UK Announces Updates to the 1990 Computer Misuse Act to Protect Security Researchers and Strengthen Cybercrime Laws

The United Kingdom is moving forward with long-awaited reforms to the Computer Misuse Act of 1990, a law originally passed in response to a high-profile hacking incident involving the Duke of Edinburgh. While the law has been instrumental in prosecuting cybercrime, its broad language has increasingly posed challenges for legitimate cybersecurity research. Security professionals have sometimes faced criminal risk when conducting research that involves controlled, covert access to IT systems. High-profile incidents, such as the 2017 WannaCry ransomware case, highlighted the potential for misinterpretation and unwarranted legal consequences for researchers. The proposed reforms aim to modernize the law to reflect contemporary cybersecurity needs, balancing protections for researchers with new powers for law enforcement. Among the changes, the government plans to introduce a Cyber Crime Risk Order to better manage cybercriminal activity and enhance the abilities of authorities to investigate and prevent serious offenses. Additionally, the bill seeks to make the UK a more resilient target against hostile foreign actors and cyber threats. Experts, including those from Rapid7, emphasize that AI-driven vulnerability research and automated security testing are now essential for defending national infrastructure, and the updated legislation aims to reduce legal risks for these essential activities while still enforcing robust cybersecurity measures.