Legal issues of searching for software vulnerabilities

Question

What are the legal issues about finding zero-day vulnerabilities (i.e. previously unknown vulnerabilities in a program/website) and what is the standard legal practices before trying to find them if myself and the web app is being run in the legal jurisdiction of England?

As an example, I haven't tried exploiting anything yet, however, I think I've found something vulnerable in a web app. I want to try an exploit it and hopefully get a CVE but I'm not sure how to go about doing this legally.

Should I go ahead and try exploiting it, and even though I'm looking to help identify a vulnerability and disclose it to the company, should I use a VPN/Tor?

Should I contact the company and explain that I think I may have found something vulnerable and go ahead straight away or wait for their response to allow me to?

Answer 1

Yes, you must ask their permission if it is a web app, because you would be breaking into their server and would be committing computer tampering or whatever the similar crime is your jurisdiction.

If you are exploiting something on a device you own, that is OK, but you can not break into someone else's server without permission.

Answer 2

Assuming you have not been authorised or given permission to do so, in the jurisdiction of England and Wales, in the circumstances you describe, I think you would commit an offence under s1 Computer Misuse Act 1990, "unauthorised access to computer material."

https://www.legislation.gov.uk/ukpga/1990/18/section/1

https://www.cps.gov.uk/legal-guidance/computer-misuse

In that context it doesn't matter whether your intention was good or bad, merely that you behaved without authorisation. (Whether you would be prosecuted is another matter.)

If you want to confirm the exploit legally you must ask for and receive the appropriate permission to do it.