Contribution
I am grateful to the noble Lord, Lord Clement-Jones, with support from the noble Lord, Lord Holmes of Richmond, for raising this topic in the amendments today. I am grateful also to the noble Baroness, Lady Neville-Jones, for bringing her vast experience in this area to the debate.
I can say genuinely to all the noble Lords that they have a point. It is a point that the Government have recognised today: that we need to ensure that we update the Act accordingly. There is no doubt that UK cyber security professionals contribute greatly to enhancing and protecting the country’s security, and supporting them is vital. The figures that the noble Lord, Lord Holmes of Richmond, gave in terms of growth since the original Act took place are absolutely valid and understood. He mentioned, rightly, that the previous Government—at ministerial or official level; I am not party to how that worked—commissioned the review in 2021. We are now in 2026, and this Government have had custody of this issue since July 2024. It is a reasonable presumption that we need to come to some conclusions on the review.
The Government have listened to the concerns raised by noble Lords. The noble Lord, Lord Holmes of Richmond, mentioned my colleague Dan Jarvis, who is the Minister directly responsible for these areas. They have listened to the concerns and have over the past year made real progress in developing a proposal for a limited defence to the offence at Section 1 of the Computer Misuse Act; namely, unauthorised access to computer material. Crucially, this includes safeguards to prevent misuse. However—and this is where my caveat comes in—this is an immensely complex area. Noble Lords, including the noble Lord, Lord Davies of Gower, have pointed to that complexity, but engagement is under way, including with the cyber security industry, to refine the approach, and I hope that we shall be able to provide an update at some point.
Further work is required to consider the safeguards that would be needed to accompany any introduction of statutory defences, and my colleagues at official level in the Home Office are working with the National Cyber Security Centre, law enforcement and the industry on this issue to try to come to some conclusions. The Home Office is actively considering wider changes to the Computer Misuse Act. As part of the review that we are undertaking, we are scoping several proposals to update the Act, including the very point that has been mentioned by a number of noble Lords, which is on the Act’s extraterritorial provisions and the maximum penalties that were introduced.
In relation to proposals to increase maximum penalties for computer misuse offences, the Act already provides for a range of penalties, including life imprisonment for offences that cause or create a significant risk of serious damage to human welfare or national security. While the Government share the noble Lord’s concern regarding appropriate sentencing and are considering this as part of the wider review of the 1990 Act, we do not consider the proposal to update the majority of offences and uplift them under the Act to 14 years to be proportionate. However—and I hope this is accepted —and as I have said in a number of areas today, this Government are still just over 18 months into office. A review is being undertaken and I hope it will come to some conclusion on those issues, but at the moment those complexities are still under consideration.
Amendment 364 would introduce personal criminal liability for directors and managers who failed to prevent or otherwise consented to offending under the Computer Misuse Act. Again, I recognise the intent to strengthen accountability. Our current view is that it is unnecessary, given the existing offences applicable to persons who enable or facilitate offending. I know that this will be entirely unsatisfactory to noble Lords, both to the noble Lord, Lord Clement-Jones, and to the supporters who have spoken in this debate today, but while this review of the 1990 Act is ongoing, I am limited in regard to what I can say about the Government’s plans to reform the Act, but I hope that I have acknowledged that the points that have been raised are absolutely valid.