3 ms·

Can security researchers send an invoice for a reasonable amount conmesurate with the value of the service provided and then sue for quantum meruit if it is not

Can security researchers send an invoice for a reasonable amount conmesurate with the value of the service provided and then sue for quantum meruit if it is not paid?

ziddoap 2y ago
The only people that I know do this are "Beg Bounty" "Security Researchers" that are, essentially, attempting to extort people. Even if it would be legally possible (I don't think you can force your 'services' on an unwilling entity and then force them to pay), it would be absolutely awful optics.
- thatguy0900 2y ago
  The closest I can think is the old scam where a business would mail you a package then demand payment for the item mailed to you. That was solved by just making anything shipped to you yours with no legal obligation to send it back
  - kmoser 2y ago
    Unfortunately it doesn't work for instances of, say, a bank accidentally depositing extra money in your account, or their ATMs accidentally dispensing too much cash.
    - themaninthedark 2y ago
      Why would it? The situations are entirely different; in the mail package situation, the outside company is attempting to get you to pay for something that you did not request. In the Bank/ATM, the company made a mistake. For the bank situation to work, they would have to add an unrequested service to your account and then attempt to charge you for it. i.e. Bank adds overdraft protection to you checking account and then bills you for it. Say you have an internet plan with a 5GB download limit and after 5GB the connection would no longer send data, one month it lets you download 7GB and then they send you a bill for going over. You probably would not have to pay the bill since they changed their behavior and provided extra without prior notification.
- TZubiri 2y ago
  Re:Optics, I agree, but I think they would be counterweighted by the dimension of the issue fixed. To put a hypothetical example, if I fix a life threatening electrical or structural issue in a children's hospital unsolicited, whatever hit to my reputation I take by charging for unsolicited work, is dwarved and possible restored and reversed by the gravity of the issue fixed and the consquences avoided. Of course this is contingent on whether the value was actually provided and whether it is provable.
pizzafeelsright 2y ago
I spent a minute reading this. My time is worth $300/hr and I bill in tenths of an hour. Where do I send the invoice?
- TZubiri 2y ago
  "For example, to state a claim for unjust enrichment in New York, a plaintiff must allege that (1) defendant was enriched; (2) the enrichment was at plaintiff's expense; and (3) the circumstances were such that equity and good conscience require defendants to make restitution.[1]" Of course that (3) is the contentious point typically, but you haven't even gotten (1) right. How does you reading my comment provide value to me? It's also funny that, excluding the element of a relationship previously existing, This is the way most business on an hourly basis is made. Suppose you have a lawyer, you agree on 300$/hr, then you ask them to draft a contract and pay them 600$/hr. If someday you are imprisoned and your lawyer is contacted by law enforcement, and they have to bail you out of jail. They would typically send you an invoice even if you didn't solicit that specific service. While it's not insignificant that you had a previous hourly arrangement for a different type of work, it's certainly not a sufficient reason to claim that you owe them for their time and bond monies.
rafram 2y ago
Can those people who wash your windshield at red lights actually make you pay? If your neighbor leaves their door unlocked while they’re at work, can you go change the locks (for their safety!) and bill them for your time? No, of course not. Why would you be able to bill for a service that you weren’t asked to provide?
- bmicraft 2y ago
  Well, in a case such as this: because they're putting other people's data/money at risk and should have payed somebody to discover flaws like this in the first place. It's not the law but maybe it should be.
  - rafram 2y ago
    And if you can’t see out of your dirty windshield, you could cause an accident. If your neighbor’s door is unlocked all day, someone could break in and steal their TV. I mean, why should I even need to apply for any job? McDonald’s always needs workers; do you think they’ll mind if I walk into the kitchen, start flipping burgers, and then name my hourly rate at the end of the day?
    - bmicraft 2y ago
      We were talking about "reasonable", which your reply seems to miss completely. Reasonable can mean a lot of things, including a predefined rate or a fixed way to calculate compensation owed.
  - giancarlostoro 2y ago
    Legal extortion you way?
    - the8472 2y ago
      Well, the users of the system should be able to recoup some of their costs for services (security) not rendered and then pay the researcher for that. In a more well-coordinated society none of this would happen because the company would have avoided the predictable outcome by hiring a security person in the first place.
tptacek 2y ago
Of course not.
yapyap 2y ago
They can not.
snakeyjake 2y ago
Yes, they can. Anyone can sue anyone else for any reason. It will be a colossal waste of everyone's time and money, though, because they will never prevail.
dizhn 2y ago
That sounds like a fine, not an invoice. If you can compel them to pay, sure. ;)
- TZubiri 2y ago
  No. A fine is punitive, an invoice is compensatory.
znpy 2y ago
most door locks can be easily picked. can i go from house to house, pick locks and then demand payment? (spoiler: no)
- TZubiri 2y ago
  I feel you are just applying a classic example from ethical hacking 101 that doesn't apply at all. The common example is that a house can have a door without lock, but it is still a crime to enter. Similarly, entering into a vulnerable system or a system without password even is not legal (although of course the existence of a password or lock mechanism makes undeniable the fact that the place is not for public entry) In this case there is no entering into any system. There is no lock picked, no server accessed.
  - znpy 2y ago
    irrelevant. can i just decide on my own to do some work, and then *demand* payment for such work? the answer is still no.

Can security researchers send an invoice for a reasonable amount conmesurate with the value of the service provided and then sue for quantum meruit if it is not paid?

ziddoap 2y ago

The only people that I know do this are "Beg Bounty" "Security Researchers" that are, essentially, attempting to extort people. Even if it would be legally possible (I don't think you can force your 'services' on an unwilling entity and then force them to pay), it would be absolutely awful optics.

thatguy0900 2y ago
The closest I can think is the old scam where a business would mail you a package then demand payment for the item mailed to you. That was solved by just making anything shipped to you yours with no legal obligation to send it back
- kmoser 2y ago
  Unfortunately it doesn't work for instances of, say, a bank accidentally depositing extra money in your account, or their ATMs accidentally dispensing too much cash.
  - themaninthedark 2y ago
    Why would it? The situations are entirely different; in the mail package situation, the outside company is attempting to get you to pay for something that you did not request. In the Bank/ATM, the company made a mistake. For the bank situation to work, they would have to add an unrequested service to your account and then attempt to charge you for it. i.e. Bank adds overdraft protection to you checking account and then bills you for it. Say you have an internet plan with a 5GB download limit and after 5GB the connection would no longer send data, one month it lets you download 7GB and then they send you a bill for going over. You probably would not have to pay the bill since they changed their behavior and provided extra without prior notification.
TZubiri 2y ago
Re:Optics, I agree, but I think they would be counterweighted by the dimension of the issue fixed. To put a hypothetical example, if I fix a life threatening electrical or structural issue in a children's hospital unsolicited, whatever hit to my reputation I take by charging for unsolicited work, is dwarved and possible restored and reversed by the gravity of the issue fixed and the consquences avoided. Of course this is contingent on whether the value was actually provided and whether it is provable.

pizzafeelsright 2y ago

I spent a minute reading this. My time is worth $300/hr and I bill in tenths of an hour. Where do I send the invoice?

TZubiri 2y ago
"For example, to state a claim for unjust enrichment in New York, a plaintiff must allege that (1) defendant was enriched; (2) the enrichment was at plaintiff's expense; and (3) the circumstances were such that equity and good conscience require defendants to make restitution.[1]" Of course that (3) is the contentious point typically, but you haven't even gotten (1) right. How does you reading my comment provide value to me? It's also funny that, excluding the element of a relationship previously existing, This is the way most business on an hourly basis is made. Suppose you have a lawyer, you agree on 300$/hr, then you ask them to draft a contract and pay them 600$/hr. If someday you are imprisoned and your lawyer is contacted by law enforcement, and they have to bail you out of jail. They would typically send you an invoice even if you didn't solicit that specific service. While it's not insignificant that you had a previous hourly arrangement for a different type of work, it's certainly not a sufficient reason to claim that you owe them for their time and bond monies.

rafram 2y ago

Can those people who wash your windshield at red lights actually make you pay? If your neighbor leaves their door unlocked while they’re at work, can you go change the locks (for their safety!) and bill them for your time? No, of course not. Why would you be able to bill for a service that you weren’t asked to provide?

bmicraft 2y ago
Well, in a case such as this: because they're putting other people's data/money at risk and should have payed somebody to discover flaws like this in the first place. It's not the law but maybe it should be.
- rafram 2y ago
  And if you can’t see out of your dirty windshield, you could cause an accident. If your neighbor’s door is unlocked all day, someone could break in and steal their TV. I mean, why should I even need to apply for any job? McDonald’s always needs workers; do you think they’ll mind if I walk into the kitchen, start flipping burgers, and then name my hourly rate at the end of the day?
  - bmicraft 2y ago
    We were talking about "reasonable", which your reply seems to miss completely. Reasonable can mean a lot of things, including a predefined rate or a fixed way to calculate compensation owed.
- giancarlostoro 2y ago
  Legal extortion you way?
  - the8472 2y ago
    Well, the users of the system should be able to recoup some of their costs for services (security) not rendered and then pay the researcher for that. In a more well-coordinated society none of this would happen because the company would have avoided the predictable outcome by hiring a security person in the first place.

tptacek 2y ago

Of course not.

yapyap 2y ago

They can not.

snakeyjake 2y ago

Yes, they can. Anyone can sue anyone else for any reason. It will be a colossal waste of everyone's time and money, though, because they will never prevail.

dizhn 2y ago

That sounds like a fine, not an invoice. If you can compel them to pay, sure. ;)

TZubiri 2y ago
No. A fine is punitive, an invoice is compensatory.

znpy 2y ago

most door locks can be easily picked. can i go from house to house, pick locks and then demand payment? (spoiler: no)

TZubiri 2y ago
I feel you are just applying a classic example from ethical hacking 101 that doesn't apply at all. The common example is that a house can have a door without lock, but it is still a crime to enter. Similarly, entering into a vulnerable system or a system without password even is not legal (although of course the existence of a password or lock mechanism makes undeniable the fact that the place is not for public entry) In this case there is no entering into any system. There is no lock picked, no server accessed.
- znpy 2y ago
  irrelevant. can i just decide on my own to do some work, and then *demand* payment for such work? the answer is still no.