UK's Teen Hacker Rehab Programme, Explained

Lucas was sitting at his window in a Cumbrian village, waiting for the fraud detectives to arrive, running the mental arithmetic of exactly how much trouble he was in. He was 16. He'd hacked his school's computers — twice — not to steal anything, not to sell anything, but to play games and access blocked websites.

"Quite a sense of achievement," he told the BBC's cyber correspondent Joe Tidy, "when you've succeeded in doing something that two, three trained professionals have been spending a lot of time trying to stop you doing."

That framing — the puzzle, the challenge, the itch of can I? — turns out to be pretty common among the teenagers cycling through the UK's Cyber Choices programme. And it's also, if you think about it, exactly the mindset that makes a decent penetration tester.

What Cyber Choices Actually Is

Set up in 2017 and run by UK police, Cyber Choices is essentially an early intervention scheme: catch a young person before their curiosity calcifies into criminal habit, connect them with someone who can explain the legal lines they've been blurring, and redirect their skills toward a legitimate path. Around a thousand teenagers and children have been through it so far, with roughly 200 passing through in the last year alone.

The BBC was given exclusive access to the programme for a recent Tech Now report, and the result is a portrait of something that's harder to categorise than either boosters or critics would prefer.

In practice, the programme often comes down to a single police officer and a teenager. It was Constable Sam Cooper who knocked on Lucas's door and has been guiding him since — teaching him what's legal, encouraging a career in cybersecurity, even signing him up for online courses. Cooper's description of his own approach is worth sitting with:

"I'll try and find where their interests are and try and divert them towards professional training, qualifications, push them in the right direction at school. If I can get that link with them then absolutely yeah — I want to scare them in a healthy way, not in a threatening way."

That distinction — healthy fear versus threatening fear — is doing a lot of work. The programme isn't trying to terrorise kids into compliance. It's trying to make the stakes legible. Which, given how opaque the Computer Misuse Act is to most adults, let alone teenagers, is not a trivial task.

The Neurodiversity Thread

One of the more striking things in the BBC's reporting is the near-consensus among the officers running Cyber Choices that a substantial proportion of the young people they're working with are neurodiverse. Constable Cooper said anecdotally that the vast majority of individuals he deals with are neurodiverse — and that even those who don't carry a formal diagnosis often show a much stronger affinity with computers than with social or practical reality.

Isaac, a Cyber Choices success story now working in security, is direct about this: "Myself, I've got autism, ADHD, so I used to struggle a lot with social and other bits in my life." At 15, he hacked his school computers to access Photoshop for graphic design work. He also found himself gravitating toward criminal groups online — "I was mainly just watching," he said — and credits what happened with the Leicestershire investigation for prompting him to get out entirely.

The neurodiversity dimension isn't a get-out clause, and the programme doesn't treat it as one. But it does shape what effective intervention looks like. A teenager who finds social reality genuinely difficult isn't going to respond the same way to a stern talking-to as one who just made a bad call. Tailoring the approach matters. That Cyber Choices appears to be doing this, at least in some cases, is notable.

The Part Where It Gets Complicated

Here's the tension the BBC's report doesn't paper over: Cyber Choices is voluntary. And voluntary programmes are only as effective as the people who choose to engage with them.

Owen Flowers was 16 when he was invited to take part. He declined. Earlier this month — per the BBC's reporting — he was jailed for five and a half years for hacking Transport for London and two US healthcare companies. The BBC has also reported on teenagers jailed after live-streaming a cyber attack on TfL, a case that illustrates how high the stakes of youth cybercrime have climbed.

There's also an ongoing trial in which a teenager who did enroll on Cyber Choices allegedly went on to offend anyway. So the programme has failures at both ends: the ones who refuse it entirely, and the ones who accept it and still reoffend.

This raises the question that the BBC puts directly to programme staff — that by educating young hackers, Cyber Choices might actually be upskilling future criminals. The response from within the programme is a pragmatic one: if these kids don't get structured guidance here, where do they get it? The implication being that they'll get it somewhere, and that somewhere is more likely to be a criminal Discord server than a police-supervised online course.

It's a reasonable argument. It's also, notably, unfalsifiable in any individual case.

The Scale Problem

Cyber choices is one programme. The problem it's trying to address is genuinely global. Cyber attacks linked to young people have disrupted supermarkets, transport systems, casinos, and hospitals. Nurseries have been held to ransom. Individuals have been targeted for their cryptocurrency holdings. Australia and Canada have both launched their own versions of the scheme — which suggests international recognition that the issue is real and that education-led diversion is at least worth attempting.

But around a thousand participants over roughly eight years, in a country where primary school children are now being taught about the Computer Misuse Act (the youngest person to go through Cyber Choices was seven years old), is not a number that suggests the pipeline is anywhere close to being managed. The NCA acknowledges this directly: Cyber Choices can't solve the problem on its own.

What it might be able to do is change the trajectory of specific individuals. Lucas, sitting at his window waiting for the fraud detectives, is now learning cybersecurity with a police officer's active support. Isaac, who was watching from the edges of criminal groups at 15, is now a security professional. That's not nothing.

The Question Underneath All of This

What I keep coming back to is the fundamental mismatch between how quickly young people are acquiring digital skills and how slowly institutions are adapting to that reality.

The teenagers in the BBC's report weren't hacking for money or ideology — they were hacking because they could, because the puzzle was there and they had the tools to attempt it, and because nobody had ever made the legal and ethical framework around those tools particularly clear to them. "It's just a challenge to see if I could," Lucas says, with a kind of retrospective innocence that's hard to disbelieve.

The question Cyber Choices is implicitly asking is whether the criminal justice system is actually the right tool for that problem — or whether education, early and ongoing, is doing work that prosecution cannot. The programme's architects clearly think the latter. The case of Owen Flowers suggests the two approaches aren't mutually exclusive.

What nobody seems to have a clean answer to yet is how you reach the kids who won't open the door.

---

Ellis Redmond is Buzzrag's Personal Development & Productivity Correspondent.