Any law that forbids citizens from revealing what the government gets up to, or from speaking out about what they find, needs to be looked at with a very hard stare indeed. Yet that’s where we find ourselves with the draft Investigatory Powers Bill, aka the Snooper's Charter.

As Glyn Moody and George Danezis point out, the draft bill effectively makes it a crime to reveal the existence of government hacking. Along the way, the new law would also make it illegal to discuss the existence or nature of warrants with anyone under any circumstances, including in court or with your MP, no matter what’s been happening. The powers are sweeping, absolute, and carefully put beyond public scrutiny, effectively for ever. There’s no limitation of time.

Forget for one moment the wisdom of giving such powers to anyone and placing them outside the main system of law, as part of normal civil life. Ignore the chance that anyone within the security services or government or other authorised agencies might use this to cover up bad actions, either their own or those of someone else who’s been doing embarrassing things. Such things are bad and inevitable, but that’s not the worst part.

By placing such stringent absolutist non-disclosure laws on government intrusion, this bill threatens to outlaw security research, at least outside the secret agencies.

Let’s say I’m a security researcher, digging into some unusual behaviour in a router on behalf of a major telecoms client. I discover a security hole into which somebody has installed a backdoor. Whoever it was didn’t leave a calling card: they rarely do.

What would I do if I found that backdoor today? The ethical thing is to check my results with trusted colleagues, tell my client, determine what the best remedial action is, tell whoever is in charge of that aspect of the router software, allow time for a patch to propagate out, then tell the world what happened. It’s interesting, but not immediately important, to work out who did the attack. Fix first, ask questions later.

Let’s look at that in a world where the Snooper's Charter has become law. I find the backdoor and tell a colleague. She doesn’t answer my e-mail, but I get a knock at the door—turns out that GCHQ was behind the attack. I am now banned forever from mentioning to anyone what I found—or that I found anything. The backdoor is later exploited by the bad guys and my client is hit. Why didn’t you find it, they ask? I can only shrug. Soon, my consultancy is in disarray. If I’m sued for incompetence, I cannot defend myself. I can write no papers, warn no people.

Standing on a landmine

There are various other bad scenarios, but the basics remain the same: as a security researcher, I could at any time stand on an invisible landmine, placed by the same people who’ve denied me the use of a metal detector. I'm essentially forbidden from digging into any backdoor, to find out who was behind the attack: it could be gangsters, or it could be someone who can and will throw me in jail.

Will I want to be a security researcher in the UK under this regime? It seems unlikely. Is it a good idea for the UK to massively discourage research and competence in IT security? That seems unlikely too—although doubtless Theresa May would say that leaving the country vulnerable to massive exploitation and without valuable economic skills is a small price to pay for the ability to find an abducted child by reading everyone’s browser history.

Given everything else asinine and dangerous the UK government has said about computer security to date, it's impossible to say whether these are unintended consequences or not. But if you are involved in security research in the UK, you may care to read the Bill and enter the debate.

If you wait until the Bill is actually signed into law next year, it will be far, far too late.

Rupert Goodwins started out as an engineer working for Clive Sinclair, Alan Sugar, and some other 1980s startups. He is now a London-based technology journalist who's written and broadcast about the digital world for more than thirty years. You can follow him on Twitter at @rupertg.