Pro-Innovation Regulation of Technologies Review and the Computer Misuse Act 1990

Opened the debate

Dr Jamie Wallis highlighted the need to reform the outdated Computer Misuse Act 1990, stressing that British cyber-security professionals face legal risks for obtaining actionable intelligence. He cited a report by the CyberUp Campaign and techUK which found four out of five cyber-security professionals worry about breaking the law when conducting essential research in good faith. Wallis emphasised the importance of introducing a statutory public interest defence to protect these professionals, citing instances such as gathering threat intelligence, responsible vulnerability research, active scanning, enumeration, use of open directory listings, identification, and honeypots. He noted the chilling effect on security researchers due to prosecution threats, and the necessity of reforming the CMA for national security infrastructure protection against hostile technologies from countries like Russia and China. Wallis also mentioned a recent case involving TikTok where Government cyber-security experts uncovered potential risks in data collection methods, reinforcing the need for safeguarding vulnerability research and threat intelligence related to defensive measures. He concluded by stressing that reform would foster innovation, economic growth, and international regulatory influence.

Government Response

The Minister for Security thanked Jamie Wallis for raising the issue of reforming the Computer Misuse Act 1990. Acknowledging the scale of cyber-crime, he highlighted the need to enhance powers and legislation for law enforcement agencies to tackle this threat. He mentioned that a call for information has been launched to gather different views on whether the 1990 Act needs enhancement. The Government committed to further considering proposals from Jamie Wallis regarding amending the Act to provide defences to Computer Misuse Act offences. However, he emphasised that any changes must support improving UK cyber-security while ensuring system owners can determine who accesses their systems and data. The Minister noted significant issues needing attention such as defining legitimate cyber-security activity, identifying applicable circumstances for defence, minimum standards for undertaking such activities, professional compliance requirements, reporting oversight, and maintaining law enforcement's ability to investigate cyber-crimes. He reiterated that the Government is consulting with various stakeholders including law enforcement agencies, prosecutors, the cyber-security industry, and system owners to reach a consensus on the best way forward.