Computer Misuse Act 'putting critical UK infrastructure at risk'

The 30 year-old legislation also prevents cyber security professionals from doing their jobs, it's claimed

The key piece of cyber security legislation in the UK is outdated, inadequate and prevents cyber security professionals from doing their jobs.

With the Computer Misuse Act 1990 (CMA) turning 30 years-old this year, a collective of academics, legal practitioners and experts have branded the piece of legislation a danger to the UK’s general cyber resilience.

The CMA, in particular, is preventing cyber security professionals from carrying out threat intelligence research against cyber criminals and internationally-based hackers, according to a report by the Criminal Law Reform Now Network (CLRNN).

The legislation also imposes restrictions on journalists and academics from researching cyber threats that are in the public interest.

“The Computer Misuse Act is crying out for reform,” said Simon McKay, a barrister specialising in civil liberties and human rights who led the CLRNN research. 

“It needs to be future- and technology-proofed to ensure it can meet the challenges of protecting the embedded internet-based culture we all live in and depend on. 

“This report delivers a blueprint for the government to use and develop to make the law more effective in policing and prosecuting cybercrime.”

The CMA has been used by law enforcement agencies over the past 30 years to penalise people who attempt to access or modify data on a computer without appropriate authorisation. 

Conventionally, this covers the broad scope of malware infections and cyber attacks, as well hacking into systems to obtain information or data for future misuse.

A recent example of a prosecution under the CMA arose in 2018, when a motor industry employee was given a six-month prison sentence for accessing thousands of customers’ personal records without permission. 

One of the arguments made by the CLRNN against the CMA in its current form is that it offers a confused legal framework, with outdated and ambiguous terminology, and is too broad in its application. The inappropriate nature of this scope may serve to penalise or deter individuals carrying out cyber research that may benefit the UK’s cyber resilience but could be interpreted as criminal.

Related Resource

Strengthen your defences against cybercrime

Cyber resilience planning for email

Download now

The CLRNN report has outlined a host of recommendations for lawmakers to take into account. These include introducing a public interest defence that allows cyber security professionals, journalists and academics to carry out work that could potentially prevent future cyber attacks.

There should also be a set of new targeted guidance for prosecutors, including a laxer sentencing regime for younger offenders, as part of a wider overhaul in the sentencing guidelines.

“The legal case for reform of the Computer Misuse Act 1990 is overwhelming,” said senior lecturer in criminal law at Birmingham Law School and CLRNN’s co-director, Dr John Child."

“Experts from academia, legal practice and industry have collaborated to identify the best route to ensure proper penalties are enforced to enable prosecution of  hackers and companies who benefit from their activities, whilst permitting responsible cyber security experts to do their job without fear of prosecution.”

Featured Resources

Digital document processes in 2020: A spotlight on Western Europe

The shift from best practice to business necessity

Download now

Four security considerations for cloud migration

The good, the bad, and the ugly of cloud computing

Download now

VR leads the way in manufacturing

How VR is digitally transforming our world

Download now

Deeper than digital

Top-performing modern enterprises show why more perfect software is fundamental to success

Download now

Recommended

What is hacktivism?
hacking

What is hacktivism?

13 Oct 2020
Microsoft: Iranian hackers are exploiting ZeroLogon flaw
Security

Microsoft: Iranian hackers are exploiting ZeroLogon flaw

6 Oct 2020
The Ritz suffers data breach after hackers pose as staff
data breaches

The Ritz suffers data breach after hackers pose as staff

17 Aug 2020
Russia hacked Liam Fox's personal email to steal trade documents
phishing

Russia hacked Liam Fox's personal email to steal trade documents

4 Aug 2020

Most Popular

The top 12 password-cracking techniques used by hackers
Security

The top 12 password-cracking techniques used by hackers

5 Oct 2020
iPhone 12 lineup official with A14 Bionic chip and 5G support
Mobile Phones

iPhone 12 lineup official with A14 Bionic chip and 5G support

13 Oct 2020
Google blocked record-breaking 2.5Tbps DDoS attack in 2017
Security

Google blocked record-breaking 2.5Tbps DDoS attack in 2017

19 Oct 2020