1

If a person discovers a vulnerability similar in scope to the recently disclosed Spectre/Meltdown (CPU design flaws that affect nearly all existing server infrastructure), could they legally explain this vulnerability to the vendor and offer non-disclosure for a fee, in the realm of $100,000 per month of delayed publication?

Failure to pay only results in immediate publication of the vulnerability, which is in itself a legal activity.

Would this be construed as extortion? The design flaw itself exists already, and information regarding it isn't withheld from the vender, they are paying solely for delayed disclosure to the public.

|improve this question
  • Usually, but as you hint at, it can be a tricky issue. – ohwilleke Jan 12 '18 at 19:09
1

This is extortion, and thus generally illegal. Below is the California Penal code on the matter (as you did not specify a particular state). To paraphrase: "Extortion is the obtaining of property (i.e. money) from another...induced by a wrongful use of...fear, (which)...may be induced by a threat...[t]o expose any secret affecting him or them".

However, payment to disclose your solution to the vulnerability is legal.

CA PENAL CODE
SECTION 518-527
518. Extortion is the obtaining of property from another, with his consent, or the obtaining of an official act of a public officer, induced by a wrongful use of force or fear, or under color of official right.
519. Fear, such as will constitute extortion, may be induced by a threat, either:
1. To do an unlawful injury to the person or property of the individual threatened or of a third person; or,
2. To accuse the individual threatened, or any relative of his, or member of his family, of any crime; or,
3. To expose, or to impute to him or them any deformity, disgrace or crime; or,
4. To expose any secret affecting him or them.

|improve this answer
0

It largely depends on whether disclosure of the vulnerability would be legal, which will differ case by case and could be challenged in court either way.

The key word in the California Penal code bit quoted by @sharur is "wrongful use". The thing is, the use of fear to do what you are legally allowed cannot be considered "wrongful". A good analogy here would be a skilled/important employee "threatening" his employer to resign if they do not raise his pay. Therefore, if disclosing the vulnerability in public can be proved legal, then the offer in question is legal as well.

|improve this answer
  • 1
    It is generally legal to truthfully tell people someone cheats on his wife. It is certainly extortion to ask him to pay me not to. I don't understand what that "wrongful" means, but it can't mean only threats to do something illegal. – user4460 Jan 12 '18 at 23:44
  • @notstoreboughtdirt Is there a precedent where a court ruled that what you've exampled is extortion? – Greendrake Jan 13 '18 at 0:50
  • @Greendrake Sekhar v. United States, law.cornell.edu/supct/cert/12-357 is where I found it. It is technically being appealed, but the contested issue is not if disclosure of an affair is extortion, but rather if a recommendation is property, for extortion purposes. – sharur Jan 16 '18 at 22:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.