4 ms·

> Is it legal to do this? Post on Twitter that you've asked Company X for this bounty and if they don't pay it by Date X you'll post it on Twitter. No, it is n

> Is it legal to do this? Post on Twitter that you've asked Company X for this bounty and if they don't pay it by Date X you'll post it on Twitter. No, it is not legal. This is called blackmail. https://www.justia.com/criminal/offenses/white-collar-crimes/blackmail https://www.justia.com/criminal/offenses/white-collar-crimes... Although as a non-legal expert, I'm not clear on how this is different from demanding that the company fix the bug or else you'll reveal it after ninety days a la Google Project Zero? Maybe what makes that non-blackmail is the promise of revealing it no matter what, but offering to delay up to ninety days?

skissane 6y ago
IANAL, but: The classic situation of blackmail is demanding money from someone, or else you'll reveal some embarrassing fact about them, report that they committed some crime, etc. Saying "Give me money or I will publicly disclose a bug in your computer systems" – that fits the classic situation of blackmail straight on. Saying "Fix this bug in 90 days or I'll publicly reveal it" – doesn't fit the classic situation of blackmail, no demand for money involved. Now, not all cases of blackmail fit the classic situation. It is possible for a person to commit blackmail without demanding money, if instead they demand something else of direct value to them – for example, saying to a university president "Offer my child a place or else I'll tell the media that you are cheating on your wife". But, in the case of Google Project Zero style "Fix this bug in 90 days or I'll publicly reveal it", it isn't clear that the demander is actually demanding anything of any direct personal benefit to themselves. Generally speaking, the direct personal benefit to the security researcher of the bug being fixed is going to be negligible. If I demand you do something which doesn't directly benefit me (or my family or friends) in any tangible way, I don't see how such a demand could legally count as blackmail. I doubt the delay itself has any direct legal relevance. Going to someone and saying "I'm going to report your crimes to the authorities no matter what, but if you don't pay me I'll do it tomorrow, if you pay me I'll wait until next week instead" is probably still blackmail. (Getting one week's notice is invaluable if you plan to flee the country, for example.)
- taeric 6y ago
  I think a big part is that it is not "or I will reveal". Rather, it is, "I'm revealing this bug in ninety days. Fix it sooner." Right?
  - andrewguenther 6y ago
    This is how Google's Project Zero works basically
- tw47ddfdf1a705 6y ago
  As you've described it, blackmail shouldn't be a crime when revealing the information would be otherwise legal.
  - skissane 6y ago
    A classic case of blackmail – I know you have committed a crime. I threaten to report your crime to the police unless you pay me. The act being threatened – reporting your crime to the police – is totally legal, even socially encouraged. It is only the demanding of money (or other benefits) not to do it part which is the crime of blackmail. If I just went ahead and reported your crime to the police – no crime of blackmail. If I just didn't – no blackmail (but could be some other crime, such as misprision) It's only when I tell you that whether I'm going to do it depends on whether you do something for me that blackmail has been committed.
    - tw47ddfdf1a705 6y ago
      Yes, and that shouldn't be a crime. Now a more relevant example: I discovered a security vulnerability in FB. 1. Publish the vulnerability publicly (legal) 2. Sell the vulnerability to exploiters (illegal) 3. Accept FB's bug bounty reward (legal) 4. Attempt to negotiate a different amount with FB, falling back to #1 (illegal, blackmail) 5. Attempt to negotiate a different amount with FB, falling back to #2 (illegal, extortion) 6. Attempt to negotiate a different amount with FB, falling back to #3 (legal) I assert that treating #4 as a crime is to use the police powers of the state to protect FB's wallet.
spoonjim 6y ago
Maybe what you need to do is post consulting fees on your Twitter, and then post something that just says, "Facebook, I've found a bug, I'm posting it in 90 days." Then it's up to Facebook to find it and fix it, or make you an offer you can't refuse.
- asdfasgasdgasdg 6y ago
  I think if you intersect the set of people willing to take this risk and the set of people with the capability to find bugs like this, then remove all the black hats, you'd end up with the empty set.

skissane 6y ago

IANAL, but: The classic situation of blackmail is demanding money from someone, or else you'll reveal some embarrassing fact about them, report that they committed some crime, etc. Saying "Give me money or I will publicly disclose a bug in your computer systems" – that fits the classic situation of blackmail straight on. Saying "Fix this bug in 90 days or I'll publicly reveal it" – doesn't fit the classic situation of blackmail, no demand for money involved. Now, not all cases of blackmail fit the classic situation. It is possible for a person to commit blackmail without demanding money, if instead they demand something else of direct value to them – for example, saying to a university president "Offer my child a place or else I'll tell the media that you are cheating on your wife". But, in the case of Google Project Zero style "Fix this bug in 90 days or I'll publicly reveal it", it isn't clear that the demander is actually demanding anything of any direct personal benefit to themselves. Generally speaking, the direct personal benefit to the security researcher of the bug being fixed is going to be negligible. If I demand you do something which doesn't directly benefit me (or my family or friends) in any tangible way, I don't see how such a demand could legally count as blackmail. I doubt the delay itself has any direct legal relevance. Going to someone and saying "I'm going to report your crimes to the authorities no matter what, but if you don't pay me I'll do it tomorrow, if you pay me I'll wait until next week instead" is probably still blackmail. (Getting one week's notice is invaluable if you plan to flee the country, for example.)

taeric 6y ago
I think a big part is that it is not "or I will reveal". Rather, it is, "I'm revealing this bug in ninety days. Fix it sooner." Right?
- andrewguenther 6y ago
  This is how Google's Project Zero works basically
tw47ddfdf1a705 6y ago
As you've described it, blackmail shouldn't be a crime when revealing the information would be otherwise legal.
- skissane 6y ago
  A classic case of blackmail – I know you have committed a crime. I threaten to report your crime to the police unless you pay me. The act being threatened – reporting your crime to the police – is totally legal, even socially encouraged. It is only the demanding of money (or other benefits) not to do it part which is the crime of blackmail. If I just went ahead and reported your crime to the police – no crime of blackmail. If I just didn't – no blackmail (but could be some other crime, such as misprision) It's only when I tell you that whether I'm going to do it depends on whether you do something for me that blackmail has been committed.
  - tw47ddfdf1a705 6y ago
    Yes, and that shouldn't be a crime. Now a more relevant example: I discovered a security vulnerability in FB. 1. Publish the vulnerability publicly (legal) 2. Sell the vulnerability to exploiters (illegal) 3. Accept FB's bug bounty reward (legal) 4. Attempt to negotiate a different amount with FB, falling back to #1 (illegal, blackmail) 5. Attempt to negotiate a different amount with FB, falling back to #2 (illegal, extortion) 6. Attempt to negotiate a different amount with FB, falling back to #3 (legal) I assert that treating #4 as a crime is to use the police powers of the state to protect FB's wallet.

spoonjim 6y ago

Maybe what you need to do is post consulting fees on your Twitter, and then post something that just says, "Facebook, I've found a bug, I'm posting it in 90 days." Then it's up to Facebook to find it and fix it, or make you an offer you can't refuse.

asdfasgasdgasdg 6y ago
I think if you intersect the set of people willing to take this risk and the set of people with the capability to find bugs like this, then remove all the black hats, you'd end up with the empty set.