Pro-Innovation Regulation of Technologies Review and the Computer Misuse Act 1990

Motion made, and Question proposed, That this House do now adjourn.—(Joy Morrissey.)

Before I begin, I draw Members’ attention to my entry in the Register of Members’ Financial Interests, and in particular to my stakeholding in a firm that has historically offered digital forensic services, but which I understand does not currently and does not plan to offer such services for the next five years.

I am grateful for having secured this debate in order to highlight the importance of the Government’s recent commitment to implementing the recommendations in Sir Patrick Vallance’s pro-innovation regulation of technologies review, which included the introduction of a statutory public interest defence to the Computer Misuse Act 1990. I also thank the CyberUp Campaign, which has worked closely with me and other colleagues to champion the reform to the outdated CMA.

I am certain that the Minister will be aware that I previously stressed the reasons as to why we urgently need to reform the CMA in a Westminster Hall debate almost a year ago. In that debate, I argued, alongside insightful contributions from other hon. Members, that the 33-year-old Act needs further reform to bring our cyber-security capabilities into the 21st century.

The primary issue with the CMA, as it is currently written, is that British cyber-security professionals are at risk of being taken to court for obtaining actionable intelligence. Such is the scale of this concern, that a report by the CyberUp Campaign and techUK found that four out of five cyber-security professionals worry about breaking the law when conducting essential research in good faith. Currently, the only protections in the Act, beyond a few cases where a warrant is obtained, are extendable only to actions undertaken with explicit authorisation. Consequently, reform should include a legal mechanism and clarify legal ambiguities in order to put professionals at ease.

In 2022, the methods used by cyber criminals and cyber-security professionals are often very similar—sometimes the same. Individuals who work in cyber-security are frequently required to perform actions for which explicit authorisation is difficult, if not impossible, to obtain. Legitimate instances of unauthorised access include gathering proportionate threat intelligence; responsible vulnerability research and disclosure; active scanning; enumeration; use of open directory listings; identification; and, of course, honeypots.

Currently, we find ourselves in a perverse situation where industry specialists who are acting in the public interest—often dealing with issues that are critical to our national security infrastructure—are at risk of being designated a criminal. ENISA, the European cyber-security agency, notes that the threat of prosecution can have a “chilling effect” on cyber researchers which “adversely affects security”. The upshot of this is that we are dissuading vital research from being conducted at a time when countries such as Russia and China are increasingly deploying hostile technologies against us and our allies.

I commend the hon. Gentleman for securing this debate. Does he not agree that the balance must be found to allow for new research and development while ensuring that there is protection in place, not simply in an individual setting, but in terms of security for our nation from cyber warfare? That is a delicate balance to find, as he has said. With the growing reputation of Belfast as a cyber-security hub, we should, with any legislation, be regulating and encouraging development in British-controlled companies in the safest way possible in the future.

Yes, I agree wholeheartedly with the hon. Gentleman. I think that I go on to elaborate exactly how we might be able to do that.

We are now almost two years on from when the former Home Secretary announced a review of the CMA. In those two years, the technological landscape has only further drastically altered with heightened cyber-security risks becoming endemic to an increasingly uncertain geopolitical world. Recent Government announcements surrounding TikTok only serve to prove this point.

In the case of TikTok, Government cyber-security experts have conducted a thorough review of evidence since November and have uncovered a potential risk in the way sensitive Government data is accessed. This conclusion has been corroborated by the United States, Canada and the European Union. The review highlights TikTok’s data collection methods, which include the collection of user contact lists, accessing of calendars, scanning of hard drives, including external ones, and hourly geolocation of devices.

With this in mind, to protect against the increasing cyber threats in the UK and to combat online fraud, it is imperative to safeguard vulnerability and threat intelligence research related to defensive measures. The Office for National Statistics reported a concerning 77% rise in cyber threats in 2022, while online fraud increased by a third over the past two years. According to the Department for Digital, Culture, Media and Sport, data breaches survey in July 2022, 39% of companies have experienced a cyber-attack or data breach in the prior 12 months. In order to address these concerns, researchers play a vital role in identifying product and service vulnerabilities, working with manufacturers and vendors to fix them, detecting cyber-attacks, and gaining insight into attackers and victims. By doing so, they can decrease the impact of incidents and use horizon scanning to prevent future ones. The UK Government’s National Cyber Strategy recognises the crucial nature of this work and is committed to building valuable and trusted relationships with security researchers to reduce vulnerabilities. Thus, reforming the CMA will be a significant step in developing co-operation with professionals.

The introduction of a statutory defence is not only essential for giving UK security professionals legal protections and peace of mind when responding to the increasing number of cyber threats, but will help to encourage innovation and influence the evolution of international regulatory frameworks to give us an economic advantage over our competitors. As the Chancellor clearly enunciated in his spring Budget statement, we must be on the front foot in shaping the evolution of regulation and standards in this key growth sector.

I thank my hon. Friend the Member for Bridgend (Dr Wallis) for securing this debate and for his continued interest in this issue. This is not the first time he has raised it with me—in fact, the first time he raised it with me was many years ago—but it is perhaps the first time that I may be able to assist.

In my role as Security Minister, I see evidence every day of the scale of the threat from cyber-crime that affects our citizens, businesses and Government services. There were an estimated 690,000 incidents of computer misuse in England and Wales in the year to September 2022, of which 577,000 were related to unauthorised access to personal information. I have seen the effects of criminals targeting businesses and individuals online—the businesses that suffer financial losses because of ransomware attack and their inability to carry on their businesses, and the individuals who lose personal information, including highly personal information, and can suffer harassment and blackmail because of it.

It is because of such criminal activity that protecting the country in cyber-space is such a key priority for the Government. It is essential that we ensure the UK has the powers and legislation to allow our law enforcement agencies to take action to tackle this threat. The Computer Misuse Act dates from 1990, before almost anybody had an email address—certainly before I did. Today, we could not only research the law online, but one of the large language model artificial intelligences we now see frequently used online could actually draft large parts of it too.

That is why this Government have launched a call for information, asking for different views on whether the 1990 Act and the powers used by law enforcement agencies to investigate the offences in that Act need to be enhanced.

In February, we launched a consultation in which we set out proposals for new powers for law enforcement agencies to improve their ability to take action to tackle crime online. Those proposals include a power to allow law enforcement agencies to take control of domains and internet protocol addresses to help tackle a wide range of offences, including fraud; a power to require the preservation of computer data; and a power to take action against a person possessing or using data obtained by another person through a CMA offence. In the consultation, we committed to further considering the question raised by my hon. Friend of whether the Act needs to be amended to provide defences to CMA offences.