from Hertfordshire's constabulary were reprimanded for the same reason, after taking photos of the force's systems and sharing them via social media.

Three officers each were sacked from both Gwent and Wiltshire forces for using the police databases without lawful access to the information. One member of the Nottinghamshire Police used its system to search for a civil dispute they were involved in.

"Instilling the highest standards of IT best practice in serving officers and operational staff is critical for maintaining the integrity of our police forces," Sheila Flavell, COO of recruitment service FDM Group.

"All too often these incidents arise due to a lack of training or understanding about the need for correctly handling sensitive information. With cyber crime on the rise, it's vital that those tasked with keeping us safe are proficient with technology and acutely aware of the importance of data protection rules."

A former software engineer with Yahoo has pled guilty to hacking into approximately 6,000 user accounts, including those of his friends and colleagues, in order to search for explicit or sexual material.

Reyes Daniel Ruiz, 34, has been accused of hacking into thousands of Yahoo accounts through his work at the company in an attempt to find sexual images and videos from the account holders.

These were accounts primarily belonging to younger women, according to the US Attorney's Office for the Northern District of California.

Ruiz made copies of images and videos he found without permission, and stored the data at his home. He also admitted to taking this a step further and compromising the iCloud, Facebook, Gmail, Dropbox and other online accounts of the victims in order to search for more explicit photos and videos.

"In pleading guilty, Ruiz, a former Yahoo software engineer, admitted to using his access through his work at the company to hack into about 6,000 Yahoo accounts," the US Attorney's Office said.

"Ruiz cracked user passwords, and accessed internal Yahoo systems to compromise the Yahoo accounts.

"After his employer observed the suspicious account activity, Ruiz admitted to destroying the computer and hard drive on which he stored the images."

Ruiz was indicted on 4 April and charged with one count of Computer Intrusion, and one count of Interception of a Wire Communication, pleading guilty to the latter. The maximum penalty for each count is five years in prison and a fine of $250,000.

Although these laws apply in the US only, one piece of legislation that serves as the equivalent in the UK is the Computer Misuse Act 1990, which is designed to prevent information theft from computer systems.

Research from 2016 found that more than a third of employees were routinely violating this law, although not to the extent of Ruiz's offences.

HMRC has issued 92 disciplinary notices to members of staff as a result of computer misuse over the last two years, according to data released as part of a Freedom of Information request.

Covering the years 2017-18 and 2018-19, the results of a Parliament Street think tank (FOI) request showed that the number of disciplinary actions had increased with time, with the most common offence being that of "misuse of email".

Figures specifically detailed the number of first warnings, final warnings and dismissals given to employees relating to misuse of email, computer equipment, telecommunications, social media and other internet services.

The offence that led to the most dismissals was the misuse of computer equipment, resulting in eight dismissals in 17-18 and between one and five in 18-19.

Where results amounted to less than five, the exact figure wasn't issued due to fears that the individual may be identified, an eventuality that could breach GDPR and therefore ommitted under section 40(2) of the Freedom of Information Act 2000.

The most common offence committed over the two financial years was 'misuse of email', resulting in 25 written warnings, including both first and final, being issued by the UK's tax collector to its employees.

There was a sharp rise in social media offences in 18-19, leading to nine written warnings compared to zero in the previous year.

What constitutes "misuse" isn't clearly defined in HMRC's reply to the FOI request, nor is it clear what the specific offences were to warrant each type of disciplinary action.

What's encouraging is that in nearly all areas, except for social media, the number of disciplined offences appeared to decrease or stay the same which indicates that employees might be becoming more aware of how their actions could lead to damaging data breaches.

"Tackling employee misuse of IT systems should be a top priority for all public sector organisations, particularly those which handle the financial data of millions of people," said Christy Wyatt, CEO at Absolute Software.

"This kind of activity often involves individuals abusing access to personal information and in some cases sharing it, leading to a potential data breach. Organisations like HMRC need to adopt an enterprise resilience mindset not only around potential bad employee behaviour, but fortifying their overall security posture and risk management profile."

It also appears that HMRC doesn't have to issue warnings before ordering the dismissal of staff. Taken from the 17-18 figures, the number of written first warnings given to staff was less than the number of issued dismissals for the same offence in the same year.

According to a 2017 report, 74% of enterprise cyber security incidents can be attributed to insider threats such as employees, so having a robust disciplinary framework for public sector IT misuse is in HMRC's best interests.

The threat of data incidents from rogue employees is still as high today as it was in 2017. A report from Deep Secure indicated that more than half of UK employees would be willing to steal and sell company data on to third-parties. A quarter of respondents said they could be swayed for as little as 1,000.

A motor industry employee has been given a six-month prison sentence for accessing customer records without permission in a landmark prosecution led by the Information Commissioner's Office (ICO).

Mustafa Kasim pleaded guilty on one charge of securing unauthorised access to personal data between January and October 2016, and was sentenced to six months under the Computer Misuse Act (CMA) 1990.

Kasim, who worked for accident repair firm Nationwide Accident Repair Services (NARS), accessed the personal data of thousands of customers on the Audatex IT platform using his colleagues' login details.

This is the first time the ICO has led a prosecution charge in 28 years since the Act came into force, and was motivated by a desire to inflict a tougher punishment on Mustafa Kasim than is conventionally handed for data misuse.

"People who think it's worth their while to obtain and disclose personal data without permission should think again," said the ICO's group manager of the criminal investigations team Mike Shaw.

"Although this was a data protection issue, in this case we were able to prosecute beyond data protection laws resulting in a tougher penalty to reflect the nature of the criminal behaviour.

"Members of the public and organisations can be assured that we will push the boundaries and use any tool at our disposal to protect their rights."

Kasim continued to access customers' personal data when he left NARS and started a new job at a different car repair organisation which used the same software. These details included customers' names, phone numbers, as well as vehicle and accident information.

NARS approached the ICO upon receiving increased complaints from customers about receiving nuisance calls.

"Data obtained in these circumstances is a valuable commodity, and there was evidence of customers receiving unwarranted calls from claims management companies causing unnecessary anxiety and distress," Shaw continued.

"The potential reputational damage to affected companies whose data is stolen in this way can be immeasurable. Both Nationwide Accident Repair Services and Audatex have put appropriate technical and organisational measures in place to ensure that this cannot happen again."

Cases such as this, concerning data abuse, are normally prosecuted under Data Protection Act (DPA) 1998, or the EU's General Data Protection Regulation (GDPR) which came into force earlier this year.

However, with the timing of the case rendering GDPR inapplicable, and punishment under the DPA 1998 not deemed severe enough, the ICO opted to prosecute Kasim under different legislation.

In this case, the ICO chose section one of the CMA 1990, which prohibits the use of a computer to intentionally gain access to programmes or data held. This offence carries a maximum prison sentence of two years.

The data regulator said "in appropriate cases" it had the remit to prosecute cases via alternative legislation "to reflect the nature and extent" of offences, and so that the court has "a wider range of penalties available".

"This was an appropriate case to pursue under CMA 1990 because the seriousness of this particular offence, which had a number of aggravating factors, meant that a sentence limited to a fine under the DPA would not have reflected the culpability of the offender," an ICO spokesperson told IT Pro.

The UK's national cyber security body has announced a new categorisation system to classify cyber attacks, in an effort to help intelligence operatives and law enforcement prioritise their response to hacks.

As part of its inaugural CYBERUK security conference, the National Cyber Security Centre (NCSC) yesterday launched the new framework, which comprises six levels of severity, from a minor individual attack all the way up to a catastrophic attack on the UK's national infrastructure.

Upon identifying an attack, the NCSC's incident response teams will use the new framework to classify the attack and allocate the appropriate resources to deal with it based on the severity of the incident.

"This new joint approach, developed in partnership with UK law enforcement, will strengthen the UK's ability to respond to the significant, growing and diverse cyber threats we face," said NCSC director of operations, Paul Chichester. "The new system will offer an improved framework for dealing with incidents, especially as GDPR and the NIS Directive come into force shortly."

Attack categories range from one to six based on impact and severity, with a category six attack defined as a "localised incident" such as an individual being hacked. This level of attack, according to the NCSC, will typically only warrant a direct response from local police, acting in a support capacity.

Responses to more severe attacks - such as a category three "significant incident" - will be led by the NCSC directly, who will be on-hand to provide remote analysis, as well as on-site support.

The highest level of threat is the category one "national cyber emergency". This type of threat - which NCSC head Ciaran Martin has warned the UK will inevitably face sooner or later - is one which attacks critical infrastructure like power grids, utilities or hospitals and leads to "severe economic or social consequences or to loss of life".

In the event of a category one attack, a "coordinated cross-government response" will be spearheaded by COBRA, with NCSC and law enforcement working closely with relevant government departments to offer mitigation and analysis.

The announcement has been welcomed by top law enforcement officials.

National Police Chiefs' council lead for cybercrime, chief constable Peter Goodman, said: "This is a hugely important step forward in joint working between law enforcement and the intelligence agencies.

"Sharing a common lexicon enables a collaborative understanding of risk and severity that will ensure that we provide an effective, joined-up response. This is good news for the safety of our communities, business and individuals."

The new category framework will replace the existing three-tiered structure, and will go into effect immediately.

Picture: Bigstock

Alleged computer hacker Lauri Love today won his High Court appeal against extradition to the US to answer to charges of hacking into the computer systems of the FBI, the US Central Bank and NASA, among others.

Royal Courts of Justice judges ruled this morning that extraditing Love to the US, where he would face three separate trials, would be "oppressive" owing to the 32-year-old's likely determination to commit suicide in a US prison, considering any measures to prevent him from doing so further detrimental to his mental and physical health, with the resulting stress worsening a severe eczema condition he has, which would then impact depression he suffers from.

Instead Lord Chief Justice Lord Burnett and Justice Ouseley permitted his appeal against his extradition, stating it would "not be oppressive" to "prosecute Love in England for the offences".

"The support of his family, in particular, would mean that he would be at far lower a risk of suicide in consequence," they stated. "On the evidence we have seen, his mental and physical condition would survive imprisonment without such significant deterioration, though it would undoubtedly be more problematic for him than for many prisoners."

Love is accused of committing the alleged offences between 2012 and 2013, hacking into and stealing vast amounts of data from the US organisations.

Speaking to the BBC outside the court after the hearing, Love said he was "very thankful for all the support" he had received and hoped he had set a "precedent so this will not happen to people in the future".

The decision comes only three months after more than 70 MPs called on the prime minister to intervene in Love's extradition, writing to the UK attorney general to warn of "potentially fatal consequences" if he stands trial there.

The cross-party group of parliamentarians, including digital minister Matt Hancock, Love's constituency MP, called for the 32-year-old to face trial in the UK.

A Westminster magistrate approved his extradition in September 2016, but Love appealed against it after home secretary Amber Rudd subsequently ordered his extradition last November.

Love, who has Asperger Syndrome, also suffers from severe eczema that is resistant to antibiotics, and has major depression. His parents have constantly stated that they are the only people with whom Love could live, and that they have prevented him from killing himself.

Naomi Colvin, Love's case director at the Courage Foundation, which is providing Love with legal support, said: "This is the result Lauri and his family have spent four years waiting for. This ruling is a massive victory for free expression online, for the fair treatment of neurodiverse people and for those of us who have drawn attention to the dire treatment of hackers and information activists in the United States. This ruling will be taken as a comment on the growing international isolation of the US under the Trump administration, and rightly so.

"I am absolutely thrilled for Lauri, his family, friends, his legal team and all the supporters who have worked so hard to bring us to this point. As we demonstrated at appeal, Lauri was only ever in this position because he had been marked out for unfair, discriminatory and vindictive treatment. With any luck, today's ruling will mean that prosecuting authorities finally start respecting the clear will of the British public: we do not extradite our geeks to face medieval punishment in the United States."

The Crown Prosecution Service is now expected to attempt to prosecute Love in the UK for the alleged offences, and the court said it expected US authorities to provide assistance.

Over a third of IT workers have admitted to accessing corporate systems after they have left a company, potentially breaching the Computer Misuse Act.

According to a survey carried out by Vason Bourne on behalf of Protected Networks, 49 per cent of those surveyed said they had retained access to their former employer's network after leaving the company. Of these, 75 per cent admitted continuing to access the corporate systems, sometimes repeatedly over the course of up to a year.

Furthermore, 57 per cent of businesses involved in the survey noticed that former IT employees still had access, but failed to take action to cut them off.

Keith Maskell, country manager at Protected Networks, criticised the "astonishingly liberal attitude of UK businesses to managing access to data on the corporate network" saying that this lax attitude creates "a serious vulnerability that can be exploited later by hackers".

While this failure to properly manage access rights is a serious oversight on the part of businesses, those still accessing their ex-employer's systems may be breaking the law.

Frank Jennings, a lawyer and partner at Wallace LLP, told IT Pro: "The Computer Misuse Act 1990 ... prohibits unauthorised access to any program or data held in any computer and anyone convicted of this could be liable to pay a fine and could face up to two years in prison.

"If someone accesses their former employer's system with the knowledge or help of their new employer, that could give rise to liability for the new employer under the CMA."

Mark Taylor, a partner with law firm Osborne Clarke, agreed.

"Any criminal liability under the Act would sit primarily sits with the relevant individuals (and not their past employer)," Taylor said.

"However, if an individual is using such access for the benefit of a new employer or at their new employer's behest, then liability may also attach to them. Consequently, new employers should be careful that they are not encouraging or facilitating such access."