What statutes (if any) would make it illegal to publish exact steps to exploit a network vulnerability?

Question

Let's hypothesize that John Doe, who lives in the United States, has discovered a large-scale vulnerability in the networks of a major industry, using legal means. The steps involved in exploiting it for malicious purposes are very simple.

Are there any statues that would prevent John Doe from publishing this vulnerability and documenting the specific steps involved in exploiting it? Would any whistleblowing statues protect this action?

Furthermore, would John be liable if he published open-source software that could be used maliciously in this manner?

Answer 1

Generally speaking, you can publish what you want, thanks to the First Amendment. You would indeed expect there to be technical discussion of computer vulnerabilities, once they are discovered (you don't always get what you expect, though). Doe might be contractually required to not divulge information about the company (he signed an NDA with Acme). If Doe is working for the company now, they could fire him (for no reason, or for having embarrassed them). If Doe is just some guy off the street who figures out this bug in the network, then Acme doesn't have much recourse.

"Whistle-blower" protection might prevent Acme from retaliating (e.g. firing Doe) if he is exposing "gross mismanagement, a gross waste of funds, an abuse of authority, or a substantial and specific danger to public health or safety". On the face of it, having a vulnerable network is not covered by such whistle-blower protections, although you never know how the courts will react to a clever argument.

A specific exception to the general right to publish whatever you want comes from the Digital Millennium Copyright Act, 17 USC 1201, which prohibits disseminating technology for circumventing copyright protection. Trade secret law would not easily silence Doe if he learned of the flaw legally, but it might in the long run be a way to prevent exposure. In order for trade secret law to be applicable, under the normal understanding of a trade secret, the information would have to be something that gives a company an advantage over the competition, and having a vulnerability doesn't exactly give a company an advantage. However... apparently, Blackboard went after a couple of folks who discovered a flaw: keeping a vulnerability secret does give a company a kind of advantage. This case was settled so we don't learn anything broadly applicable, except that if you annoy a company, they will try to bury you alive.

If you figure out an exploit and publish it to hackers, that would be aiding and abetting, the key concept being that you know you are helping someone break the law. However, you could publish these results in some general forum and that would not be aiding and abetting, even though criminals as well as security experts might read about this vulnerability in that venue.

Answer 2

From Eugene Volokh's recent article, The Freedom of Speech and Bad Purposes:

The Supreme Court has never decided when speech can be restricted on the grounds that the speech conveys information that can help people commit crimes, or escape punishment for committing crimes. Lower court cases have not reached a consensus on this issue, and in particular on what mens rea is required. [...] Three federal circuit cases have not required a showing of purpose, and have held that speech that merely knowingly facilitates bombmaking, bookmaking, or illegal circumvention of copy protection is constitutionally unprotected.

Answer 3

While the question limits itself to statutes, it is important to realize that in the United States, a very large share of all theories of legal liability are not codified in statutes. The vast majority of lawsuits are brought based upon common law theories, not to enforce statutory rights. With that in mind, here are some common law theories of liability that might apply.

Under some circumstances, someone might be able to bring an intentional interference with contract or intentional interference with business advantage lawsuit under a tortious interference common law theory.

Most of the elements would be met in these circumstances:

1. The existence of a contractual relationship or beneficial business relationship between two parties.
2. Knowledge of that relationship by a third party.
3. Intent of the third party to induce a party to the relationship to breach the relationship.
4. Lack of any privilege on the part of the third party to induce such a breach.
5. The contractual relationship is breached.
6. Damage to the party against whom the breach occurs.

If you weren't a competitor, there wouldn't be a competitor's privilege, which is the most common defense. Also, this wouldn't apply if the conduct was deemed wrongful for tort purposes, which this conduct might very well be considered to be.

Conceivably, one could also bring a civil conspiracy claim, arguing that you are conspiring with unidentified hackers to do harm to the company impacted. This would be particularly plausible in the case where he published open source software, and would be even more plausible if he somehow profited from the mayhem that revealing the breach caused.

The big question would be whether there would be a First Amendment privilege for otherwise truthful speech about lawfully obtained information, but as noted in another post, the law on that question is muddy.

At a minimum, I can't think of any obvious whistle blower statutes that would apply.

I suspect that it might also be possible to prosecute someone for doing so if the network was a military one and it implicated classified national defense matters (even if you never had actual notice of the fact that it was classified).