Former hacktivists have reacted with bafflement after the Conservative MP Kemi Badenoch admitted that she hacked Harriet Harman’s website in 2008.

Badenoch confessed to the hack, which carried a jail sentence of up to five years at the time she acted, in response to a question about the “naughtiest” thing she had done.

For other politically motivated hackers, breaching the Computer Misuse Act has had serious consequences.

“Considering others have been prosecuted for similar, juvenile attacks on websites, I’ll be curious to see if the law will be applied equally in this case,” said Mustafa Al-Bassam, a former member of the hacking collective LulzSec. When he was 16, Bassam was given a 20-month suspended sentence for breaching the CMA as part of the group’s campaign.

“This is a situation where someone has straight-up admitted to a crime on TV, the police have an easy job. If a Conservative MP can admit to a computer crime on television and get away with it, then that says the law is not being enforced equally in the UK,” he said. Bassam, who is now a computer scientist at UCL, filed a crime report to the national cyber crime reporting centre on Sunday.

Others expressed hope that Badenoch’s ability to shrug off the incident might herald a change in the enforcement of the CMA, which covers hacking offences. “I’m hoping this results in useful discussions around updating the Computer Misuse Act to more accurately and fairly deal with hackers of all levels,” said Jake Davis, another former LulzSec member.

Badenoch gained access to Harman’s website by guessing the credentials (she later gave an anonymous interview revealing that Harman’s username and password were “harriet” and “harman”), and posted a hoax blogpost claiming the then Labour minister for women and equality was supporting Boris Johnson in the London mayoral race.

British computer crime law does not distinguish between technically sophisticated attacks and lucky guesses. “What’s interesting about the CMA is that it doesn’t explicitly bring up the sophistication of a hacking offence, so legally, the defacement here does break the CMA, regardless of the weakness of the credentials of the victim. The problem is the law itself,” said Davis.

Section 3 of the CMA covers “unauthorised modification of the contents of any computer” carried out with intent “to prevent or hinder access to any program or data held in any computer”. It carries a maximum penalty of five years in prison, a fine or both. There have been convictions for similar offences: in 2006, a man was found guilty under the same law for hacking and defacing four dating site profiles with easily guessable passwords. He was sentenced to eight months in prison, suspended for two years.

As well as over-criminalising potentially minor acts, campaigners argue that the CMA prevents legitimate security research. “Even had Kemi written a nice email to Harriet Harman’s office alerting them to their daft choice of password, that in itself would still in theory constitute grounds for prosecution under the CMA,” said Naomi Colvin, director of the whistleblowers’ organisation Courage Foundation. “That runs counter to the aim of promoting online security and needs to change.”

Colvin and Davis said they hoped this case would result in an amendment to the law. “I am pleased to see that Harriet Harman has accepted that apology, which makes prosecution unlikely,” Colvin said.

“This is an entirely appropriate way to deal with a trivial incident and highlights just how ridiculously heavy-handed most prosecutions of online activists are. People have had their houses raided and equipment seized on lesser pretexts, when a settlement like today’s would be more consistent with the interests of justice and common sense.

“I look forward to working with Kemi Badenoch and Harriet Harman on amending the CMA and associated CPS guidance to defend online activists, security researchers and journalistic sources from inappropriate harassment.”

Davis said: “The CMA has become yet more absurd since the LulzSec prosecutions of 2011, with the maximum sentences being increased for each offence.” The maximum penalty for an offence under section 3 of the act is now 10 years.

“Personally I want to see fewer prosecutions under the CMA in general and would welcome its reform,” said Davis. “Our hacking laws are embarrassingly out of date.”