Loading story…
The UK government is actively considering amendments to the Computer Misuse Act, a law originally enacted in 1990 to criminalize unauthorized access to computer systems. Security Minister Dan Jarvis announced that the government is exploring the introduction of a "statutory defense" for security researchers, aiming to ensure that individuals engaged in responsible vulnerability discovery and bug bounty programs are not penalized under the current legal framework. This move is in response to longstanding concerns from the cybersecurity community that the existing law inadvertently stifles legitimate research and weakens the resilience of UK digital infrastructure.
The proposed changes would allow security researchers to "spot and share vulnerabilities" without fear of prosecution, provided their actions are responsible and in good faith. The government acknowledges the critical role these researchers play in identifying and mitigating unknown vulnerabilities, and the potential legal reform is seen as a step toward fostering a more collaborative and secure cybersecurity environment in the UK. The initiative has been welcomed by industry experts who have advocated for clearer legal protections to support the growth and effectiveness of the British cybersecurity sector.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
Security Minister Dan Jarvis announced that the UK government is considering revising the Computer Misuse Act to introduce a statutory defense for security researchers conducting responsible work such as bug bounty activity and vulnerability disclosure.
The United Kingdom introduced the Computer Misuse Act in 1990, creating the legal framework that later drew criticism for potentially criminalizing legitimate cybersecurity research.
The Cyber-Up campaign and industry advocates, including Verona Johnstone-Hulse, publicly called for reform of the Computer Misuse Act to protect threat intelligence and vulnerability research.
The National Crime Agency highlighted that the aging Computer Misuse Act is not only problematic for researchers but also limits effective law enforcement operations.
At an unspecified earlier stage, attempts to amend the Computer Misuse Act to add protections for good-faith security researchers did not gain sufficient parliamentary support.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK government has announced plans to reform its outdated Computer Misuse Act to provide statutory defenses for ethical hackers and security researchers, aiming to protect them from prosecution when responsibly disclosing vulnerabilities. British security minister Dan Jarvis emphasized the need for these changes, acknowledging that the current law constrains legitimate research and that updated legislation would help strengthen the country's cyber resilience. The proposed reforms would allow researchers to spot and share vulnerabilities under certain safeguards, aligning the UK with similar protections already enacted in countries like the Netherlands, France, and Belgium. Meanwhile, Portugal has passed new legislation granting protections to security researchers, provided they do not seek financial gain or breach data protection laws. This move has been welcomed by the security community and increases pressure on the UK to modernize its own laws. The Portuguese law is described as "tightly scoped," requiring that security actions be strictly proportionate, and is seen as a positive step toward creating a safer environment for responsible vulnerability disclosure across Europe.
Jun 29, 2026
The UK government is moving to update the Computer Misuse Act (CMA), originally enacted in 1990, to better protect ethical hacking and legitimate cybersecurity research. The lack of exemptions for researchers in the original law has long been a concern, and recent recognition of the growing scale of cybercrime and the need for robust research has prompted calls for reform. The changes aim to ensure that cybersecurity professionals can conduct research without fear of prosecution, reflecting the evolving threat landscape and the importance of proactive defense. In parallel, the UK's National Cyber Security Centre (NCSC) has highlighted the value and risks of cyber deception technologies such as honeypots and decoy accounts. Findings from the NCSC's Active Cyber Defense 2.0 program indicate that, when properly implemented, these tools can provide valuable threat intelligence and disrupt attacker confidence. However, the NCSC warns that poor implementation can generate noise, create vulnerabilities, or foster a false sense of security, emphasizing the need for clear strategy and ongoing management. The NCSC is working to help organizations invest in and deploy these technologies effectively as part of a modern defense strategy.
Jun 29, 2026
Portugal has amended its cybercrime law to provide a legal exemption for good-faith security researchers, establishing a safe harbor for activities previously considered illegal, such as unauthorized system access or data interception. The new provision, Article 8.o-A, titled "Acts not punishable due to public interest in cybersecurity," outlines strict conditions under which security research is exempt from criminal liability, including requirements that the research aims solely to identify vulnerabilities not created by the researcher, contributes to cybersecurity, and does not seek economic gain beyond normal compensation. Additional stipulations mandate that researchers must promptly report discovered vulnerabilities to system owners, relevant data controllers, and the CNCS, limit their actions to what is necessary for detection, avoid service disruption or data alteration, and refrain from using prohibited techniques such as DoS attacks, social engineering, or malware deployment. Any data obtained must remain confidential and be deleted within 10 days of remediation. The law also exempts acts performed with the system owner's consent, provided vulnerabilities are reported to the CNCS, thereby clearly defining the boundaries and protections for ethical hacking in Portugal.
Jun 29, 2026