4 ms·

> The policy for the first time directs that good-faith security research should not be charged. > Accordingly, the policy clarifies that hypothetical CFAA vio

> The policy for the first time directs that good-faith security research should not be charged. > Accordingly, the policy clarifies that hypothetical CFAA violations that have concerned some courts and commentators are not to be charged. Embellishing an online dating profile contrary to the terms of service of the dating website; creating fictional accounts on hiring, housing, or rental websites; using a pseudonym on a social networking site that prohibits them; checking sports scores at work; paying bills at work; or violating an access restriction contained in a term of service are not themselves sufficient to warrant federal criminal charges. > However, the new policy acknowledges that claiming to be conducting security research is not a free pass for those acting in bad faith. For example, discovering vulnerabilities in devices in order to extort their owners, even if claimed as “research,” is not in good faith. What exactly does this policy change even mean? Who was being charged with a federal crime for checking a sports score or paying a bill at work? And since the claim to be conducting security research is not a "free pass" for unauthorized research, I'd really like to know who exactly was being charged under the old policy that is protected by the new? This "change" just seems like a bunch of pointless grandstanding.

duxup 4y ago
Sometimes grandstanding makes sense. "We're not going to charge people for security research", might reduce the chilling effects of some company threatening some rando researcher.
- shockeychap 4y ago
  How, exactly, when you qualify it with, "However, the new policy acknowledges that claiming to be conducting security research is not a free pass for those acting in bad faith. For example, discovering vulnerabilities in devices in order to extort their owners, even if claimed as “research,” is not in good faith."? Seems the rando researcher is subject to the same liabilities as before.
  - duxup 4y ago
    I think that line is just there to state the obvious that you can't say "security researcher" and get off free... your actions determine if you are acting as a researcher, not just a claim. I don't find that the least bit weird.
    - shockeychap 4y ago
      "discovering vulnerabilities in devices in order to extort their owners, even if claimed as “research,” is not in good faith." If I had just discovered a vulnerability, and didn't have a written contract authorizing me to do the research, I wouldn't feel the least bit of additional protection from this policy change, and would probably refrain from extorting the owner. Edit: I had read "extorting" as "extolling" and associated with notification, not extortion. (I even typed "extorting" in this response.) I stand corrected, as extortion changes the tone of the qualification.
      - duskwuff 4y ago
        You should probably refrain from extorting anyone, regardless of the circumstances. :)

duxup 4y ago

Sometimes grandstanding makes sense. "We're not going to charge people for security research", might reduce the chilling effects of some company threatening some rando researcher.

shockeychap 4y ago
How, exactly, when you qualify it with, "However, the new policy acknowledges that claiming to be conducting security research is not a free pass for those acting in bad faith. For example, discovering vulnerabilities in devices in order to extort their owners, even if claimed as “research,” is not in good faith."? Seems the rando researcher is subject to the same liabilities as before.
- duxup 4y ago
  I think that line is just there to state the obvious that you can't say "security researcher" and get off free... your actions determine if you are acting as a researcher, not just a claim. I don't find that the least bit weird.
  - shockeychap 4y ago
    "discovering vulnerabilities in devices in order to extort their owners, even if claimed as “research,” is not in good faith." If I had just discovered a vulnerability, and didn't have a written contract authorizing me to do the research, I wouldn't feel the least bit of additional protection from this policy change, and would probably refrain from extorting the owner. Edit: I had read "extorting" as "extolling" and associated with notification, not extortion. (I even typed "extorting" in this response.) I stand corrected, as extortion changes the tone of the qualification.
    - duskwuff 4y ago
      You should probably refrain from extorting anyone, regardless of the circumstances. :)