The new Police and Justice Act, published today, could criminalise legitimate IT security activity. There are fears among security experts that changes it makes to the Computer Misuse Act will make it illegal to distribute some vital tools.
The new law modifies the Computer Misuse Act of 1990, the cornerstone of Britain's anti-hacking law. The changes make clear for the first time that denial of service attacks are an offence [1], but they also address the distribution of hacking tools.
The new Act will make a person guilty of an offence "if he supplies or offers to supply any article believing that it is likely to be used to commit, or to assist in the commission of, [a hacking offence]". The word "article" is defined in the Act to include "any program or data held in electronic form".
Some software tools commonly used by IT security professionals can also be used for malicious purposes, making the new legislation a cause for concern.
"This applies particularly to dual use tools like nmap, which security professionals use to check if a network is insecure or not and which the bad guys use to scan for insecurities to then attack it," said Richard Clayton, a member of digital rights group the Open Rights Group and a security researcher at Cambridge University. "Distributors of this have to decide if the people getting it from them are the good guys or the bad guys."
