# What is Cyber Choices, and when should a school refer a pupil?

Source page: https://pupilprotect.co.uk/guides/cyber-choices-youth-cybercrime  
Last updated: 2026-10-20  
Publisher: Pupil Protect (Glacier Labs Ltd)

> Cyber Choices is a national police prevention programme led by the National Crime Agency (NCA) and delivered by regional and local police cyber teams. It works with young people who are at risk of committing, or being drawn into, low-level offences under the Computer Misuse Act 1990, such as hacking or knocking people offline, and steers them towards legal uses of their skills. Keeping children safe in education 2026 says the DSL should consider a referral when there are concerns about a child in this area (Annex A). DSLs refer through their local Cyber Choices team.

## What KCSIE 2026 says

Keeping children safe in education (KCSIE) 2026 has a section on cybercrime in Annex A. Annex C says it was expanded this year with "detail on CMA offences and national risks". It says:

- Cybercrime is either **cyber-enabled**, meaning crimes that can happen offline but are made faster and bigger online, or **cyber-dependent**, meaning crimes that can only be committed using a computer.
- Offences under the Computer Misuse Act 1990 "have risen substantially", and young people "experiment with illegal online activity, often without understanding the legal or ethical implications".
- "Children with particular skills and interest in computing and technology may inadvertently or deliberately stray into cyber-dependent crime."
- "If there are concerns about a child in this area, the designated safeguarding lead (or a deputy), should consider referring into the Cyber Choices programme."

KCSIE's examples are close to home: accessing "a school's computer network to look for test paper answers or change grades", denial of service attacks or "booting", and making or getting malware.

## The Computer Misuse Act 1990

| Section | Offence | Example (from the NCA) | Maximum on indictment |
|---|---|---|---|
| 1 | Unauthorised access to computer material | Logging into a friend's account with a password you saw them type | 2 years |
| 2 | Unauthorised access with intent to commit a further offence | Using a teacher's tablet to buy things with their saved card | 5 years |
| 3 | Unauthorised acts to impair a computer, or reckless as to that | Using a "booter" to knock another gamer offline | 10 years |
| 3ZA | Unauthorised acts causing, or risking, serious damage | A hack that stops people calling the police | 14 years, or life in the most serious cases |
| 3A | Making, supplying or obtaining tools for offences under sections 1, 3 or 3ZA | Downloading software to get past someone's login | 2 years |

What these offences have in common is that the access or act is **unauthorised**, and the person knows it is. Curiosity is not a defence. A pupil who uses a teacher's password "to see if it works" may have committed a section 1 offence.

The NCA warns that young people who commit cybercrime can face a police visit and warning, having their devices seized, arrest, a criminal record, and restrictions on travel and careers.

## What Cyber Choices does

Cyber Choices is coordinated by the National Crime Agency and delivered by Cyber Choices teams in Regional Organised Crime Units and local police force cyber teams. KCSIE describes it as "a nationwide preventative police programme supported by the Home Office". Its aims are to:

- explain the difference between legal and illegal cyber activity
- encourage young people to make informed choices about technology
- raise awareness of the Computer Misuse Act 1990
- promote legal cyber opportunities

KCSIE says it aims to intervene "where young people are at risk of committing, or being drawn into, low-level cyber-dependent offences and divert them to a more positive use of their skills and interests". The NCA's case studies include a pupil caught hacking a school's IT systems who went on to paid work experience in cyber security. Another pupil, facing permanent exclusion for bypassing school controls, went on to help the IT team find weaknesses in the network.

### What it doesn't cover

KCSIE is clear that Cyber Choices "does not currently cover 'cyber-enabled' crime such as fraud, purchasing of illegal drugs on-line and child sexual abuse and exploitation, nor other areas of concern such as on-line bullying or general on-line safety". Those go through your normal safeguarding procedures.

## What staff might notice

Neither KCSIE nor the NCA gives a checklist of signs. The offences above suggest what to look for:

- a pupil getting round the school's filtering or device controls
- using someone else's login, or having other people's passwords
- talking about "booting" or knocking other players offline
- downloading hacking tools or malware, or offering them to others
- changes to school data, accounts or grades that can't be explained

A strong interest in computing is not a concern. The NCA encourages schools to support it and point pupils towards legal routes into cyber careers. Report a concern to the DSL in the usual way, and record what you saw.

## How to refer

1. **The DSL decides.** Staff pass concerns to the DSL or a deputy. The DSL considers whether there is a wider safeguarding issue, such as someone else pressuring or paying the pupil to offend.
2. **Contact your local Cyber Choices team.** The NCA website has a map that lists contact details for each area. General questions go to the national team at cyberchoices@nca.gov.uk.
3. **Tell the pupil and family what is happening,** unless that would put the child at risk.
4. **Record the referral** and the outcome on the pupil's safeguarding record.

The NCA notes that information given to Cyber Choices is held in confidence, but may be passed to partners if criminal offences or risks of harm are reported.

## If the school is the victim

If a pupil has attacked the school's own systems, there are two jobs: protect the school and support the pupil.

- Follow the DfE's **cyber security standards** and your incident plan, and tell your IT provider.
- If an organisation is suffering a live cyber attack, the NCA says to call Report Fraud on 0300 123 2040. Report other cybercrime to Report Fraud, and other non-urgent crime to the police on 101. In an emergency, call 999.
- KCSIE also points to the National Police Chiefs' Council guidance, *When to call the police*.
- Any sanction must follow the behaviour policy. If exclusion is considered, see our guide to [suspensions and exclusions](https://pupilprotect.co.uk/glossary/exclusion). A Cyber Choices referral can sit alongside a sanction.

## Questions

**What is the Cyber Choices programme?**  
A nationwide police prevention programme, coordinated by the National Crime Agency and delivered by Cyber Choices teams in Regional Organised Crime Units and local police force cyber teams. It works with young people at risk of committing low-level cyber-dependent offences, explains the Computer Misuse Act 1990 and the difference between legal and illegal activity, and points them towards legal opportunities to use their skills.

**What is not covered by Cyber Choices programme?**  
KCSIE 2026 says Cyber Choices doesn't currently cover cyber-enabled crime such as fraud, buying illegal drugs online, or child sexual abuse and exploitation. It also doesn't cover online bullying or general online safety. Those concerns go through the school's usual safeguarding routes.

**What is the Computer Misuse Act?**  
The Computer Misuse Act 1990 is the UK law on cyber-dependent crime. Its main offences are unauthorised access to computer material (section 1), unauthorised access with intent to commit further offences (section 2), unauthorised acts that impair a computer, such as denial of service attacks (section 3), acts causing serious damage (section 3ZA), and making, supplying or obtaining tools for these offences (section 3A).

**Is ethical hacking illegal in the UK?**  
Testing a system's security with the owner's permission isn't an offence under the Computer Misuse Act, because the offences turn on access or acts being unauthorised. Accessing or testing a system without permission, including the school network or a friend's account, can be an offence even if nothing is damaged. Cyber Choices points young people to legal practice platforms and careers instead.

## Sources

- [Keeping children safe in education 2026 (DfE, statutory guidance, in force from 1 September 2026): Annex A, 'Cybercrime', and Annex C, summary of changes](https://assets.publishing.service.gov.uk/media/6ac3c09c11ed58342ad8e4ac/Keeping_children_safe_in_education_2026.pdf), checked 2026-10-20
- [Cyber Choices (National Crime Agency)](https://www.nationalcrimeagency.gov.uk/cyber-choices), checked 2026-10-20
- [Computer Misuse Act 1990, sections 1 to 3A (legislation.gov.uk)](https://www.legislation.gov.uk/ukpga/1990/18/contents), checked 2026-10-20
- [Cyber security: core standard (DfE, Meeting digital and technology standards, updated 16 September 2026)](https://www.gov.uk/guidance/meeting-digital-and-technology-standards-in-schools-and-colleges/cyber-security-core-standard), checked 2026-10-20

## Related

- [Filtering and monitoring in schools](https://pupilprotect.co.uk/glossary/filtering-and-monitoring)
- [Online safety lead role](https://pupilprotect.co.uk/guides/online-safety-lead-role)
- [Suspensions and exclusions guidance](https://pupilprotect.co.uk/glossary/exclusion)
- [Child criminal exploitation and county lines](https://pupilprotect.co.uk/glossary/cce)
- [Safeguarding concern form](https://pupilprotect.co.uk/tools/safeguarding-concern-form)
- [Safeguarding and DSL jobs](https://pupilprotect.co.uk/jobs/role/safeguarding)

## In Pupil Protect

Pupil Protect Safeguard keeps every concern, action, meeting and referral on one chronology for each child, so when an inspector samples a case, the DSL can show what happened and why, in order. [See the chronology in Safeguard](https://pupilprotect.co.uk/safeguard)