Can someone who discovered a zero-day exploit in a program sell the information, and does the applicable jurisdiction depend on his location, the buyer location, the location of the developed of the product that the exploit targets, or something else?

  • 2
    You are, at a bare minimum, required to obey the laws of the place you live. The answer thus depends on where that is.
    – cpast
    Jun 10, 2015 at 21:16
  • 1
    @cpast place where I live, or place where I perform the sell? Jun 10, 2015 at 21:18
  • 2
    Either/both. The place where you are physically located is somewhere where you always must obey the local laws, but those laws might not prohibit a sale to someone in another country.
    – cpast
    Jun 10, 2015 at 21:23

1 Answer 1


It might possibly be illegal.

For criminal law, usually you need to obey the laws of three countries:

  • The country you are a national of (by personality principle)
  • The country from where you make the sale (by territoriality principle)
  • The country that hosts the attacked interest (by territoriality principle)

Then it depends on the jurisdiction (and other factors) whether the sale is legal or not. I'll use the example of my country, Czech Republic.

There is a crime called "Unauthorized access to a computer system or data storage device". For example, you commit this crime by exploiting a vulnerability in a web application and copying the web owner's data on your computer.

It is also codified that whoever wilfully facilitates the committing of a crime by providing the criminal with resources (such as the exploit) is considered to have also committed the crime. For this to apply, you must have known or expected that the exploit will be used to commit a crime. The courts would decide this.

  • 1
    I like this answer and for practical purposes the three point list is probably correct. Its just worth noting that those categories are not closely aligned with the relevant legal analysis, which turns on questions of personal jurisdiction and choice of law not on the categories listed above. Not a criticism of the answer, just useful information for readers. Sep 1, 2015 at 3:23
  • 1
    This is exactly the same as the UK (even the crime identified). Sep 18, 2015 at 12:50
  • 2
    you must have known or expected that the exploit will be used to commit a crime this is the key piece.
    – Ángel
    Sep 23, 2015 at 22:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .