Portugal updates cybercrime law to exempt security researchers

Portugal has updated its cybercrime law to create a legal safe harbour for good-faith security research and to make hacking non-punishable under certain strict conditions, according to DataBreaches[.]Net. A new provision in Article 8.o-A, titled “Acts not punishable due to public interest in cybersecurity,” provides an exemption for actions previously classed as illegal system access or illegal data interception.

The exemption applies only when researchers act to identify vulnerabilities and contribute to cybersecurity, with two key conditions: the research must aim solely at identifying vulnerabilities not created by the researcher and at improving cybersecurity through disclosure, and the researcher cannot seek or receive any economic benefit beyond normal professional compensation. The article notes the update was first spotted by Daniel Cuthbert and references further details in an external source.

For readers seeking additional context, the piece points to Bleeping Computer as a place to read more about other exemptions and protections, according to Bleeping Computer.