7

Can someone who discovered a zero-day exploit in a program sell the information, and does the applicable jurisdiction depend on his location, the buyer location, the location of the developed of the product that the exploit targets, or something else?

  • 1
    You are, at a bare minimum, required to obey the laws of the place you live. The answer thus depends on where that is. – cpast Jun 10 '15 at 21:16
  • @cpast place where I live, or place where I perform the sell? – Franck Dernoncourt Jun 10 '15 at 21:18
  • 1
    Either/both. The place where you are physically located is somewhere where you always must obey the local laws, but those laws might not prohibit a sale to someone in another country. – cpast Jun 10 '15 at 21:23
5

It might possibly be illegal.

For criminal law, usually you need to obey the laws of three countries:

  • The country you are a national of (by personality principle)
  • The country from where you make the sale (by territoriality principle)
  • The country that hosts the attacked interest (by territoriality principle)

Then it depends on the jurisdiction (and other factors) whether the sale is legal or not. I'll use the example of my country, Czech Republic.

There is a crime called "Unauthorized access to a computer system or data storage device". For example, you commit this crime by exploiting a vulnerability in a web application and copying the web owner's data on your computer.

It is also codified that whoever wilfully facilitates the committing of a crime by providing the criminal with resources (such as the exploit) is considered to have also committed the crime. For this to apply, you must have known or expected that the exploit will be used to commit a crime. The courts would decide this.

  • I like this answer and for practical purposes the three point list is probably correct. Its just worth noting that those categories are not closely aligned with the relevant legal analysis, which turns on questions of personal jurisdiction and choice of law not on the categories listed above. Not a criticism of the answer, just useful information for readers. – HarveyBirdMan Sep 1 '15 at 3:23
  • This is exactly the same as the UK (even the crime identified). – Andrew Leach Sep 18 '15 at 12:50
  • 1
    you must have known or expected that the exploit will be used to commit a crime this is the key piece. – Ángel Sep 23 '15 at 22:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.