Computer offences in Australia: unauthorised access to and modification of data.

This note sets out the law on computer offences in New South Wales, the Australian Capital Territory and under Commonwealth law: what the offences are, who can be charged, the penalties, and what the prosecution has to prove. The arrest reported this week is the news hook, but the law below is the standing law that applies to everyone.

A word before the law. This is a plain-English account of the legal position. It is not a comment on any person who has been arrested or charged, and any person charged with an offence is presumed innocent until a court finds otherwise. The reason this area matters is that the offences reach ordinary conduct, an ex-partner reading someone's email, an employee copying a company database, a person looking through an account they once shared. The law calls all of it unauthorised access.

What counts as a computer offence in Australia?

The offences are built around three ideas: access, modification and impairment. Access means getting to data held in a computer. Modification means changing, adding or deleting it. Impairment means disrupting data or an electronic communication, for instance a denial of service attack. Each becomes an offence when it is done without authority and the person knows it is not authorised.

Three sets of laws sit side by side. New South Wales uses Part 6 of the Crimes Act 1900 (NSW), sections 308 to 308I. The Commonwealth uses Part 10.7 of the Criminal Code, which applies where a Commonwealth computer, a telecommunications carriage service or a bank is involved. The ACT uses Part 4.2 of the Criminal Code 2002 (ACT). The three schemes are close cousins, because the state and territory laws were written to line up with the Commonwealth model.

Is hacking a crime in Australia?

Yes, though the word hacking does not appear in the legislation. What the public calls hacking, breaking into a system, stealing data, planting malware, is prosecuted as one or more of the access, modification and impairment offences. The offences are written to be neutral about the technology. It does not matter whether the method is a stolen password, a phishing email, a piece of malware or a guessed login. What matters is that the conduct was not authorised and the person knew it.

That design has a wide reach. It catches the outside attacker, but it also catches the insider who was allowed into a system for one purpose and used it for another. An employee with a valid login who copies client data to take to a competitor is a common example. So is a person who uses a partner's saved password to read their messages. Neither fits the popular picture of a hacker, and both can be charged.

What is unauthorised access to restricted data?

This is the base offence, and the one most people are charged with. Restricted data is data held in a computer that is protected by an access control system, such as a password, a PIN or a login. Under section 308H of the Crimes Act 1900 (NSW), it is an offence to cause any unauthorised access to, or modification of, restricted data, knowing the access or change is unauthorised and intending it.

The Commonwealth version is section 478.1 of the Criminal Code, and the ACT version is section 420 of the Criminal Code 2002 (ACT). All three carry a maximum of two years. The offence turns on the access control. If the data was locked behind a password and the person got past that lock without permission, the offence is made out, even if nothing was copied, damaged or shared. Getting in is enough.

What is a serious computer offence?

The serious offences are reserved for conduct that causes real harm or is a step towards another crime. Under section 308C of the Crimes Act 1900 (NSW), access, modification or impairment done with the intent to commit or help commit a serious indictable offence carries the same maximum penalty as that offence. So a person who breaks into a system as part of a fraud faces the penalty for the fraud, not the two-year base penalty.

Two further offences carry ten years. Section 308D covers unauthorised modification of data intending to impair the data, and section 308E covers unauthorised impairment of electronic communication. These are the charges for deleting or corrupting data, or for knocking a system offline. The Commonwealth equivalents are sections 477.1, 477.2 and 477.3 of the Criminal Code, and the ACT equivalents sit in the same Part 4.2, headed by section 415. The most serious cases, and attacks on critical infrastructure, can attract heavier penalties again under separate Commonwealth laws.

Is it an offence to possess hacking tools or malware?

It can be, well before any system is touched. Producing, supplying, obtaining or possessing data, and that includes a program, a script or a set of stolen logins, with the intent to use it to commit a serious computer offence, is itself a crime. In New South Wales it is sections 308F and 308G of the Crimes Act 1900 (NSW). Under the Commonwealth Criminal Code it is sections 478.3 and 478.4. Each carries up to three years.

The catch, and the defence, is the word intent. Owning a security tool is not an offence. Many are used lawfully by IT professionals and researchers every day. The offence needs proof that the person meant to use the data or tool to commit an offence. That is where these cases are won or lost, and why the surrounding material, messages, searches and what a person did with the tool, tends to matter more than the tool itself.

What are the penalties for computer offences in NSW, the ACT and the Commonwealth?

The base offence, unauthorised access to or modification of restricted data, carries two years in all three jurisdictions: section 308H in NSW, section 478.1 for the Commonwealth, and section 420 in the ACT, where it also carries a fine of up to 200 penalty units. The possession and supply offences carry three years. Modification to cause impairment, and impairment of electronic communication, carry ten years. Access with intent to commit a further serious offence carries whatever that offence carries.

A maximum is not a starting point. Most first-time restricted-data matters, where no lasting damage was done, sit at the lower end, and a court has the full range of sentencing options, including a non-conviction order in a suitable case. Where a data breach is tied to fraud, blackmail or the spread of private material, the picture changes, and the matter is treated as far more serious.

What does the prosecution have to prove, and what are the defences?

For the base offence the prosecution must prove three things: that the access, modification or impairment was unauthorised; that the accused knew it was unauthorised; and that the accused meant to do it. Access is authorised if the person was entitled to cause it, so a real question in many cases is whether permission existed, and how far it went. An employee allowed into part of a system may not have been allowed into all of it.

The other common battleground is identity. Linking a device, an account or an IP address to a particular person is not always as simple as it looks, and shared devices, shared passwords and remote access all complicate it. Our note on digital evidence and orders to access a locked phone explains how police gather this material, and our note on encrypted evidence shows how much can turn on its reliability. A genuine belief in a right to access the data can also answer the intent element.

What should you do if police contact you about a computer offence?

Get advice before you answer questions or hand over devices. Computer cases are built on digital evidence, and an account of who did what, given without advice, is hard to take back later. You are not required to take part in a record of interview, and our note on the police interview and your right to silence explains why. If police have a warrant to seize devices, that is a separate question, and there are limits on what you can be made to do.

Whether a computer charge is a summary matter that stays in the Local Court or a serious indictable matter often turns on which section is charged and what harm is alleged. Where a breach is said to be tied to fraud or the sharing of private images, other charges can be laid alongside it, such as fraud or image-based abuse. Our page on computer offences in NSW sets out the framework in more detail. Bring any court attendance notice, warrant or property receipt to your lawyer.

Frequently asked.

Is hacking a crime in Australia?

Yes. Accessing, changing or damaging computer data without authority is a crime in Australia. New South Wales deals with it in Part 6 of the Crimes Act 1900 (NSW), the Commonwealth deals with it in Part 10.7 of the Criminal Code, and the ACT deals with it in Part 4.2 of the Criminal Code 2002 (ACT). The word hacking does not appear in the legislation. The offences are built around unauthorised access to, modification of, or impairment of data and electronic communication.

What is unauthorised access to restricted data?

Restricted data is data held in a computer that is protected by an access control system, such as a password or login. Unauthorised access to or modification of restricted data is an offence under section 308H of the Crimes Act 1900 (NSW), section 478.1 of the Commonwealth Criminal Code, and section 420 of the Criminal Code 2002 (ACT). The prosecution must prove the access or change was unauthorised, that the person knew it was unauthorised, and that they intended it. The maximum penalty is two years.

What is the difference between accessing restricted data and a serious computer offence?

Accessing restricted data under section 308H is the base offence and carries two years. A serious computer offence is access, modification or impairment done with the intent to commit or help commit a further serious indictable offence, for example fraud or blackmail. Under section 308C of the Crimes Act 1900 (NSW), the maximum penalty for that offence is the same as the maximum for the serious offence the person intended to commit.

What are the penalties for computer offences in NSW?

Under the Crimes Act 1900 (NSW): unauthorised access to or modification of restricted data (section 308H) carries a maximum of two years; unauthorised modification of data to cause impairment (section 308D) and unauthorised impairment of electronic communication (section 308E) each carry ten years; possessing or supplying data with intent to commit a serious computer offence (sections 308F and 308G) carries three years; and unauthorised access, modification or impairment with intent to commit a serious indictable offence (section 308C) carries the same penalty as that offence.

What are the Commonwealth computer offences?

Part 10.7 of the Commonwealth Criminal Code, inserted by the Cybercrime Act 2001, applies where a Commonwealth computer or a carriage service is involved. The serious offences in sections 477.1 to 477.3 carry up to ten years, or the penalty for the intended offence. The other offences in sections 478.1 to 478.4 cover unauthorised access to restricted data (two years), impairment of data on a disk or card (two years), and the possession or supply of data intended for use in a computer offence (three years).

Is it an offence to possess hacking software?

It can be. Producing, supplying, obtaining or possessing data, including a program or tool, with the intent to commit or help commit a serious computer offence is itself an offence. It appears in sections 308F and 308G of the Crimes Act 1900 (NSW), sections 478.3 and 478.4 of the Commonwealth Criminal Code, and the equivalent ACT provisions, and carries up to three years. The intent to use the data to commit an offence is the part the prosecution must prove.

What does the prosecution have to prove in a computer offence case?

For the base offence, the prosecution must prove the access, modification or impairment was unauthorised, that the accused knew it was unauthorised, and that the accused meant to do it. Access is authorised if the person was entitled to cause it. Common issues include whether the person had permission, whether they were the one who caused the conduct, and whether the digital evidence linking a device or account to a person is reliable. A genuine belief in a right to access the data can also be relevant.

To speak to a criminal defence lawyer, call Aaron Kernaghan on 0421 717 019.

This article is written by Aaron Kernaghan, criminal defence lawyer at Brady & Associates Lawyers, as at 9 September 2026. It is commentary and reflects the personal opinion of the author only. It is not legal advice, it is not a substitute for advice on your own matter, and it does not purport to be accurate or complete. Any matter referred to may be before the court and any person charged is presumed innocent. For advice on a specific matter, contact Aaron Kernaghan on 0421 717 019 or contact the firm.

More criminal-law commentary by Aaron Kernaghan.

← Back to all news