Member

This is not about criminalising ordinary data handling or routine cyber security research; it is about reaching the deliberate, malicious act of obtaining someone’s identifiers in order to pass oneself off as them and act in their name. Where that intent can be shown, it is entirely right that the law should bite at that point rather than waiting passively for the fraud or for the victim’s life to be upended.