Computer Misuse Act 1990

Ms Lynch highlighted the urgent need for reform of the Computer Misuse Act 1990 due to its outdated nature and lack of effectiveness in tackling modern cyber-crime. She cited low prosecution rates, with only 45 prosecutions and 43 convictions in 2020, and called for a statutory defence that would allow cyber-security professionals to perform legitimate activities without fear of legal repercussions. Holly Lynch introduced comparisons with France's approach to cyber security laws and emphasised the importance of learning from other countries' experiences.

Mr. Jim Shannon highlighted the importance of improving cyber security for individuals and companies, citing concerns about insecure devices compromising privacy or being hijacked to disrupt internet usage. He questioned whether Government targets set in 2016 had been met regarding making online products and services cyber-secure by default by 2021. With an estimated £1.27 billion cost of cybercrime annually in the UK, Mr. Shannon stressed the need for legislative changes to address issues like weak passwords and user behavior contributing to poor cybersecurity.

Mr Warman welcomed the debate, thanking officials for recent meetings on improving the Computer Misuse Act. He stated that while the act may not be broken, it can be improved to adapt to changes in cyber-security industry structure since its inception. Matt Warman raised points about statutory defence and emphasised the need to balance reassurances for security professionals without legalising criminal activity.

Apologised for not being present at the beginning of the debate. Agreed with his colleague's suggestion about a statutory defence, but suggested that it could be achieved without amending existing legislation, particularly through co-ordination with the Crown Prosecution Service.

The CMA is holding the UK back in cyber security, making professionals face legal jeopardy for their work. The Act needs reform to support vulnerability research and threat intelligence without criminalising necessary activities. Simon Fell provided a concise summary of the case for reforming the Computer Misuse Act 1990, advocating for well-considered changes to address current security challenges.

Mr Baker is concerned about the complexity and technical challenges involved in reforming the Computer Misuse Act. He notes that the subject of cyber-security is highly complex, requiring expertise from top 1% software engineers, which makes it difficult for non-experts to understand or legislate effectively. Mr Baker supports reform of the act but opposes an official register of professionals. I recommend the Minister read 'Peopleware', a classic in software engineering, which discusses the significant differences in competence between software engineers and raises interesting issues for consideration.

Stuart C. McDonald discussed smart fridges and the evolving technological landscape, highlighting that everything from driverless cars to internet-connected devices is becoming a reality.

Welcomes the debate and acknowledges the need to revisit and revise the Computer Misuse Act due to technological advancements. Highlights that less than 1% of reports of hacking lead to prosecutions, suggesting the legislation is ineffective. Supports adding a defence to protect ethical hackers identifying vulnerabilities without exploiting them.