Bug Bounty: Keeping Hacks Ethical in 2022
summary
Covers concrete legal guardrails for bug bounties: verify researcher identity, refuse payments to anyone on the OFAC list, and treat unauthorized access as an incident under the Computer Fraud and Abuse Act (damage threshold often cited ~$5,000). Advises clear, readable safe harbor language, documented decision rationale, vendor screening steps, and using outside counsel for government contracts or ransom/crypto tracing. Uses USA v. Sullivan as a cautionary example of nondisclosure and role-conflict consequences; recommends sector-specific reporting checks and strict adherence to terms of engagement.
AI-written summary · about
chapters (11)
- 0:00Introduction and disclaimers
- 2:13What is a bug bounty
- 7:30United States v. Joseph Sullivan case
- 11:47Computer Fraud and Abuse Act risks
- 13:32Legal guardrails for bug bounties
- 20:22False Claims Act and accountability
- 27:32Paying ransomware and OFAC compliance
- 34:13Role of legal counsel in security
- 40:18Signing legal documents as CISO
- 47:04Working with regulators
- 48:07Q&A with the audience
related talks
48mThe Law and Economics of Bug Bounties
50mBug Bounty Programs: Successfully Controlling Complexity and Perpetual Temptation
33mHacking the Law: Are Bug Bounties a True Safe Harbor?
52mPractical Tips For Running A Successful Bug Bounty Program
38mManaging for Success: Maintaining a Healthy Bug Bounty Program Long Term
25mEverything Old Is New Again: Legal Restrictions on...
15m"You've Got Your Nice List of Bugs, Now What?" Vulnerability Discovery and Management
55mYour License for Bug Hunting Season