White Hat vs. Black Hat: The thin line between a tech career and a criminal record.

White Hat vs. Black Hat: The thin line between a tech career and a criminal record.

When it comes to coding, gaming, and digital systems, young tech enthusiasts often hear about "hacking." But in the tech industry, the community is divided into two main groups: White Hats (the good guys) and Black Hats (the cybercriminals).

The technical skills needed for both are exactly the same. The only differences are authorization, intent, and the law.

As part of our #CyberChoices campaign, we want to look at how a young person's curiosity can accidentally cross the line—and remind everyone about the strict realities of the Computer Misuse Act 1990.

The Two Sides of Hacking

Black Hat Hackers: These individuals exploit security flaws for personal gain, spite, amusement, or financial reward. They break into servers, launch DDoS attacks, or steal data without permission. In the eyes of the law, they are cybercriminals.

White Hat Hackers (Ethical Hackers): These are the cybersecurity experts hired by companies, banks, and governments to find security weaknesses before the bad guys do. They do the exact same type of hacking, but they have written, legal permission to do so.

The Reality: The Computer Misuse Act 1990

Many young people believe that if they don’t steal money or cause permanent damage, they haven't committed a crime. This is a dangerous misconception.

Under the Computer Misuse Act 1990, there are three primary levels of offences that tech-savvy youths frequently trigger:

Section 1: Unauthorised Access

What it is: Simply logging into or accessing a server, system, or someone else's account without explicit permission (even just guessing a friend's password or bypassing a school firewall).
The Penalty: Up to 2 years in prison and an unlimited fine.

Section 2: Unauthorised Access with Intent

What it is: Hacking into a system specifically to commit a secondary crime—such as altering school grades, accessing private exam papers, or stealing personal documents to blackmail someone.
The Penalty: Up to 5 years in prison and an unlimited fine.

Section 3: Unauthorised Acts with Intent to Impair

What it is: Doing something to intentionally break a system, slow down a network, or stop a computer from working. This directly includes downloading "stresser" tools to launch DDoS attacks against a gaming rival, a business, or a school network.
The Penalty: Up to 10 years in prison and an unlimited fine.

Choose the White Hat Path

The National Crime Agency Cyber Choices framework is designed to ensure talented young people don't ruin their lives with a Section 1 or Section 3 conviction.

A criminal record under the Computer Misuse Act can result in seized tech, being banned from internet access, and being barred from major universities and tech corporations.

Alternatively, channelling that exact same energy into becoming a professional White Hat open doors to an incredibly lucrative, high-demand legal career path.

What Parents Can Do

Explain the boundary: Make sure they understand that "intent" doesn't matter if they don't have explicit permission. If they hack a local business "just to show them their security is weak," it is still a Section 1 crime.

Redirect them: Point them toward legal ethical hacking platforms like CyberStart or government-backed coding challenges.

Let's guide their talent safely.

Kind regards

Stephen Blake

Cyber Prevent Officer

#CyberChoices

Reply to this message

Message Sent By
Stephen Blake
(Cheshire Police, Cyber Prevent Officer, Cheshire)