The Computer Misuse Act amendment before peers this afternoon creates no statutory defence, whatever its heading says

Grand Committee on the Cyber Security and Resilience Bill sits again this afternoon at 15:45, and Amendment 164 is on the list. Its heading reads:

"Computer Misuse Act 1990: statutory defence for cyber security activities"

It is sponsored by Lord Clement-Jones for the Liberal Democrats, with Lord Arbuthnot of Edrom and Lord Holmes of Richmond from the Conservative benches and Baroness Finlay of Llandaff from the Crossbenches. Cross-party, and the long-running ask of the security research community.

I pulled the operative text from the Bills API this morning, because the marshalled list PDF blocks automated fetching and the heading is not the clause.

The amendment does not create a statutory defence.

What it actually does

What the heading says, and where the clause stops

The clause, verbatim, requires that the Secretary of State "must, within 12 months of the day on which this Act is passed, carry out and publish a review of whether the introduction of a statutory defence under section 1 of the Computer Misuse Act 1990 ... is necessary or desirable".

The review "must consider, in particular" three things: the position of "cyber security researchers, vulnerability testers and threat-intelligence practitioners acting in good faith"; the "conditions and safeguards (including as to authorisation, proportionality and reporting)" any defence should contain; and "the approaches taken in other jurisdictions".

Then a report to Parliament setting out the findings, and "whether the Secretary of State intends to bring forward proposals for such a statutory defence, and, if so, the intended timetable for doing so".

Three duties, all of them procedural. The sponsors' own explanatory statement says so plainly: it "seeks to place a statutory duty on the Secretary of State to review, within 12 months, whether a statutory defence ... is needed".

So nobody is being misleading. The drafting is honest and the explanatory note is accurate. It is the heading that will travel, and the heading says something the clause does not do.

The reason a review duty is being asked for at all

Here is the part that makes this afternoon interesting, and it is visible only if you put two government statements side by side.

On 3 December 2025, the Security Minister Dan Jarvis told the FT Cyber Resilience Summit, and gov.uk published it:

"Which is why we are looking at a legal change to the Computer Misuse Act. This would create a 'statutory defence' for these researchers to spot and share vulnerabilities, which would protect them from prosecution, as long as they meet certain safeguards."

That is about as clear as ministerial language gets. Named mechanism, named effect.

On 3 September 2026, nine months later, the same minister answered written question UIN 22222, tabled by James Naish, on whether the department plans to review the effectiveness of the Act. The full relevant passage:

"The Government is conducting an ongoing review of the Computer Misuse Act 1990 and is actively taking forward reforms to the cyber landscape. Proposals to update the CMA will be introduced as soon as parliamentary time allows. The changes will allow law enforcement agencies to more effectively tackle threats posed by cyber criminals. The reforms will create a Cyber Crime Risk Order to place robust controls on the behaviours of cyber criminals, alongside new powers to search individuals believed to be concealing evidence on behalf of suspects. It will also unlock the power of cyber security professionals to better enable them to secure computer systems."

The phrase "statutory defence" is not in it.

The two named, concrete reforms are both enforcement powers: a Cyber Crime Risk Order, and new search powers. The researcher provision has become "unlock the power of cyber security professionals to better enable them to secure computer systems", which commits to no mechanism at all.

The same commitment, in the government's own words, four days ago and nine months ago

Date	What was said	What it commits to
3 December 2025	“This would create a ‘statutory defence’ for these researchers … which would protect them from prosecution, as long as they meet certain safeguards”	A named legal mechanism with a named effect
3 September 2026	“It will also unlock the power of cyber security professionals to better enable them to secure computer systems”	No mechanism named. No effect named
3 September 2026, same answer	“The reforms will create a Cyber Crime Risk Order … alongside new powers to search individuals”	Two specific new enforcement powers, both named

Read that table in the other direction and it explains the amendment. If the government were still committed to a defence in the terms it used in December, a review duty would be redundant. Asking for one is a way of finding out whether the December sentence is still operative.

What this means if you do security research in Britain

Nothing changes today, and nothing changes if the amendment passes. That is the honest answer and it is worth saying before the practical notes.

The position

There is a version of this story where a cross-party group of peers finally legislated protection for security researchers this afternoon. That version will be written. It is wrong on the face of the document.

What is actually happening is smaller and, in its way, more revealing. Four peers have concluded that the way to make progress on a nine-month-old ministerial commitment is to compel a review of whether the commitment should be honoured, with a report to Parliament and a stated timetable. You do not ask for that when a promise is being kept.

The Minister's answer this afternoon is the thing to listen to, and the specific thing to listen for is whether the words "statutory defence" come back.