Legal Ambiguity Is Pushing Security Researchers to Withhold Findings, Study Says

A qualitative review of U.S. and U.K. research experiences points to clearer safe harbors as a central policy question for anti-hacking laws.

Good-faith security researchers in the United States and United Kingdom are abandoning projects, avoiding certain fields and sometimes withholding vulnerability disclosures because they fear legal exposure under anti-hacking laws, a recent qualitative research paper finds.

The paper examines how researchers navigate laws including the U.S. Computer Fraud and Abuse Act and the U.K. Computer Misuse Act. Both laws are intended to deter malicious hacking and protect digital systems, but researchers told the authors that broad or uncertain boundaries can make routine security work legally risky.

One anonymous participant summarized the problem bluntly: “You can’t really have a functional security research career without taking some level of risk; there’s just not enough legal certainty.”

The consequences extend beyond individual researchers. When researchers delay or decide against investigating a system, potential flaws may remain undiscovered. When they find weaknesses but avoid disclosing them, vendors, users and public authorities may lose an opportunity to fix problems before attackers exploit them.

The paper draws on interviews with dozens of researchers in the two countries, as well as lawyers and other professionals who the authors said have collectively advised thousands of researchers. Participants described legal risks as serious and commonplace, and, in some research areas, close to unavoidable.

Researchers reported receiving legal threats and making career decisions around potential liability. One participant recalled sending emails to warn people about a security incident and then encountering law enforcement officers with machine guns. The participant said that response “doesn’t seem to balance” with the act of issuing a warning.

The findings are qualitative rather than quantitative. The authors kept participants anonymous, did not connect quotations to specific individuals and omitted detailed context to reduce the chance of identification. They also cautioned that their dataset is diverse but not designed to measure how often specific outcomes occur across the full research community.

That limitation matters for compliance leaders. The research does not establish a numerical rate of threatened litigation, investigation or abandoned work. It does establish that perceived exposure can affect disclosure and research decisions even where a researcher believes the work serves a defensive purpose.

For organizations that operate vulnerability disclosure programs, the practical issue is whether their policies give researchers enough clarity to report findings without fearing an accusation of unauthorized access. Clear scopes, explicit authorization for defined testing activity and predictable reporting channels can reduce ambiguity at the organizational level, though they do not override criminal law.

For policymakers, the paper adds pressure to debates over whether anti-hacking statutes need clearer protections for good-faith research. A safe harbor would need to distinguish defensive testing and responsible disclosure from conduct intended to damage systems, steal data or enable intrusion. The enforcement challenge is that intent alone may be difficult to assess after the fact, particularly when the same technical actions can be used for research or abuse.

The uncertainty is material. The available account does not identify the paper’s title, authors or publication venue, and it does not provide a full methodology or sample size. It also does not identify whether individual anonymous participants were based in the United States or the United Kingdom. Still, the reported experiences indicate that legal uncertainty itself can act as an enforcement mechanism, shaping security research before a prosecutor, regulator or court ever takes action.