9

Suppose you were working at a company for a few years, and during your time there you found a few computer security vulnerabilities that could be used by potential attackers. If you were to compile them into a report, would it be legal to sell it to that company (in the United States)?

Edit:

In cybersecurity, there's a term called responsible disclosure. In essence, you notify the company of a vulnerability and give them plenty of time to take care of it. Typically, if the company doesn't do anything about it, the person will publicly disclose the vulnerability to get the full attention of the company (full disclosure). What are the legal implications of full disclosure?

Improve this question
15
  • 13
    what does your employment contract say about work you do during the course of your employment? who does it belong to?
    – user20574
    Commented Aug 29, 2022 at 14:26
  • 14
    @bdb484 But if the OP got the knowledge of those vulnerabilities during his work contract and did not notify them...
    – SJuan76
    Commented Aug 29, 2022 at 14:51
  • 25
    If I were at that company my first call would be to our company attorney to have him find out what legal options they have against you since you did not report these vulnerabilities immediately.
    – jwh20
    Commented Aug 29, 2022 at 16:19
  • 15
    @bdb484 I find it difficult to imagine that private information one learns about a company while employed by the company isn't subject to conditions of the employment contract beyond the end of the period of employment.
    – phoog
    Commented Aug 29, 2022 at 18:38
  • 7
    @bdb484 If you knew of the vulnerabilities while you worked there and tried to sell that info to them after you leave the company you could be setting yourself up for criminal/civil liability as it wouldn't be a stretch to say it is an employees duties to report vulnerabilities they discover to the company and not to try to profit off them.
    – Joe W
    Commented Aug 29, 2022 at 19:35

4 Answers 4

Reset to default
20

Well, as always, the answer is "it depends".

It isn't illegal per se.

If both parties agree, it's good business. You get paid for the work of compiling the report. For example, let's say you leave and are no longer working for them, and they call you and say "hey, you know those security vulnerabilities you were talking about last year? Yeah, the boss finally decided to give it priority, but it seems we kept no notes in that meeting. Could you compile a report for us? I know you no longer work here, but we would pay you a little more than the normal contractor rate if you are interested". That's perfectly fine.

Now, not disclosing them when you found them could be seen as a breach of contract, which implicitely includes the duty of loyalty. Keeping it a secret to cash in on later is certainly sleazy.

The compiled report might, depending on state laws, your specific contract, and who can pay the better lawyer, end up as their's. You can only compile that report because you worked there and you got knowledge of those vulnerabilites only as a part of your job.

And finally, even if you did compile a report and it is waterproof and it is yours exclusively, it very much depends on the "else". What if they just say "no thanks"? Selling that report to someone else is illegal. So you have exactly one legal buyer and that buyer knows it. Does not sound like a great bargaining position.

If you approach them, it takes a lot of skill and maybe a bit of legal training to make sure it does come across as an offer of "good business". I think it would be easy to be misinterpreted as either blackmail or selling them knowledge they legally probably already own.

So unless you are certain you can fit into that "good business" model of selling your work compiling a report, instead of selling the knowledge of their secrets, it might be safer to not do that.

If they approach you, it should not be a problem, but if you approach them, it will be a mess, no matter how well you mean it.

Improve this answer
14
  • 16
    If that were to happen, you would be the first suspect to be investigated.
    – erickson
    Commented Aug 30, 2022 at 0:13
  • 3
    Hans Henrik, if you know about a vulnerability it is utterly illegal to either use it or to sell it for someone else to use, and very likely illegal to publish it. Now it would be unwise for a company to tempt you into becoming a criminal, but that doesn’t matter. And you will very likely hurt others.
    – gnasher729
    Commented Aug 30, 2022 at 11:10
  • 3
    Also worth noting that in many cases it would probably mean OP has kept confidential information they probably were not supposed to keep.
    – jcaron
    Commented Aug 30, 2022 at 14:11
  • 4
    @hanshenrik If that comment was not satire: This kind of attitude is what gets security people thrown in with blackhats sometimes.
    – rackandboneman
    Commented Aug 30, 2022 at 20:42
  • 4
    @akostadinov: That's true of a criminal court case that you have to prove beyond a reasonable doubt - but in a civil lawsuit, the company would only have a preponderance of the evidence. So it'd trip civil case possibilities almost certainly, and criminal charges would only get applied with more evidence - some that might come across via a warrant for the information you had withheld.
    – Alexander The 1st
    Commented Aug 31, 2022 at 8:52
20

No.

An employee has a duty of loyalty to the employer and profiting from this personally (without the employer's consent) would breach the employee's duty of loyalty to the employer.

The common law concepts are explored at Jet Courier v. Mulei, 771 P.2d 486 (Colo. 1989) ("an agent is subject to a duty to his principal to act solely for the benefit of the principal in all matters connected with his agency."), and while the facts are different (it involved an employee plotting to jump ship to a new company while working for an old one) the legal principles are the same.

Improve this answer
4
  • 5
    Are you sure we're reading the same case? The case link quotes are as follows: the Colorado Court of Appeals affirmed the trial court's decision that the respondent, Anthony Mulei, did not breach any duty of loyalty to his employer, Jet Courier Service, Inc. (Jet), when he organized another company, American Check Transport, Inc. (ACT), to compete with Jet in the air courier business and... the court of appeals agreed with the trial court that as a matter of law, neither Mulei nor ACT engaged in a civil conspiracy to harm Jet's business interests
    – Nelson
    Commented Aug 30, 2022 at 3:37
  • 3
    @Nelson: That was the Colorado Court of Appeals's decision, provided for context. The Supreme Court of Colorado did not make the same decision. The Supreme Court of Colorado decided that the trial court's findings of fact were insufficient to determine whether Mulei breached a duty of loyalty, and remanded the case for retrial.
    – user2357112
    Commented Aug 31, 2022 at 1:37
  • 1
    So why wasn't the final results linked? It's just an add thing to do...
    – Nelson
    Commented Sep 1, 2022 at 3:43
  • @Nelson It is the final appellate result - what happened on remand is irrelevant for purposes of establishing case law. It is a Colorado Supreme Court case. The quoted language in your comment is the Colorado Supreme Court's summary of the procedural history of the case.
    – ohwilleke
    Commented Sep 1, 2022 at 17:15
4

Answering this part of the question:

you notify the company of a vulnerability and give them plenty of time to take care of it. Typically, if the company doesn't do anything about it, the person will publicly disclose the vulnerability to get the full attention of the company (full disclosure). What are the legal implications of full disclosure?

Consider this analogy:

Alice lives with Bob and learns that he has a peculiar medical vulnerability: if one pulls his left nipple and his right earlobe simultaneously, he well may suffer a severe heart attack.

She tells him that he should fix it but he won't.

She leaves him and posts this ad: "Wanna cause Bob a heart attack? Here is how.".

Legal implications: breach of confidentiality, and, if someone uses Alice's info to kill Bob — accessory to murder.

Improve this answer
2
  • 1
    "Wanna cause someone a heart attack? Touch their left nipple with a powered electrical cable!" - does this also count as accessory to murder?
    – Dmitry Grigoryev
    Commented Aug 31, 2022 at 11:38
  • 4
    @DmitryGrigoryev Nah, because that statement contains publicly available knowledge only, nothing private/specific to Bob.
    – Greendrake
    Commented Aug 31, 2022 at 11:52
-1

Why would that be any different from skills you learned while at the company, you quit, and now they want you to help them with a problem that only you know about? Are you obligated to help them free of charge?

What if you said, "Hey Jim, I know a way you could increase the throughput on your network and stop paying rent on half your fleet. Want me to tell you how?" Are you obligated to tell them free of charge? Would be be in contempt of court if you didn't?

Improve this answer
1
  • 1
    The OP is unclear about whether the report is being offered while still employed or after leaving. If the former, yes you are obligated to help them free of [additional] charge, because they're already paying your salary (presumably). Turning around to sell them that information unsolicited afterwards is a great way to have them accuse you of planting the bugs yourself for profit. If they come to you after you've left and they ask you, then you charge them consultants' rates to help out and most definitely shouldn't work for free.
    – Bobson
    Commented Aug 30, 2022 at 21:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .