Outdated Cybercrime Laws Put Security Researchers at Risk
TechTarget, Tuesday, August 19th, 2025
Only 15 of 154 countries with cybercrime statutes offer any legal protection for good-faith research.
NCC Group's Katharina Sommer mapped global cybercrime law and found only 15 countries have implemented or are considering legal protection for security researchers, out of 154 with cybercrime statutes.
The UK's Computer Misuse Act, enacted in 1990, still makes no distinction between malicious hacking and good-faith research, leaving researchers exposed to fines or prison.
Portugal's 2025 amendment creating a safe haven prompted her to survey further; Argentina, Chile, and Panama have also adopted protections, with Panama covering those who produce hacking tools.
She built the survey by feeding the UN Global Cyberlaw Tracker into an LLM. Her five-point CICIC framework covers conduct, intent, consensus, institution, and conditionality, regulating the activity rather than the actor.