3 ms·

It's not just the transfer of cash. It's also complying with tax and employment laws in the country the hacker is in, to the satisfaction of your legal and fin

It's not just the transfer of cash. It's also complying with tax and employment laws in the country the hacker is in, to the satisfaction of your legal and finance teams. Sure, in western-style legal systems you can call them a contractor and they can pay their own tax. Just don't employ them full time for long enough to trigger 'sham contract' rules that would make them employees. But your corporate legal team doesn't have anyone trained and licensed to give advice on Tajikistan tax and employment law, so they can't approve this proposed contract without hiring an outside legal expert. And of course all suppliers, regardless of country, must agree to our anti-slave-labour policy which permits audits of... One might say "skip that nonsense, just send the money" - but the larger the company, the more their in-house infosec becomes a load of uptight squares who love compliance and audit. And the kind of companies that can pay out five-figure bounties tend to be pretty large.

inigyou 2mo ago
Why would you or anyone in your American company care about complying with Tajikistan law?
- ofjcihen 2mo ago
  Less about that. More about “not accidentally funding terrorism” (or, more realistically, not giving money to sanctioned countries which can have significant consequences).
- michaelt 2mo ago
  CISO: "We're going to invite random strangers from all around the globe to hack us, and pay them for their findings" CEO: "I'm not sure I like the idea of us inviting people to hack us - or paying a 'bounty' to hackers holding a knife to our throat. Will they at least agree to a binding NDA and terms of engagement, in advance?" CISO: "No, they won't." CEO: "Well, at least if the hackers are in poor countries, a $500 payout for a critical bug will be plenty, right?" CISO: "No, critical issues will be 10-100x that" CEO: "Well will the average quality of these reports better than those we get from our hired pentesters?" CISO: "On average these will be the lowest quality reports you've ever seen. But 0.1% might be gold. Oh, and I need to hire 3 more guys to sift through these terrible reports. Also our sifters might miss the gold." CEO: "Oh. Well at least we won't be breaking the law though, right?" CISO: "Uh, about that..."

inigyou 2mo ago

Why would you or anyone in your American company care about complying with Tajikistan law?

ofjcihen 2mo ago
Less about that. More about “not accidentally funding terrorism” (or, more realistically, not giving money to sanctioned countries which can have significant consequences).
michaelt 2mo ago
CISO: "We're going to invite random strangers from all around the globe to hack us, and pay them for their findings" CEO: "I'm not sure I like the idea of us inviting people to hack us - or paying a 'bounty' to hackers holding a knife to our throat. Will they at least agree to a binding NDA and terms of engagement, in advance?" CISO: "No, they won't." CEO: "Well, at least if the hackers are in poor countries, a $500 payout for a critical bug will be plenty, right?" CISO: "No, critical issues will be 10-100x that" CEO: "Well will the average quality of these reports better than those we get from our hired pentesters?" CISO: "On average these will be the lowest quality reports you've ever seen. But 0.1% might be gold. Oh, and I need to hire 3 more guys to sift through these terrible reports. Also our sifters might miss the gold." CEO: "Oh. Well at least we won't be breaking the law though, right?" CISO: "Uh, about that..."