Peers from across the House of Lords have once again called for reform of the Computer Misuse Act 1990, as an amendment seeking greater legal protections for legitimate cyber security activity was debated during Report Stage of the Cyber Security and Resilience Bill on Monday 26 October.
Lord Clement-Jones, supported by Lord Holmes of Richmond, tabled Amendment 158, which would have required the Government to review within 12 months whether a statutory defence under Section 1 of the Computer Misuse Act should be introduced for good-faith cyber security researchers and threat intelligence practitioners, and report its findings to Parliament.
Building on a similar amendment debated at Committee Stage in September, Lord Clement-Jones highlighted how countries including the United States, France and Belgium have already taken steps to provide greater legal certainty for legitimate cyber security research.
He also referenced the CyberUp Campaign directly, calling for the Government to conclude its discussions with the campaign and industry and bring forward concrete proposals within 12 months.
"It is time to untie the hands of our cyber defenders," he told the House.
The amendment received strong support from fellow peers, including Viscount Camrose, who reiterated the Opposition's backing for reform. He argued that enabling good-faith cyber security research could help create self-improving systems, strengthening security across both the public and private sectors without additional cost to the taxpayer.
Lord Holmes of Richmond, a longstanding supporter of CMA reform, stressed the importance of protecting the cyber professionals working to keep the UK safe. He criticised the continued delay in updating legislation approaching its 40th anniversary, arguing that cyber defenders should not find themselves on the wrong side of outdated laws when carrying out legitimate work.
Baroness Harding of Winscombe also expressed her wholehearted support for the amendment, describing the failure to resolve the issue as "gobsmacking". She called on the Government to provide reassurance that it would finally deliver the legal protections cyber professionals have sought from successive governments.
Responding on behalf of the Government, Baroness Ramsey of Wall Heath reiterated that the Home Office has completed its review of the Computer Misuse Act and is proposing a statutory defence under Section 1 for accredited cyber security researchers undertaking certain activities that would currently be unlawful.
The Minister confirmed that the Home Office has been working with the National Cyber Security Centre, law enforcement and the cyber security industry to develop the proposals, and reaffirmed that legislation remains a priority.
She pointed to the Government's commitment to updating the CMA through the forthcoming National Security Bill, confirming that the legislation is in development and will be brought forward as soon as parliamentary time allows.
Following these assurances, Amendment 158 was not moved. Lord Clement-Jones welcomed the Government's renewed commitment while making clear that peers would be looking to see the promised statutory defence included in the forthcoming legislation.
The CyberUp Campaign welcomes the continued cross-party support for CMA reform and the Government's repeated commitment to delivering a statutory defence. With cyber threats growing increasingly sophisticated, it is essential that this commitment translates into clear and workable legal protections for legitimate vulnerability research, threat intelligence and other cyber security activities.
We are extremely grateful to Lord Clement-Jones, Lord Holmes of Richmond, Viscount Camrose and Baroness Harding of Winscombe for their continued efforts to keep CMA reform firmly on the parliamentary agenda.