Recommendation 26

The UK’s main legislative framework on cybercrime is over 30 years old. In that time, the country’s relationship with the online world has changed beyond recognition, along with the scale and nature of cybercrime. Rather than introducing a Bill, however, the Home Office has run a second consultation on its proposed reforms to the Computer Misuse Act 1990 (CMA), and only published an analysis on 14 November 2023. We are disappointed that the King’s Speech 2023 did not include the CMA and we are still unclear as to how the Criminal Justice Bill is a suitable replacement. The Government should urgently bring forward legislation to reform the Computer Misuse Act, including to: • Criminalise the theft and copying of data, to bring it in line with property theft offences; • Introduce appropriate extra-territorial provisions for cybercrime; • Give authorities the power to preserve data, pending a decision on formal seizure; • Enable law enforcement agencies to seize domain name and IP addresses; and • Increase the maximum sentences for more serious CMA offences.