Legally Hacked - How Countries Decide When Security Research Is Allowed

Governments increasingly mandate coordinated vulnerability disclosure, yet many still enforce cybercrime laws written in the late 1980s and early 1990s that make finding and reporting flaws illegal. The talk surveys how different nations are closing that gap. The speaker started from the UN Trade and Development cyber law tracker, then compared the legal landscape before and after 2023, when the EU NIS2 directive pushed disclosure into national law.

Only about 15 of roughly 195 countries have any legal protection for security research, and just four offer true safe harbour, all in Europe. Eight of those 15 are also ranked as role models in the ITU Global Cyber Security Index, suggesting a link between mature security programmes and legal clarity. The speaker sorts the approaches into a taxonomy covering who is protected, what activity is covered, and how the protection is created. Mechanisms range from accreditation schemes and prosecutorial guidance to statutory defences, with examples from Poland, the United States, Portugal, Belgium and the UK's planned reform of its Computer Misuse Act.

The recurring elements are distilled into a minimum viable safe harbour built on conduct, intent, consensus, institutions and conditionality. Laws that regulate the activity rather than the person scale better, and most countries broadly agree on good faith, such as timely disclosure, least intrusive methods, and avoiding social engineering or denial of service. The takeaways are to reuse existing legal texts rather than start from scratch, reform outdated statutes, and remember that obligations on organisations receiving reports deserve attention too. A shared spreadsheet of the findings invites contributions, especially from non-English-speaking countries.