It's a pleasure to be here. What's my accent? Anyone knows? What, what
is my accent? Where are from? Where am I from?
Any guesses? Okay Israel, all right. And enjoys I am Israeli. And in fashion I
want to start with a direct question. So if you know of Israelis that's part of
what we do, often. Who is this guy? Anyone knows? I have one per person. Yes.
Okay. This is Kevin Finster. He's instilled and respected security
researcher. And he found the one thing that, according to reports, leaked
personal information of DJI consumers, according to the media reports. And at
time when Kevin has done this research, DJI in fact had an active bug bounty. They just
launched a bounty and Kevin, although he has you know, lots of hair. As you can see.
He wanted to do the right thing, he waned to wear the white hat. He wanted to report
this vulnerability under this new, just launched DJI bug bounty. Now, the way this
bug bounty was launched at the time, according to the reports, as you can see,
was in this kind of fashion. There wasn't really a clear policy, with a clear scope.
It wasn't a bug bounty kind of policy you are used to seeing, you know.
Contract with the elements. It was more of a PR announcement along this lines.
So, because there was some unclarity according to reports, expected scope, Kevin
contacted DJI. And he asked them is this vulnerability in scope? And they said
according to the reports, it is in fact in scope.
And you're authorized to conduct this testing.
Now we got the active ability. They offered him a thirty thousand dollar
reward for that vulnerability. So I don't know if we have bug hunters today in the room with
us? But, thirty thousand dollars throwback is pretty high. That's a pretty high back.
That's my priority back and then the plot thickens. DJI also wanted, according
to media reports, Kevin to sign an agreement. An agreement that he found was
one-sided. One that lets him legally exposed. So Kevin
refused to sign this agreement, and in negotiations as far that process, a legal rep
drafted a letter mentioning that Computer Fraud and Abuse Act was
exchanged, according to the reports. Now, this is an interesting example, because
this is one of the first time that we heard about a potential legal question
going public in a bug bounty settings. So how does this story ends? Anyone knows?
Anyone heard? Kevin ended up walking away from an improved thirty thousand
dollar bug bounty. So, refusing to sign a contract and walking away from that
improved background. And I think this is a bill you know,
there are multiple versions to the story. This all according to reports and I
encourage you to go online and you know, look at all the versions to the story
equally. DJI responds to this article. But isn't this is, in fact an
interesting you know, story that just relied on some of the emerging aspects that
we're seeing when it comes to the legalese and the interactions of
bug bounties and one ability disclosure programs we don't want. So
what I'm going to be sharing with you today, is a bit about that landscape. So
just show hands anyone here is you know with my prior work? Not at all, great. Because we
have a whole hour to dig into that. So again, so this is mostly repair work that
I did before I joined Intel. Today my director, I had a director global cyber
security policy with Intel. And also teach at UC Berkeley, the master in
cybersecurity program. But I did this work before I joined Intel as part of my
doctoral degree in the law, at UC Berkeley law school. And part of that work
I really dived into a lot of contracts. Hundreds of contracts. Both along with
the disclosure programs, backgrounds and platforms and most important feedback
bounty programs. To inquire what is going around in that landscape, and I'm gonna
be sharing a lot of that research we do today and also going into some of
the transform here seen with respect to bug bounty legalese and just you know,
looking at some myths that are circling, circling around. Why is this
important? This is important because there is a conception among the
information security community, among the research community, that you know, the law
matters here. That they're legal risks. And you know that's the empirical
research. So this is one example, this is work done by since D. Anyone here from
you know, the city Phoenix and democracy technology there are doing very
important work and this type of in this research what they did is they interview
twenty leading information security professionals hackers and other
professionals working in this field and they asked us specifically about the
laws and fifty percent than half of those researchers said in that research
that they literally think about copyright law and the CFAA and laws that
are going to be talking about them today as they're doing their testing so much
that this is a consideration when everything when they are thinking what
if they disclose the mobility and they might even change the way they test
because of these because of this law moreover we know from additional
research that was done among 100 security researchers that 20% of them so
this is research looking at 100 research also from that academic center setting
that's 20 percent of them said they were threatened in one kind of way legal
action and a broader research that was conducted in 2015 with more than 400
researchers they found that 60% 60% 6-0 of the researchers reported that this
consideration of legal risk is something that are thinking about when there are
that Junction when when they need to decide where it reports to a cooperation
of our mobility so we know that this conception is emerging that is existing
among the community and there might be some gap between how the law operates
and that reception but it really matters because
one foster that collaboration between security researchers between hackers and
companies and even governmental governmental entities we want to foster
but collaboration because at the end getting the research to the right to the
right hands matters right and this is for a lot of what my work was focused on
and I'm not alone in this kind of relaying there are a lot of people that
are operating this remained in fact City T is part of this work they also
collaborated and basically got a lot of experts in the field of security 50x
which sign a letter to explain that we need to address this issue of the
culture of legal risks that we have in information security to ensure that we
and bond we want advises the release of elbow vulnerabilities out there we don't
invite folks quarter and we are able to foster coordinate disclosure practices
so a lot of ones you're gonna see here today is basically a means a way to
foster that collaboration to build a bridge between companies and hackers and
this is focusing specifically on bug bounties but of course this is just one
example of what we can do in the broader data system so let me start with this
question about this how many of you familiar heard about the concept of
course these are programs in which corporations big corporations and even
other entities are in Buckingham statistics systems in exchange for
monitoring their interpretation of reports so how many of you
see something that looks like this this is a background in program that we've a
website over by party okay even from from those for the for the few
that I have here that have seen something like this have you ever read
the legal terms okay great so basically what we are seeing is this landscape of
bug bounties that is operating that all this matter of invitation to conduct
testing all this market even if you will legal even exchange of abilities is
operating under contracts okay so this is the first kind of inside this this is
an area that is mostly dictated by trans abuse contracts like EULA's right and
utilizes license agreements that you probably are canoeing or
other I exact terms that you click on on every no your everyday kind of practices
you go through the internet and I'm going to be looking at those contracts
and giving you some of the background and how those contracts interact with
computer crime laws and other aspects would be see the back bumper lien but
first of all I want to clarify then again I'm talking about the entire
research before in details I'm though I'm a lawyer in Israel I'm
not your lawyer this is not legal advice and I'm expressing my own opinions there
you have it you know of the fine cream the disclaimer just in line with the
other I accept terms that you want to see here today so the bottom of the
phenomena phenomena is really expanding this is a this is being a trend we know
there is value in that stand right we have seen it not only in
Silicon Valley corporations like Google Intel Facebook and others but also a
more traditional sectors like transportation aviation and even the
government the government has conducted multiple formats within the center
bombing in the Department of Defense I think they're into the fifth or sixth
program they're doing right now they have extended it to more platforms in
which they actually invite people from all over the world to hunt and find
vulnerabilities on what you might consider you know the most substance
systems of all and because of the growth of this phenomenon it wanted to take a
look and see how we adjusting the legal landscape to support that because this
is all you can say a newly emerging field in security but it's definitely
expanding very rapidly and our time to say that Intel the company that I work
for also has a bug bounty program that is very successful so I first of all
would like to invite you all cyber security professionals here in the room
to hunt on our program but the point is that we're seeing this expansion in
multiple sectors including in the hardware and firmware sector and this is
just one success story coming out out of the back bounty relax that there are lot
of conversations founders that I what I'd love to kind of
stress out the more the most is that the way the battery these programs actually
allow us to develop the pipeline for track security so this is Jack Campbell
any of you know him you know he's a great guy I just met him a few weeks ago
now he studies in Stanford but this guy Jack
before joining Stanford why after basically graduating from his last year
in high school got to make that we turned into ten tomorrow that's after he
participated in multiple programs of the Department of Defense nearly we need all
the best challenge points out there for the hack the Pentagon Act the army and
after US Air Force programs and what a best life about Jack is not only that is
really cool nine disability story about how that buddies are being used to
foster the timeline and get people excited about security and even hired
them in very non-traditional ways if you can think about it but also because of
this segments so Jack's tells us that part what he likes about the bounties as
he can eat is able to participate in paying for skill set in America is legal
without having to hide his findings or to be worried about the legalese or the
implications and I think that is one of the major advantages of bug bounty and
that is why I want to make sure that as we are operating in this field we also
think about the legal aspects of it and as I mentioned really cool story that
because of that black multi participation Jack got to spend three
months before with a Pentagon okay now another
landscape that is really developing is the vulnerability disclosure landscape
and I want to make sure that I'm distinguishing between bug bounties and
vulnerability disclosure programs so the main difference between pack bounties
frameworks and which corporations are invited external hackers to test their
system in exchange for monetary rewards and vulnerability disclosure programs
which are basically frameworks to create a channel of communication a weapon
security I'd email process for in which you details how you're gonna address and
received vulnerabilities from external researchers that are reported to you
without monetary rewards that's a key that's the distinction between one
bility disclosure programs and bug bounties now we also see a major
especially anomaly because believe it or not regulators are actually pushing
towards fallibility disclosure products they are saying that you as a user
corporation is part of your security maturity as part of your reasonable
security practices you need to have that channel of communication in place so
that when someone is fighting someone something they were able to report it to
you and you need to have a process to handle that not only that there's deceit
in two cases so the main federal the main regulator who deserve protection in
the Mountain States the Federal Trade Commission actually mentioned this
aspect that needs to have the one ability disclosure program or the way
that is really the process and it can process a place to receive on abilities
into cases in which yes armed with other circumstances they viewed the lack of
such process unreasonable security measure
so basically illegal under the law because of this expansion for mobility
discussion as well and the fact that it supported
by so many regulators are out there we are also seeing more and more of these
policies accepted as well and of course they have legal implications so let's
dive a little bit into the moment Computer Fraud and Abuse Act the main
active hacking federal law in the nineteen states from here some of you
are okay there are misconceptions around the Computer Fraud and Abuse Act and I
do encourage you to learn more about it if you're looking for a great resource
by the way little Bailey who is one of the biggest experts out there he's a
special muscle to the DOJ computer crime division has a lot of talks from
blackhat and besides online and it gives a really great overview of the law
including some of the things we're gonna focus on today so if you're looking as
you know for something as an additional resource that's one thing that is out
there so the Computer Fraud and Abuse I've been an actual the important
concept you need to kind of there are many things to think about but they
really the poor or that law is like this notion of authorization and the main
language suggests that whoever intentionally exists accesses a computer
without authorization or in a manner which exceeds the authorization I'm
going to speak about that and obtains information from a protected computer
that is defined pretty broadly to basically include any computer is
connected today tracks it is inspecting commerce shall be punished by this and
that etc so this law has both criminal and civil liability and if you look at
the statistics that is provided by the Department of Justice interestingly
there are not a lot of criminal cases that are using this provision against
security researchers they're really really not a lot maybe two in all the
history of the State Fair the reason however our additional component a
component of similar which means that private parties can use
the CFA to other private parties individual companies employees etcetera
that part of the CFA is more litigated when it comes to this section so what I
want you to take away from here is this idea of fluoridation now if we have any
pen testers in the room yeah so often you take this contract but you
always have is consent to test us it's a key component of any of any contest
contract which interacts with this provision that relates to authorization
it's this idea that I consented for your testing of my device on my computer now
we do have something that is called circuit splits and my cervix leak I
don't mean an actual circuit I mean there is a conflict in which different
states inside the United States in the federal system are interpreting the
opinion and specifically this notion of optimization and what does it mean to
explain conversation and that suite is a lot of the kind of poor tension and
debate when it comes to state faith I'm gonna give a very quick overview and
reminding everybody this is not a good advice you should always seek your own
console so there is one key kind of interpretation that is focusing on
circumvention of technical measures this means that of authorization is
based upon technical measures ok I include authentication barrier on the
way I could have password wall you need to you know you need to provide a
concert forget it if you have circumvented
password you have circumvented a technical nature technological assurance
and answer convention could be exceeding authorized access so that's one kind of
key interpretation that is being used mostly in the ninth circuit for example
in the first circuit ninth circuit by the way is California among others so
all the Yukon Valley and that is a narrow definition to the CFA and it's
notional conversation because you have to have those technical barriers in
place now there is another another kind of way to think about this and according
to that kind of approach even circumvention of contract language so
violation of employment contracts could be exceeding authorization because I
have established the boundaries of the flurries they should be our contracts
and if you violated something for example you use the information in a way
that is not consistent with the contract you have exceeded authorization and
violated the CFAA and that approach is mostly debated and caused a lot of case
law and if I can recommend you one case to look at is the nazil case in which
California looked at this approach and said wait a minute this is not what the
CFA was meant to address the CFA was about happy it wasn't about contract
breach of employees so this debate is still actually ongoing it's a really
interesting debate we have one case in the DC Circuit so in the Washington area
that is actually looking at the practice I wouldn't equality so these are people
that reverse-engineer algorithms from the outside and whether spreading is the
violation of the CFAA in public facing websites so that question of the
legality of scraping under the CFA is actually right now highly debated in one
case in DC and to another case called IQ in the Ninth Circuit so it's a really
interesting area of the law and I know you're really curious about that but the
case no but I do encourage you to take a look it is it is an important area now
in addition to the CFAA the Computer Fraud and Abuse Act we have another one
the DMCA how many of you heard about Nixon many hands right the DIA is very
famous among the security community also because of the extension and the trial
proceeding proceedings in which the Copyright Office created a special
exemption for the purpose of good faith security research so I'm going to talk
about that the reform what's to do with the CF with the DMCA the density at the
Digital Millennium Copyright have and the together you get I mean any
Copyright Act is in fact a provision that is prohibiting the circumvention of
technological measures that effectively control the access to software as a
copyright protected and there's some statutory exceptions so the law itself
has exemptions for the purpose of encryption and research in that area but
they have a lot of limitation for example for security testing you leave
you know you have some conditions that you need to follow in order to get them
but the copyright that the law also recognized that with technology
development and innovation we might need new exemptions from this active hacking
provision that we like that we have in a copyright law so they created a process
a process in which people can go to the Copyright Office to write to an
administrator regularly runs operating operating in this field and tell them
give us an exemption for three years from this anti-circumvention provision
for the purpose of doing something that we the public need and is not really
undermining copyright protection and one of these exceptions that started already
to the 2015 really because of great work many people
was actually be nude and expended last year so we do have an exemption from the
DMCA from that specific law remember it only gives you that the NCAA doesn't
deal with the CFAA that still operating in the background and that extension
enables which it fosters whose face appear to be our research but it also
has some limitations now one the humanization was the device limitation
original 2050 this was actually never narrowly applied to consumer voting
machines and Auto munille among others and also medical devices but that device
limitation was removed so now this this exemption is applied to many other
devices as well but there are still other issues like you need to lawfully
acquire the device you need to only engage in the practice solely for the
for the purpose of good security research you still need to not violate
any other law including the same there you're going to talk about that and you
need to carry the the reason we need to conduct the research in a manner and in
an environment that is done to avoid any harm to individuals or the public which
is really the key concern that's why we are so focused about quoting one ability
disclosure because we want to minimize that harm that potential harm for
end-users so you see there are many conditions to this exception as well but
it's pretty it's already broader it's applicable and what we knew once already
in 2018 so I encourage to keep following those preceding and where that exemption
lies but most importantly where the spark battlefield
you know gets into that discussion where does bug bounty interact with that
discussion so in fact in that kind of relationship between all these law the
key ideas of conversation also in the context of the DMCA the practice the
goonies exemption one the practice that you originally didn't
get the authorization of the owner for if you have those certification the
percent of the owner then you do not need that exemption because you you are
you have the consent consent to this system and the way those laws are
interacting is essentially the backbone T terms where are we going to see that
notional authorization played out now when I first conducted this research I'm
talking about the year year and a half ago when I was looking through the
torrents of our bounty programs this notion wasn't as developed we haven't
seen a lot of are going to terms actually including specifically this
idea of authorization inside their program and specifically authorizing
access for the purpose of this law but since then we have created industries
created standards in this area to really address this tension and use the
contracts of the bug bounty to address some of the legal risk in order to not
be relying solely on the DMCA exemption that as you saw has multiple conditions
that you need to address in order to get it so what is this notion of a bug on
the safe harbor so safe harbor the concept yes we do have something right
so this is this is the idea the idea is in a contract I can give you
optimization and I can in my contract in this case in a bug banking policy
includes our provisions that will allow you to test and not basically feel that
risk or be worried about the legal implications because I specifically
addressed those those risks in a contract language now in that landscape
you're discussed a movement so when I first did the research again we didn't
have a lot of safe harbors out there I looked at the tentative part of policies
and in fact although we that we already had some guidance for the Department of
Justice in there Frank to talk about where they said you know
these legal considerations with respect to the CFA it's something you need to
consider when you're establishing the back bounty although we we have that
already adoption of safe harbor wasn't as as popular but then Dropbox was
really the first company to come and adopt a safe harbor into their policy
and I prefer to say that I had something to do with this in fact I encouraged
them to adopt the DMCA exclusion that you're seeing right there at the time
and again is from my work I started a movement called legal bug bounty it
operated on Twitter and I had a lot of basically specific programs that I I
looked at their terms and I published some tweets around it and I work with
many of the companies in Silicon Valley to foster more adoption of safe harbors
into bug bounties are going to speak a little bit about that but what this is
geared to do is basically take that contract of the bug bounty and
specifically address this question of anti hacking was within the language of
the back party proof so you would expect to see in this regard again a legal part
of a bug bounty not just a technical scope or definition of what is it now
then how much you're going to get for your bugs and some may be other parts
and also apartment is impressive example the legal concerns and in that part in
some respects we're now seeing more safe harbors learned a language that
specifically addresses the issue of legal risks now why is this important by
the way we do have some empirical research out there that looks at the
market of bug bounties and this is very important academic work that is done if
you're looking for a little bit you know of academic work that can give you some
insights about the real economics of that market I really I really invite you
to take a look but the worth of plastic I tell the
zaccharas now they have multiple papers in there in this area in fact they're my
co-authors in future work but I'm going to recommend you to take a look and one
of their work looked in 77 policies from Haku one as of January 2016 so yes this
is updated work I recognise that fears in bug bounty industry is a lot a lot
has changed since then but over but then at the time they found
that 17 from 77 analyzed policies had in fact that clause that suggest that the
corporation will not take legal action if you follow the terms of the bug
bounty but they also found that having that Clause from an from a statistical
perspective didn't effect the crowd so it didn't cause the crowd to change
their behavior or to operate differently just from statistical academic
perspective so really interesting but again we're talking about the partial
safe harbor just an obligation under pristine legal action Knopfler is a sure
and also we're talking about data from January 2016
one of the interesting things to see is how is this what a change now that we
have seen such a movement in this area we also know that sometimes policies
have different they have language that really relies on the reading
capabilities of the reader so they also use this image that is called that is
really areas that is used widely that's them
what they found is that the average readability score of back parking
policies is around 40 which requires some college education now it could be
because there are a lot of typical terms in back bounties and it could be just
because of how this academic is geared to offering but it's still very
interesting because we really want to clarify that language and make sure that
we are communicating the base communicating in the best way possible
okay so what happened in this safe harbor movement what we basically saw is
more and more companies agathi this language and I think one of the
interesting things that we also saw this tesla doing this really noble move so
again I have to say that I did have something the doing is in fact Tesla
gave me one of their challenge points one of only 20 in the world because of
that interaction and what they did in their language that they not only ate
the safe harbor and address the legal risk in terms of saying that they will
not pursue legal action against hackers but they also did something that is
pretty novel and they said that if you are cleared if you are pre-approved
researcher so you need to sign up with their bug bounty which is public by the
way it's a public work on it so it's open to all but for the purpose of this
provision you need to be a pre approved researcher if you sign up your Tesla as
a bug bounty test not and you have conducted testing and something went
wrong because it could happen you they will fix it for free if you follow the
guidance of the program and if you sign up you're here yourself as a researcher
then we'll fix it for free so they gave you waivers from the warranty
limitations that they usually have in their EULA's in the end-user license
agreements for the purpose of the bug bounty and that's one of the kind of new
abilities that we are seeing in this legal netscape that is really
recognizing that especially when it comes from cars for example these are
very expensive devices so in order to foster that testing in that cooperation
with a crowd with the external community they had to
go and basically create this legal novella and I think they really deserve
are you chat out for that okay so what are we doing we know that we searchers
care about the communication elements when it comes to one ability disclosure
and coordinate one ability disclosure we know from research that when when they
were asked a majority that said that you know they would like to coordinate and
to coordinate disclosure with a corporation if they don't do it it's
because something went wanted went wrong in terms of their expectations and we
also know that policies and disparities in this empirical research again ii l
the policies that have more contact more content actually attract more bugs so we
know there is a lot of impact to the way a policy could be drafted in this regard
so what are we doing how we basically fostering this tonight's game and how
are you operating as an industry in this community to make that legal landscape
more solid and more innovative as the research continues and as this economy
grows so this is one key document and what I really would like you to alter
Michigan up that in this document that it has actually to the Computer Crime
Commission at the DOJ so this is the people that are really the experts on
the CFAA and DMCA are hacking provisions and then July 2017 that this is why
after I started my research I already had some research and some presentations
going out there and then in the OJ published this work that really
complement in my work what they do here is this saying when you are thinking
about what I'm going to be these cultural programs policies so those
channels of communications that you need to establish with the crowd to make sure
that when someone finds something they are able to communicate with you
effectively they are able to report that and they
they're able to find that and you're handling that correctly when you're
thinking about establishing those channels and we're when you are thinking
about establishing the bug bounty program which is essentially a standard
phone contract it's a take-it-or-leave-it contract that you
are putting on your website or if you're using a platform
bug bug departments have you heard about that concept that's the hacker one and
back routes of the world absolutely so back bounty platforms are
basically market facilitators there are plot there there there are companies
that are coordinating and sending up bug bounties to allow companies to interact
with a crowd and they have their own set of contracts as well at place so when
you are setting up those back bounties and one ability discussion programs that
frameworks gives you a little overview of what considerations especially from
the legal side you should be thinking about now this is not binding this is
our accommodation this is just a list of consideration it's only seven pages it's
pretty short I encourage you to think about it I
encourage you to go to your put them to employ or whatnot whoever you were
working with and tell them have you thought about a vulnerability disclosure
program have you thought about establishing that channel come in of
communication and when they're doing so I encourage you to give them this
document it's really short again just set seven pages and what we have in that
document are some key considerations for example them to discuss on how you
should be describing what is the authorized conduct and what is not
authorized in very plain language to ensure that you have established that
communication is very clear and establish those expectations and we
don't have any discrepancies or conflicts or question marks to allow the
hackers and basically the researchers that you're inviting to test your system
to basically follow the law moreover they're talking about establishing bound
boundaries so one key element is what's going around with
minimize your POC or proof of concept in order to ensure that you are not putting
users data at risk how you minimize your interactions with users data at all so
if you ever swap back bounty for example you will often see a term staring saying
only use your own you use your credentials your own dad I've never
interacted with the dialog of others that is a very important element that
the Department of Justice kind of clarifies and emphasized in that
document they also talked about this approach of you have to be prepared you
have to be mature in order to to do this kind of to have it place these kind of
programs and they either talk about the legal language and the safe harbor
component that I just showed you with respect to the authorization and
basically clarifying that we will not pursue legal action against researchers
that are complying with the policy now all of this is to say we are setting up
clear expectations and boundaries this doesn't mean that you have an approval
to do whatever you want this suggests that the document the bug bounty
contract it's a really important document you should be reading carefully
because that sets the boundaries of the Flores engine that we just talked about
if you remember when we talked about the CFA yeah in the DMCA in the importance
of our ization in the context of anti hacking laws in addition this document
also talks about scoping so in a bug bounty you will often see a technical
scope which is important by the way if you see a bug bounty without and scope
that should raise an a question mark because this old notion of scope it's
basically what am i inviting you to test and when you are preparing that scope
you need to know what's going around in your scope in order to ensure that if
you are providing a post safe harbor authorization you are actually in the
legal position to do so and you're not authorizing
staying on other people's product so this is this notion that you need to
consider what kind of components and data you are putting in scope that might
implicate third party interest now you also need to setup this according to the
Department of Justice according to this document you also need to set
expectation then it comes to perfect concept so what are you exactly
expecting from the crown when it comes to the type of proof concept that they
are delivering to you where do you want the crowd to stop
is it an exploit or what is the level of kind of POC that you would like to see
from them to ensure that you are protecting your users now these are some
of the considerations that you really need to drill on and I mean one of my
key elements are main key messages to everyone considering back parties out
there especially if this is a bug bounty in which you are actively paying money
for research and inviting the justice system do anything for the legal leaves
my prior work again that I've conducted two years ago has showed multiple
programs in which there was no legal part at all how many of us so there I
don't we don't have a lot of hunters there but the hunters here might not be
surprised to hear that they probably saw in the past a bug bounty with no legal
part at all because that was a phenomena out there and I'm proud to say that you
know since then the market really matured there is excellent work done by
DOJ another work that I'm going to share with you here some more but it was it
was a thing so one of my key messages is when even if if you're on hunter or if
you are program manager or if you're considering anything along the lines
make sure that you consult your lawyer because this has legal aspects that you
need to consider now this question by the way is not just emerging here it's
also emerging in new york this is in fact a very interesting document
prepared by CPS that's a task force that reviewed all of the european computer
I'm landscape in the context of on ability disclosure and what they
suggested is this issue of legal liability due to some of the laws there
as well is a little bit murky and we need to think as industry what we can do
in that regard okay so again as I mentioned if you're
not familiar with my work again this project you tell this song my prior work
I try to get industry to push industry to to adopt more safe harbors and
basically standardize that landscape of the legal language of both parties now
you all are familiar with standards how many of you are familiar with open
source licenses right or Creative Commons which is the general license
that we have in the copyright community that allows access to work basically by
enabling the owner to use one contract to waive some of their rights in the
creation will go the law default is something else those type of license are
operating as a standard and because there is one car one contract there are
many benefits that are associated with that and I'm going to talk about that
but my main kind of focus area and that in this work was actually to work with a
lot of companies again to foster the adoption of these terms and one way that
I did that with the help of coin here Ryan who is actually cyber con organizer
right or founder even though or not absolutely
that's that's amazing is to create this big of a bounty hunter orange reserved
only for companies that I know time adopted a safe harbor okay what I also
did is to create this github repository where I wanted to establish a language
that lawyers of companies can take a look of course the you know people saw
their own legal advice but this we had one
my standards that people can take a look at and was informed by the Department of
Justice framework to consider when they are drafting their mark on the policy
and I'm proud to say that you have recently adopted this language and
created another fork of that language to kind of better better situated the
language as this landscape develops and again Dropbox also adopted this language
and the interesting thing here is that we sued the crowd is that in and out so
Justin here Alan is a great guy as well he says you know way to God Dropbox
adopting this policy I'm going to be hunting on a program because of this now
since since I started this legal bug bounty movement and stomach work I
collaborated with background to start disclose I know disclose AO is another
physician project in which all of you can take a look and check out their
language six to create one language for bug bounty programs that is also
addressing this legal landscape issue and it's open source you can all use it
they just in think that back pad also did is incorporate disclosed i/o into
their filtering system so as a hunter if you are professional hunter and you want
to take a look at programs that are that have language that includes safe harbor
you can actually filter in their platform for programs that have a safe
harbor I think that that's one of the recommendations that I originally did in
my prior work and on in my larger paper and they adopted it and I think it's a
great it's a great system and a great tool I mean that this is a selection is
key because then we have one language and we have one standard and this really
serves the benchmark and reduces the information burden on the researchers or
in the crowd and raises awareness towards decision and it also it gives us
transactional cost drastic costs right because you need to consult a lawyer but
at least we have something one language
certificate all quite a thing to agree on now this type of work will actually
be key as we see that expansion of back monkeys into new areas and new arenas
for example this Facebook's newly data abuse program that is focusing on using
the bug bounty not to encounter security flaws but to uncover privacy violations
in fact that can also share with you guys that I'm a proud recipient of a 10
$10,000 $10,000 but not me alone me in my quarters from UC Berkeley on a
privacy enhancing type of academic work so as we are moving this backpack the
concept to new areas and your rayna's it would be important to also look at the
legalese so finally and I'm about to finish up I just want to put here on the
screen some research some basically websites and some that points you can
all seek and look for if you're looking for more information from the new jframe
work I also did a podcast with general Baili again great expert on the CFAA
from the Department of Justice but we only focused on issues of deep bug
bounty kind of legalese including the interaction with extortion there is a
recent CFA indictment that involved Linda subsidiaries did that in fact
involve the bug bounty and someone coming to a party with an extortion at
CFA event it's a very interesting and Agnes the first one that I'm aware of
that has an interaction with the CFA a so that's another thing to take a look
at it if you want and we discussed it a look at at the
post task that also puts you here the links for that encourage you to take a
look at our standardization work disclosed ago and little bug bounty and
if you want to see my prior work in this area you can check out this paper
private ordering changing cycle it's shaking cybersecurity I'm proud to say
that I did negotiate that take it a liquid conflict with the publisher so
that paper is going to be free although it's part of the book and it's
accessible to all on SSRN and with that I'm gonna finish up this presentation
thank you so much and I hope you look for more information in this area you
can always keep the conversation going with me here's my handle in the Missouri
really appreciate you coming here today
you