In brief. Cybercrime covers any criminal offence committed through, or directed against, a computer system or digital network. In the United Kingdom it is regulated by the Computer Misuse Act 1990 and subsequent amendments, while at international level the Council of Europe Budapest Convention sets the standard for cross-border cooperation. The law firm ILA assists individuals and corporations in cross-jurisdictional cybercrime proceedings.

ILA is an Italian criminal-defence firm. This guide outlines UK rules for reference; we assist English-speaking clients whose case has an Italian dimension — extradition to or from Italy, Interpol Red Notices and cross-border proceedings — alongside local counsel abroad.

In short

  • Cybercrime is regulated in the UK primarily by the Computer Misuse Act 1990 (CMA 1990)
  • It includes unauthorised access, system interference, data interference, fraud by digital means and misuse of devices
  • Cybercrime investigation involves the National Crime Agency (NCA) and the Crown Prosecution Service (CPS)
  • Cross-border cases rely on the Budapest Convention and mutual legal assistance treaties (MLATs)
  • Penalties under the CMA 1990 range from fines to up to life imprisonment for the most serious offences

What is cybercrime: a working definition

Cybercrime is any criminal conduct that uses information technology as the instrument of the offence or as its target. The category includes computer-dependent crimes — such as hacking, denial-of-service attacks and the deployment of malware — and computer-enabled crimes — such as online fraud, phishing, identity theft and cyber-stalking. The distinction matters because it affects which statute applies and which investigating body takes the lead.

In the UK, the principal statute is the Computer Misuse Act 1990, as amended by the Police and Justice Act 2006 and the Serious Crime Act 2015. Its key offences are:

  • Section 1: unauthorised access to computer material
  • Section 2: unauthorised access with intent to commit further offences
  • Section 3: unauthorised acts impairing the operation of a computer
  • Section 3ZA: unauthorised acts causing or creating risk of serious damage
  • Section 3A: making, supplying or obtaining articles for use in computer misuse offences

Related offences fall under the Fraud Act 2006 (fraud by false representation, section 2) and the Data Protection Act 2018. At European level, the Budapest Convention on Cybercrime (2001) and Directive 2013/40/EU on attacks against information systems provide the cooperation framework. International cases routinely engage the European Investigation Order regime where applicable and bilateral MLATs.

How cybercrime investigations work in the UK

Cybercrime investigations in the UK are coordinated by the National Cyber Crime Unit (NCCU) inside the National Crime Agency, with regional support from the Regional Organised Crime Units (ROCUs) and local police cybercrime teams. The CPS leads on prosecutions. A typical investigation moves through: (i) intelligence gathering and victim reporting (often via Action Fraud); (ii) preservation of digital evidence under chain-of-custody rules; (iii) forensic imaging of devices; (iv) attribution analysis through IP tracing, blockchain analytics, or open-source intelligence; (v) arrest and charge; (vi) trial in the Crown Court for indictable offences.

For suspects located abroad, the UK authorities issue international cooperation requests under MLAT, the Budapest Convention or — for serious offences — extradition requests. ILA assists clients facing UK-originated cybercrime investigations from foreign jurisdictions, coordinating local counsel and overseeing the extradition process.

Examples of cybercrime

The catalogue of cybercrime is broad and evolves with the technology. The most frequent categories observed in international practice are:

  • Hacking and unauthorised access — gaining entry to a corporate network without authorisation, typically prosecuted under section 1 CMA 1990
  • Ransomware attacks — encryption of victim data combined with extortion demands
  • Business email compromise (BEC) — impersonation of executives to authorise fraudulent wire transfers
  • Phishing and identity theft — harvesting credentials to access bank accounts or commit fraud
  • Cryptocurrency-related fraud — investment scams, rug pulls and money-laundering through digital assets
  • Online sexual offences — distribution of indecent imagery, grooming, sextortion

Each carries distinct evidential challenges. Our cybercrime guide explores classification in greater depth.

Cybercrime and cross-border defence

Most serious cybercrime is by nature international. A suspect resident in country A may use infrastructure in country B to target victims in country C. This creates jurisdictional competition: under section 4 CMA 1990 the UK asserts jurisdiction if there is at least one “significant link” with the home country (e.g. the accused was in the UK at the time of the act, or the target computer was in the UK). Clients are therefore exposed to parallel proceedings in multiple jurisdictions, and to extradition requests from the UK or from non-EU states.

ILA coordinates the defence strategy across jurisdictions: challenging jurisdiction where possible, contesting extradition on human-rights or specialty grounds, and managing parallel proceedings to avoid duplication of penalties. See our cybercrime definition entry for the conceptual map of the offences involved and the related in-depth guide: online fraud for the overlap with online fraud.

Case examples (anonymised)

(Illustrative examples of typical situations: they do not refer to specific proceedings or to clients of the firm.)

Case 1 — corporate hacking with UK link. A non-UK resident engineer is investigated by the NCCU for alleged unauthorised access to a UK-based fintech, and the CPS considers charges under sections 1 and 3 CMA 1990. Defence work can focus on challenging the attribution evidence and the “significant link” with the UK under section 4.

Case 2 — extradition in a cross-border ransomware case. A foreign national faces an extradition request connected to a ransomware operation said to have affected suppliers in the healthcare sector. Possible lines of defence, pursued with corresponding counsel, include prison-conditions grounds and the proportionality of the request under the Extradition Act 2003, supported by objective evidence on detention conditions in the requesting State. Such matters turn on a fact-specific assessment of fundamental-rights risks and show how cybercrime increasingly plays out in the extradition arena, where the defence operates across more than one jurisdiction at once.

FAQ

What is the difference between cybercrime and computer crime? The two terms are often used interchangeably. “Cybercrime” is the broader umbrella covering any offence that uses a computer system or network as instrument or target; “computer crime” typically refers narrowly to offences against a computer system, such as those listed in the CMA 1990.

Which UK authority investigates cybercrime? The National Crime Agency, through the National Cyber Crime Unit, leads on the most serious cases. Lower-level offences are handled by regional units and local forces. Action Fraud is the national reporting centre for victims.

Can the UK extradite a cybercrime suspect from abroad? Yes. The UK can request extradition under the Extradition Act 2003 and bilateral treaties. For EU Member States the surrender regime is governed by the post-Brexit Trade and Cooperation Agreement.

Is hacking always a criminal offence? Unauthorised access is criminal under section 1 CMA 1990 regardless of intent to cause harm or financial gain. Authorised testing (e.g. under a written engagement letter with the system owner) is not an offence.

What penalties does the Computer Misuse Act 1990 provide? Section 1 carries up to two years’ imprisonment on indictment; section 2 up to five years; section 3 up to ten years; section 3A up to two years; section 3ZA — for acts causing or creating a significant risk of serious damage — up to fourteen years, or life imprisonment where the damage is to human welfare or national security.

Read also: our what is cybercrime primer.

About ILA

International Lawyers Associates is an international criminal-law firm with offices in Naples, Milan and Rome, directed by Avv. Alexandro Tirelli. The firm assists individuals and corporations in cross-border criminal proceedings, including cybercrime, extradition, money laundering and international cooperation.

Contact ILA | Our offices