Portugal Revises Cybercrime Law to Protect Security Researchers

Portugal has amended its cybercrime law to exempt security researchers and ethical hackers from prosecution when their actions are aimed at identifying vulnerabilities or otherwise contribute to cybersecurity, provided they meet strict conditions (no economic motive; no violation of personal data; no DoS, social engineering, phishing, data theft or alteration; proportionate and limited actions; no disruption or harmful effects). Researchers must report findings to the system owner/designated manager and the data protection regulator, keep the data confidential, and delete it within 10 days after a vulnerability is fixed. The report also notes comparable moves in Germany and the US and a proposed statutory defense for researchers under consideration in the UK.