Is it legal in the United States to buy a vulnerability in a well-known software but without using it in the wrong way? like exploiting it against users.

  • 2
    Do you mean "pay a person to tell you the technical details of a software vulnerability"?
    – user6726
    Sep 19 '17 at 23:26
  • 1
    Even if it's legal (and I'm not saying that it is), the act of buying such a vulnerability could give the US government probable cause to get a warrant against you to see what else you may have on your computer. Sep 22 '17 at 10:29

It must be legal. Three reasons.

  • Paying to be told information capable of misuse is commonplace. Journalists can do it.

  • Many big software companies publicise schemes where they will at to learn of vulnerabilities (in their own software but legally that isn't important, it would be legal if not their software as well.)

  • Security researchers may pay to learn of vulnerabilities.

It's not likely one could criminalise one aspect without criminalising others, and the crime is misuse, not paying to learn of misusable information.

HOWEVER...... it may be seen as evidence of criminal intent. If so there might be interest in seeing if you have a likely criminal intent, or other criminal connections. But the act in the OP would not inherently be illegal.

  • "Its not likely one could criminalize one aspect without criminalizing others" Sure it is, you just license certain individuals and only those individuals are allowed to participate in the licensed behavior. Not saying that's the case here though.
    – Matt
    Sep 25 '17 at 16:19
  • It will be interesting to watch attempts by any (nominally democratic /western) government to require persons who might pay informants for non-public information, to have a license to do.so......
    – Stilez
    Sep 25 '17 at 21:19
  • en.wikipedia.org/wiki/…
    – Matt
    Sep 25 '17 at 21:41

Although your question pertains to "buying from US" and does not provide any details of where you are located or against which jurisdiction you wish to use it against, it is tough to provide a clear answer. Are you planning to buy from US and "test" against some person or organisation in the USA ?

Notwithstanding the above, suffice to say that in the United States, the Computer Fraud and Abuse Act (CFAA) criminalizes certain activities on or by a computer. See U. S. v. Ross William Ulbricht.

Bonus bedtime story:https://antilop.cc/sr/trial/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.