The new Police and Justice Act, published today, could criminalise legitimate IT security activity. There are fears among security experts that changes it makes to the Computer Misuse Act will make it illegal to distribute some vital tools.