Liability for damages in the U.S. for finding and disclosing "0-day" computer exploit

Question

In the IT/Programming security world, usually people contact the vendor/owner of a particular software if they find a bug or security vulnerability and give them time to patch it before releasing the bug or vulnerability for public scrutiny/awareness. This is usually as a courtesy though unless you're bound by contract. But as asked in If I Find or Create a 0day: What if I find a vulnerability in a widely used piece of software?

Can I be held liable for damages if I release "Proof of Concept" code to the public without giving the vendor time to properly patch and update its vulnerable code?

UPDATE: After having a discussion about this question with some peers, I realized I need to be a bit more specific with the question: Security researchers usually work with the vendor to try and patch (fix) the error/vulnerability. If after sufficient (30 days?) time has passed and the vendor has not fixed the code then a full disclosure is released publicly.

Can I be held liable for damages caused after the release of a "Proof of Concept" code if the software/vendor is open source? What if the vendor/software is closed source?

Answer 1

Can you be liable for damages? Under Tort Law, yes.

Let's assume someone developed a virus based on your code. The virus caused millions of dollars of damage. The plaintiff (software vendor) can argue that:

1. You have a Duty of Care

to avoid acts or omissions which you can reasonably foresee are likely to injure your neighbor

Donoghue v. Stevenson (1932) (UK)

The concept of Duty of Care is also found in U.S. law, for example in MacPerson v. Buick Motor Co. (1916), which established that negligence does not require a contract.

2. Breach of Duty: A reasonable person can foresee that the "proof of concept" can cause harm. The act of releasing code, therefore, falls short of the expected standard. If you are a IT professional, it is going to be difficult to defend this point.

3. There is a causation relationship between your code release and the resulted damage.

4. You are liable for negligence.

5. Damage: It is likely that users will sue the software vendor for their loses. The software vendor will then sue you, since because of you, the software vendor has to compensate to its customers.

This, of course, depends on what exactly did you release to the public. For example, if significant effort is needed to convert your "proof of concept" to an actual exploit, and you have provided a workaround to avoid this vulnerability, you may defend yourself by arguing that the cause and effect linkage is too remote.

---

So I must keep the report private? What if the software is open source?

Not really. You should take reasonable measure to ensure that your "proof of concept" is not an actual exploit, and a hacker needs considerable time to develop a functioning malicious software. CVE is a platform where vulnerabilities are publicly shared.

---

What if you have given the vendor reasonable time to fix the vulnerability?

It does not matter (to you) if time has been given for the vendor to fix the vulnerability. It does matter for the vendor, because if something happens later, the vendor is liable for knowing the problem well in advance and have not allocated the appropriate resources to correct the problem.

To demonstrate a vulnerability exist does not require instruction of how to utilize this vulnerability. For example you can record a video showing the effects of the hack.

---

Here (Wayback Machine; original link is dead) is an interesting read about Motorola taking matters into their own hands after they discovered a vulnerability on the Xerox CP-V system and Xerox did not patch the problem.

Answer 2

A: (to the revised version of the question) It's possible, but not at all likely, that you would be found liable.

1. While you have a Duty of Care, so does the vendor, who is not likely to want to draw attention to their own Duty of Care failure.

2. Mere disclosure of the vulnerability, after the vendor has had ample time to address it, without a working exploit is not necessarily likely to cause net harm. Arguably, your duty - to warn other users of the software of the vulnerability - over time becomes more in line with your Duty of Care than suppressing it does. So the other users are unlikely to pursue a case as well.