Lord Clement-Jones (LD)

My Lords, Amendment 360 seeks to introduce statutory defences to charges under the Computer Misuse Act 1990. I thank the noble Lord, Lord Holmes, again for his support. He has tabled a number of amendments which are companions to this amendment. The Computer Misuse Act 1990 is widely recognised as outdated. It inadvertently criminalises legitimate and beneficial cyber security research, making the UK a difficult place for cyber experts to operate in. There has been a very vigorous campaign, as I am sure the Minister is aware, the CyberUp campaign, which has made the case very clearly. This anomaly risks undermining our national cyber resilience and the ability of researchers proactively to detect vulnerabilities. This amendment would address this by inserting a statutory defence where unauthorised access was demonstrably necessary for the detection or prevention of crime or carried out in the public interest. This reform is vital for supporting responsible cyber research and aligning our laws with the needs of the 21st century digital landscape. The CMA was passed in 1990, when cyber security, as we know it today, simply did not exist. At the time, only 0.5% of the UK population regularly used the internet. Critics, including 93% of cyber security professionals surveyed, believe the Act is no longer fit for this century. The current criminal law criminalises unauthorised access irrespective of the good intentions or defensive motivations of the professional. This has created a perverse situation in which the UK’s cyber defenders are forced to act with one hand tied behind their back. Threat intelligence researchers investigating criminal infrastructure, for instance, are often unable to obtain the explicit consent required under the Act. This has resulted in 80% of surveyed cyber security professionals having worried about breaking the law while investigating cyber threats. This ambiguity and restriction deters a large proportion of the research needed to assess and defend against emerging threats posed by organised criminals and geopolitical actors. It also limits the UK industry’s capability compared with foreign competitors in countries such as France, Israel and the US, which already offer more permissive legislative regimes. Consequently, the UK cyber industry is held at a competitive disadvantage. This is a clear economic issue, not merely a legal one. Reform of the CMA is essential to securing a robust digital economy. Updating the Act is estimated to unlock up to £2.4 billion in additional annual sector revenue and support the creation of thousands of highly skilled jobs.