No penalty for reporting errors in electronic security systems in Poland The Digitization Minister (Minister) has announced the abolition of criminal liability for identifying and reporting errors in electronic security systems. The Minister recognises cases in which an IT specialist, acting for the public good incidentally finds an error in the electronic security system and accordingly notifies the administrator of the system, and yet exposes himself/herself to criminal liability in the process. Under the current law, such an action is considered a crime, and such person is deemed a hacker, as he is considered to be one "who produces, acquires, sells or provides other persons with devices or computer programs designed to commit an offence referred to in Article 165 § 1.4, Article 267 § 3, Article 268a § 1 or § 2 in connection with § 1, Article 269 § 2 or Article 269a, as well as computer passwords, access codes or other data enabling access to information stored in a computer system or a data communications network, and is punishable by imprisonment of up to 3 years" (Article 269B § 1 of the Penal Code). The amendment bill has not yet been published in the Government Legislative Centre. Initial consultations have already been held with the Ministry of Justice which is set to prepare proposals to identify cases that are exempt from criminal liability. The two circumstances that have been discussed are: the abolition of criminal liability for actions undertaken for scientific research purposes, and the testing of electronic security systems, subject to the consent of the administrator. The introduction of such a provision is seen to encourage individuals with relevant knowledge to voluntarily notify the proper authority or administrator about such errors, and thus will result in increasing the degree of security both in the government and private sectors. Activities involving blackmail, including threats to making public the information about the error in the electronic security system in the event of failure to remove it within a specified period, will continue to be punishable. For more information, please contact Wiktor Krzymowski.