InfoSecBulletin Cybersecurity for mankind
Portugal has changed its cybercrime law to protect good-faith security research and to make hacking legal under specific, strict conditions.
Daniel Cuthbert identified a new rule in Article 8.o-A, called “Acts not punishable due to public interest in cybersecurity,” which exempts some actions from being illegal that were once seen as illegal system access or data interception.
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
The exemption applies only to security researchers who identify vulnerabilities to enhance cybersecurity. To avoid criminal liability, specific conditions must be met:
The article outlines the boundaries of security research while offering legal protection for ethical hackers.
In November 2024, Germany’s Federal Ministry of Justice proposed a draft law to protect security researchers who responsibly report flaws to vendors.
Earlier, in May 2022, the U.S. Department of Justice (DOJ) announced revisions to its federal prosecution policies regarding Computer Fraud and Abuse Act (CFAA) violations, adding an exemption for “good-faith” research.
Security research is recognized and allowed to explore systems, find vulnerabilities, and report them safely without legal repercussions.
