Following the sentencing of two young men for the 2024 Transport for London (TfL) hack, senior police officers have said the case makes a compelling argument for tougher legal powers in the UK, namely Cybercrime Risk Orders (CCROs).
Owen Flowers, 19, and Thalha Jubair, 20, were sentenced to five and a half years in prison each for committing unauthorised acts against TfL under Section 3ZA the UK’s Computer Misuse Act (CMA) 1990.
Both men are believed to be part of Scattered Spider, a cybercriminal group that has been linked to major cyber-attacks over the past few years, including the Marks & Spencer and Co-op incidents in 2025.
Read now: M&S and Co-op Hacks Classified as Single Cyber Event
TfL Hack: UK’s Largest Cybercrime Prosecution
Following the sentence, pronounced by London’s Woolwich Crown Court on July 16, Paul Foster, deputy director of the UK National Crime Agency (NCA) and head of its National Cyber Crime Unit, described the case as “the largest cybercrime prosecution ever brought before the UK courts.”
Foster noted that Scattered Spider has been “the most significant cybercrime threat to the UK in recent years” and that any disruption to the group’s activity can only be positive for the country.
The cyber-attack is thought to have cost TfL an estimated at £29m ($38m) in damages and £10m ($13.5m) in lost income. It also caused disruptions that affected the lives of between seven and 10 million people across the UK.
Additionally, Foster emphasized the complexity and length of the investigations, which took “nearly two years of painstaking work” by the NCA, the Crown Prosecution Service (CPS) and other policing partners, such as the City of London Police, the FBI, Europol and the Australian Federal Police.
During a briefing ahead of the sentencing, Foster said, “This is without doubt the biggest, most complex and most challenging investigation that we’ve ever conducted, in many ways surpassing the takedown of Lockbit ransomware with Operation Cronos in 2024.”
The conviction of Flowers and Jubair is only the second under section 3ZA of the CMA.
Foster described this as “the most serious section” of the Act because it applies where the unauthorised act causes or creates a significant risk of serious damage and the person intends or is reckless as to that damage.
The first conviction under 3ZA of the CMA concerned a Government Communications Headquarters (GCHQ) employee that resulted in them being jailed for six years.
“There was nothing in that case we can draw a comparison with,” Foster admitted.
UK Law Enforcement Highlights Need for Stronger Legal Powers
Foster argued that two of the main complexities law enforcement faced during the TfL hack investigation were the age of Flowers, who was 17 at the time of his arrest, and the fact that he breached bail on two separate occasions, once in October 2024 and again in May 2025.
“This is where the proposed Cybercrime Risk Orders that were trailed during the [May 2026] King’s speech and are due to be introduced in late 2027 or early 2028 are of huge importance to us,” Foster said.
He explained that complex cybercrime investigations “can take many months and during that time high-risk offenders, including those under the age of 18, may continue to present a significant risk of causing harm.”
Existing legal powers, he argued, including serious crime prevention orders, are not sufficient in these cases as they do not apply to underage offenders.
He also regretted that some computer misuse offenses “do not meet the serious crime criteria, which leaves a gap in our current ability to manage risk.”
Cybercrime Risk Orders Could Allow for Earlier Arrests
Proposed by the British government in May 2026 as part of planned reforms to the Computer Misuse Act, CCROs are civil preventive measures to manage the behavior of individuals suspected of or convicted of cybercrimes by creating a form of “digital prison” to disrupt illicit activities before further attacks occur.
They could give authorities powers to impose restrictions on individuals considered to pose an ongoing cyber threat, even before prosecution thresholds are met.
Foster said CCROs would “have allowed us to arrest Flowers sooner” by “potentially acting on information provided by US or Australian partners.”
He explained: “The proposed CCROs would provide law enforcement with a proportionate preventative tool similar in principle to sexual risk orders to impose conditions that help to protect the public and businesses whilst an investigation continues.”
“Those conditions would be actively monitored, and any breach could result in criminal sanctions, including imprisonment. That’s regardless of whether the underlying investigation has concluded,” he added.
Speaking to Infosecurity, Adam Pilton, a UK-based cybersecurity consultant and advisor, has a different opinion on the reform of the Computer Misuse Act.
While he would welcome legislation “that lowers the barriers to prosecution and introduces offences that reflects the reality of cybercrime today,” he also cautioned of the potential inefficacy of CCROs.
“The people subject to these proposed CCROs are going to be highly skilled and capable of tricking most officers, effectively hiding their illegal activity, so unless the people checking compliance have genuine technical capability, these orders won’t be able to achieve what they promise,” he said.
“Before they come into force, we must think very carefully about what we’re trying to achieve and whether it will actually work.”
The Case for Digital Prisons
During the pre-sentencing briefing, Ollie Shaw, Commander at the City of London Police, also said he “welcomes” the introduction of CCROs.
“It’s increasingly apparent that traditional mechanisms that we have for controlling offenders who work in a physical environment, but as robbers, mobile phone thieves, etc., are simply less effective for cyber offenders,” he said.
He advocated for the creation of “digital prisons where we can better control the damaging behavior of offenders like Flowers and Jubair.”
“If you think about traditional orders of serious crime prevention orders, they often talk about physical restrictions on individuals not to travel to a specific location, for example shoplifters being barred from certain high streets. But, of course, it’s very easy with any digital device to access the tooling that you need to commit and carry on your offending,” he explained.
Shaw advocated for restricting offenders’ access to the digital tools and platforms they need to reoffend.
He argued these measures should be enforced in partnership with tech providers and allow for monitoring of account usage and device limits. He acknowledged there will be practical enforcement challenges, notably around keeping digital devices out of prisons.
“Of course, these risk orders will need to be brought to life by guidance from policing and other parts of law enforcement and will need to be very restrictive in order to protect individuals,” Shaw concluded.
In contrast, Pilton criticized the term “digital prison,” which he described as “headline-grabbing marketing terminology for a CCRO.”
“There will be no digital prison, anyone who’s determined to bypass these orders will do so whether by tricking supervising officers or simply being more technically advanced,” he argued.
“Restrictions can and will help manage risk, but only skilled supervision makes them meaningful.”
The legislation for a reform of the CMA is expected to be introduced in Parliament later this year as part of a broader national security package.
Read now: UK Government Weighs Review of Computer Misuse Act to Combat Cybercrime