0

In the current security landscape it is common to offer responsible disclosure to (ethical) hackers to report vulnerabilities in such a way that the company does not pursue legal action against this person if the report was filed according to the rules set by responsible disclosure.

However, hacking is illegal is most countries (for reference, I'm from the Netherlands), it certainly is here. Can responsible disclosure be seen as an open invitation to try and penetrate a website or service legally? Or what is the legal status of responsible disclosure in relation to illegal hacking?

3
  • Is really nobody sure of an answer? There is an open bounty if 100 reputation, just saying.
    – user23613
    Jan 9 '19 at 13:03
  • You mention of "disclosure to (ethical) hackers" appears to denote inviting them to test the system so that they will report security issues. Is this what you mean? If not, could you clarify the difference between a company's "disclosure" and "invitation"? Jan 9 '19 at 21:37
  • Well resposible disclosure is basically a company saying 'hey, if you find a vulnerability and report it to us, we will not seek legal action'. Can this be seen as an open invitation? Let me give an example: If I start to try and hack a website, but I do not find a vulnerability to report, I did something illegal. does responsible disclosure still apply? @IñakiViggers
    – user23613
    Jan 9 '19 at 23:01
1
+100

Can responsible disclosure be seen as an open invitation to try and penetrate a website or service

Yes. Hacking is lawful if the person who gains access to the system(s) is authorized by its owner to do so (by owner I mean the proprietor or the systems/network administrator in charge of the system). The lack of authorization would trigger Section 138ab of the Dutch penal code. An open invitation certainly amounts to authorizing anyone to try to hack the system.

Beware that this English translation of the Dutch penal code is flawed and misleading. It portrays Section 138ab as defining the concept of "unlawful entry" purely in terms of the method of gaining access, irrespective of the existence or absence of owner's authorization. The translation inaccuracy lies in automatically attaching to "the act of penetrating" (that is, binnendringen) a connotation of "unlawful".

The key word in the legislative language of Section 138ab is wederrechtelijk, which means "without agreement by the right/title holder" (zonder toestemming van de rechthebbende, see here or here).

As for your follow-up question:

If I start to try and hack a website, but I do not find a vulnerability to report, I did something illegal. does responsible disclosure still apply?

An open invitation or individualized authorization is crucial for immunizing yourself against prosecution or liabilities.

Although the language of Section 138ab is strictly in terms of actually gaining access to the system, the mere attempt to hack a system might trigger other sections of the penal code. For instance, a failed attempt that has the effects of a DOS attack could "hinder the access to or use of a computerised device or system by [...] sending data", Section 138b. Similarly with the first item of Section 139c, or item 1 of Section 139d. Hence the importance that the attempt to penetrate a system be authorized beforehand: Wie dus andermans beveiliging wil testen, kan dat maar beter vooraf vragen.

3
  • An open invitation certainly amounts to authorizing anyone to try to hack the system. I'm still really curious if responsible disclosure can be seen as an open invitation or not. The following link is an example of responsible disclosure: responsibledisclosure.nl/en
    – user23613
    Jan 10 '19 at 3:37
  • If you discover a vulnerability, we would like to know about it so we can take steps to address it as quickly as possible. We would like to ask you to help us better protect our clients and our systems. Merely discovering a bug should never lead to legal action being taken, so I would assume there is more to it then just discovering a bug: The only thing left is responsible disclosure being an open invitation to hack a website which I would find very difficult to believe as well.
    – user23613
    Jan 10 '19 at 3:39
  • I gather that when you say "responsible disclosure", you actually mean "invitation to hack conditional on the responsible disclosure of vulnerabilities". The example you provide indeed authorizes anyone to test and hack (responsibly, prudently) the system at issue. You are right in that merely discovering a bug does not suffice for avoiding prosecution/liabilities: The discoverer has to timely comply with the conditions listed in the authorization/invitation so that notice or existence of the detected vulnerabilities are not abused by him or others. Jan 10 '19 at 11:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy