2

I'll cite an example that came to my mind to crisply explain the essence of my question. It might contain some extreme assumptions not rooted in real world examples.

Computer scientist John Doe who is working on his own pet project detects a vulnerability in a mobile hardware related to fingerprint storage while analyzing bunch of social media posts. He found that whenever a user posts something from their popular social media application, the device adds some data to that post that leaks the information related to their fingerprint. Anyone with fair technical understanding can then reproduce the fingerprint from such posts. These fingerprints are the gatekeepers to all the funds that are stored by the users on their devices.

John Doe is now in a dilemma (legal not ethical). He is uncertain whether revealing this vulnerability publicly is legal or he should do it discreetly to the manufacturer. This smartphone manufacturer has 40% of the market share and this public revealing might lead to loss of funds for all the users who have used this fingerprint storage option.

  • 1
    Depends upon how he found out, what he gets out of the deal, and what his relationship is to the affected parties. Someone who is relying on a trade secrets subject to a non-disclosure agreement has different obligations than a total stranger. Who, if anyone, is paying him to look into it and why? The life of the law is not reason, it is experience. Facts and context always matter. There are no general answers. – ohwilleke Oct 28 at 17:41
  • @ohwilleke I have updated my question. John was working on his pet project on analyzing social media posts when he made this discovery out of a sudden. He was not paid by anyone to detect such vulnerabilities. His sole intention is to harm all the people affected by disclosing this vulnerability (heartless John :( ). He wants to know the legality of such a move. – Ugam Kamat Oct 28 at 18:05
  • This helps a great deal and it now has a much more definite answer (which I may or may not have a chance to answer today). – ohwilleke Oct 28 at 18:10
  • @ohwilleke no worries. Looking forward for your answer. :) – Ugam Kamat Oct 28 at 18:11
1

The legality and generally accepted ethics for security professionals differ on this point.

From a legal perspective, unless John Doe has signed a legal agreement to not reveal the information (most commonly a Non-Disclosure Agreement, or NDA) or has a responsibility to keep the information private, there is no legal penalty for revealing truthful information*. Generally, one is safe revealing truthful information unless one has agreed to not do so, or one is doing so specifically to harm someone else.

Generally, security professionals will alert software manufacturers first and give them a reasonable amount of time to work on a solution before announcing the vulnerability publicly. This is generally seen as a way to give manufacturers a "head start" in crafting a solution to the problem before the increased knowledge of the flaw can lead to increased exploitation.

*If John Doe asks for money to delay or stop the announcement that may constitute extortion, but that is outside of the scope of this question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.