The Home Office’s Review of the Computer Misuse Act 1990 and proposals for change - Which? response

Which? welcomes the opportunity to provide our views on the Home Office’s review of the Computer Misuse Act 1990 (CMA). In 2021, we approved of the government's intention to review this three decade old piece of legislation, given the enormous change in the digital landscape in that period. As the UK’s consumer champion, Which?’s interest in the Act stems from our work to advise and protect consumers in all aspects of their digital lives. We have chosen to respond to sections of the review consultation that are most relevant to consumers. In summary:

• Which? agrees that voluntary takedown arrangements do not always succeed in swiftly removing fraudulent and malicious domains and that there is a need for formal powers as a backstop to protect consumers.
• We welcome the intention behind the proposal to prevent the creation of criminal domains but seeks further detail to understand the Home Office’s vision for this power.
• We recommend the Home Office fully considers other preventative options to tackle domain abuse like placing due diligence obligations on registrars.
• We welcome the government's intention to consider how the Act’s extraterritorial provisions could be clarified and expanded.
• Without the introduction of statutory public interest defences under the Act we continue to be hampered in our role protecting consumers from cybercrime and holding businesses to account. The Home Office must introduce stronger legal protection for consumer groups, cyber security professionals and researchers undertaking legitimate activity to keep UK consumers safe.