Chilling Effect of the Enforcement of Computer Misuse Act: Evidence from Publicly Accessible Hack Forums.

This article investigates the chilling effect of Computer Misuse Act (CMA) enforcement—laws criminalizing the production, distribution, and possession of hacking tools with criminal intent—on legitimate cybersecurity discussions within publicly accessible online hack forums. Using a quasi-experimental difference-in-differences approach comparing Chinese forums subject to CMA enforcement with an English forum outside such jurisdiction, the study finds that CMA enforcement significantly reduces both the quantity and relevance of cybersecurity-related contributions, including knowledge acquisition and provision. The research attributes this chilling effect primarily to users’ uncertainty and fear of false prosecution, moderated by factors such as users’ prior experience (behavioral inertia), peer feedback (social learning), and conformity to content produced by recognized cybersecurity professionals (uncertainty-identity theory). The findings highlight the complexity of balancing legal deterrence of cybercrime with the preservation of lawful cybersecurity research and knowledge sharing, offering policymakers and forum administrators recommendations to mitigate unintended negative impacts of CMA enforcement.