3 ms·
Not only was there significant personal liability, but there had been multiple instances of hackers being criminally charged and sentenced to jail time for find
by tptacek 3mo ago
Not only was there significant personal liability, but there had been multiple instances of hackers being criminally charged and sentenced to jail time for finding and reporting security vulnerabilities prior to this.
I don't think this is true, although it's a very commonly-held belief. Dan Goodin (I think?) wrote an article about this a long time ago, and was only able to come up with a few examples, and none of them fit this fact pattern.
https://news.ycombinator.com/item?id=16642155 https://news.ycombinator.com/item?id=16642155
What is true is that it is much less legally risky to test someone else's computer than it was 10-15 years ago. People forget that's what you're doing when you look for web vulns! The DOJ has had a norm over the past ~many years not to prosecute good-faith vulnerability research, even though strictly speaking it contravenes CFAA directly. But "risky on paper" is the most you could say about doing that kind of testing back in 2010.
- doc_ick 3mo agoDoubt, I’d argue it’s the opposite given the term “vulnerability research” is being overloaded to include things such as F12 on a school website.
- arcwhite 3mo agohttps://m.slashdot.org/story/159162-- https://m.slashdot.org/story/159162-- example circa 2011 I can think of 4-5 other situations from around that era (~2012) where people were at least charged and needed a lot of help to navigate the legal proceedings to avoid jail time. In 2010 it was more than risky on paper. 2017-2018 is well into the established era and probably even the golden age of bug bounties when a lot of corporate and judicial thinking re: white hat cybersecurity had been shifted.
- tptacek 3mo agoIt's true that I'm speaking entirely in an American context.
- furst-blumier 3mo agoMaybe in the US but see eg germany: https://binsec.wiki/en/pentesting-guidelines/pt-legal-framework/pt-germany/ https://binsec.wiki/en/pentesting-guidelines/pt-legal-framew...