Lord Holmes of Richmond:

Moved by Lord Holmes of Richmond

47: After Clause 107, insert the following new Clause—“Data use: defences to charges under the Computer Misuse Act 1990(1) The Computer Misuse Act 1990 is amended as follows.(2) In section 1, after subsection (3) insert— “(4) It is a defence to a charge under subsection (1) to prove that—(a) the person’s actions were necessary for the detection or prevention of crime, or(b) the person’s actions were justified as being in the public interest.”(3) In section 3, after subsection (6) insert—“(7) It is a defence to a charge under subsection (1) in relation to an act carried out for the intention in subsection (2)(b) or (c) to prove that—(a) the person’s actions were necessary for the detection or prevention of crime, or(b) the person’s actions were justified as being in the public interest.””Member’s explanatory statementThis amendment updates the definition of “unauthorised access” in the Computer Misuse Act 1990 to provide clearer legal protections for legitimate cybersecurity activities.

My Lords, in moving Amendment 47, I shall speak also to Amendment 48.

Here we are again: the Computer Misuse Act 1990 is another year older. It was put into statute at a time when technology looked nothing like it did 10 or 20 years ago, never mind today. I will give some brief facts. We have a fantastic cyber sector in our country, which adds so much to our economy and safety. The Computer Misuse Act constrains the sector from keeping us as safe as it might and constrains businesses in terms of their growth and what they could be adding today to our economy in terms of—yes—growth.

There is no reason for us to continue with the Computer Misuse Act when we have the solution in our hands, set out, I suggest, in Amendments 47 and 48. Our cyber- security professionals, often working way out of sight, for obvious reasons, do such important work and professionally, diligently, keep us safe and keep our country, assets and economy secure.

When the Minister responds, will he say, even sotto voce, that a Division on these amendments might help him in his discussions within the department to get some movement on this issue? We heard in previous debates how doing this would be premature and how the time was not now. Well, for a statute that came into being at the beginning of the 1990s, I suggest that it is high time that we made these amendments for individuals, for businesses, for our economy and for our society, in an extraordinarily uncertain world and at a time when I imagine that every Minister should be looking to every potential source of economic growth. I look forward to the debate and to the Minister’s response. I beg to move.

My Lords, in Committee, the noble Baroness the Minister said there was no consensus on the best way forward to amend the law to provide protection for ethical hackers trying to work against cybercrime. All I ask is that noble Lords should read the amendment, which says:

“It is a defence to a charge … to prove that … the person’s actions were necessary for the detection or prevention of crime or … the person’s actions were justified as being in the public interest”.

What on earth could be wrong with that? I support my noble friend Lord Holmes of Richmond.

My Lords, I too support this. I well remember the passage of the Computer Misuse Act, and we were deeply unhappy about some of its provisions defining hacker tools et cetera, because they had nothing about intention. The Government simply said, “Yes, they will be committing an offence, but we will just ignore it if they are good people”. Leaving it to faceless people in some Civil Service department to decide who is good or bad, with nothing in the Bill, is not very wise. We were always deeply unhappy about it but had to go along with it because we had to have something; otherwise, we could not do anything about hacking tools being freely available. We ended up with a rather odd situation where there is no defence against being a good guy. This is a very sensible amendment to clean up an anomaly that has been sitting in our law for a long time and should probably have been cleaned up a long time ago.

My Lords, I support Amendments 47 and 48, which I was delighted to see tabled by the noble Lords, Lord Holmes and Lord Arbuthnot. I have long argued for changes to the Computer Misuse Act. I pay tribute to the CyberUp campaign, which has been extremely persistent in advocating these changes.

The CMA was drafted some 35 years ago—an age ago in computer technology—when internet usage was much lower and cybersecurity practices much less developed. This makes the Act in its current form unfit for the modern digital landscape and inhibits security professionals from conducting legitimate research. I will not repeat the arguments made by the two noble Lords. I know that the Minister, because of his digital regulation review, is absolutely apprised of this issue, and if he were able to make a decision this evening, I think he would take them on board. I very much hope that he will express sympathy for the amendments, however he wishes to do so—whether by giving an undertaking to bring something back at Third Reading or by doing something in the Commons. Clearly, he knows what the problem is. This issue has been under consideration for a long time, in the bowels of the Home Office—what worse place is there to be?—so I very much hope that the Minister will extract the issue and deal with it as expeditiously as he can.

I thank my noble friend Lord Holmes for tabling the amendment in this group. I, too, believe these amendments would improve the Bill. The nature of computing and data processing has fundamentally changed since the Computer Misuse Act 1990. Third parties hold and process immense quantities of data, and the means of accessing and interacting with that data have become unrecognisably more sophisticated. Updating the definition of unauthorised computer access through Amendment 48 is a sensible reform, as this new definition takes into account that data controllers and processors now hold substantial quantities of personal data. These entities are responsible for the security of the data they hold, so their provisions on access become legally relevant and this amendment reflects this.

When updating an offence, it is equally necessary to consider the legal defences, as my noble friend has rightly done in Amendment 47 by protecting individuals accessing information to detect or prevent a crime or whose actions are in the public interest. We on these Benches feel these amendments are wholly sensible. I urge the Minister to listen to the persuasive argument that my noble friend Lord Holmes has made and consider how we can deliver these improvements to our data legislation.

I am grateful to the noble Lord, Lord Holmes, for raising this topic through Amendments 47 and 48. I am very aware of this issue and understand the strength of feeling about reforming the Computer Misuse Act, as we have heard from the noble Lord, Lord Arbuthnot, and the noble Earl, Lord Erroll.

As the noble Lord, Lord Clement-Jones, rightly pointed out, when I was the Government Chief Scientific Adviser I conducted a review making recommendations on pro-innovation regulation of technologies and I made recommendations on the issues these amendments raise. These recommendations were accepted by the previous Government.

The Government are actively taking forward these recommendations as part of the Act’s ongoing review. These issues are, of course, complex and require careful consideration. The introduction of these specific amendments could unintentionally pose more risk to the UK’s cybersecurity, not least by inadvertently creating a loophole for cybercriminals to exploit to defend themselves against a prosecution.

Our engagement with stakeholders has revealed differing views, even among industry. While some industry partners highlight the noble Lord’s view that the Computer Misuse Act may prevent legitimate public interest activity, others have concerns about the unintended consequences. Law enforcement has considerable concerns that allowing unauthorised access to systems under the pretext of identifying vulnerabilities could be exploited by cybercriminals. Without robust safeguards and oversight, this amendment could significantly hinder investigations and place a burden on law enforcement partners to establish whether a person’s actions were in the public interest.

Further work is required to consider the safeguards that would need to accompany any introduction of statutory defences. The Government will continue to work with the cybersecurity industry, the National Cyber Security Centre and law enforcement agencies on this issue. The Home Office will provide an update in due course, once the proposals have been finalised—or, in the words of the noble Lord, Lord Clement-Jones, they will pop out of the bowels of the Home Office in due course. With these reassurances in mind, I hope the noble Lord will feel able to withdraw his amendments.

My Lords, I thank everybody who has taken part in this short debate. I was really hoping that we would not hear the phrase “the bowels of the Home Office” twice, but we did—now we have heard it three times. Perhaps it could be the title of somebody’s autobiography. I do not know whose, but I claim the IP rights even though the noble Lord, Lord Clement-Jones, said it first.

I am grateful for the Minister’s response. It would probably have been better to have some sense of timeline; much of what he said was very much what we heard in Committee. We are all amenable to having a course of action, but it needs more objectives attached to it as to when we are likely to see some consequences, action and changes. As every day goes by, as the Minister is well aware, risks go unchecked that could be checked, people are less safe who could be made safe and economic growth, the Government’s priority, is prevented which could be enabled.

For now, I will withdraw my amendment, but I am minded to see what is possible between now and Third Reading, because the time is now; otherwise, “in due course” will be even longer than the official statement “later in the summer”. I beg leave to withdraw.

Amendment 47 withdrawn.

Amendment 48 not moved.

Clause 109: Interpretation of the PEC Regulations