2019 - Chloé Messdaghi - Fixing the Internet's Auto-Immune Problem

### Overview In this talk, security researcher advocate Chloé Messdaghi addresses the legal and communication challenges faced by ethical hackers and security researchers when reporting vulnerabilities, framing this disconnect as the internet's 'auto-immune problem.' Messdaghi focuses on the ambiguity of existing legal frameworks, specifically comparing Canadian laws and the United States landscape, to illustrate how good-faith disclosure can inadvertently result in legal threats or criminal prosecution. To bridge this gap, she introduces disclose.io, an initiative that establishes standardized, readable vulnerability disclosure and safe harbor frameworks to protect both organizations and researchers.

### Key Topics - **Legal Ambiguity for Ethical Hackers:** Examination of how copyright and criminal statutes leave well-intentioned security researchers vulnerable to prosecution. - **The Kelly Dunham Case:** A real-world incident where an individual discovered exposed personal data, reported it without response, shared the link to a private group, and subsequently faced potential criminal charges. - **Disclose.io Framework:** A community-led, grassroots initiative designed to provide readable, standardized safe harbor terms and maintain a directory of organizations practicing safe harbor. - **Mutual Expectations in Vulnerability Disclosure:** Ground rules and responsibilities for both program managers and security researchers to maintain productive, bilateral collaboration.

### Technical & Legal Details Messdaghi examines two primary components of Canadian law affecting researchers: - **Copyright Act:** Relies heavily on consent and 'reasonable notification.' Determining the appropriate entity to contact can be difficult when multiple parties are involved (such as differentiating between a website owner and a third-party server operator like Microsoft). Furthermore, Canadian law contains ambiguities regarding disclosure timelines and exceptions for public interest disclosures. - **Criminal Code:** Poses significant risks for ethical hackers who inadvertently encounter out-of-scope assets or private data. Without prior consent or explicit protections, stumbling upon vulnerabilities out of scope can expose individuals to criminal liability.

To remediate these issues, the disclose.io framework offers: 1. **Standardized Safe Harbor Language:** Readable disclosure terms that reduce legal jargon and language barriers for international researchers. It sets clear rules on explicit scoping, expected rewards (swag or bounties), and designated official communication channels. 2. **Program Manager Commitments:** Organizations adopting safe harbor commit to working in a timely manner, responding promptly, remediating vulnerabilities, and extending explicit legal protection to researchers acting within policy bounds. 3. **Researcher Ground Rules:** Researchers are expected to promptly report vulnerabilities, respect the privacy of others, and avoid extortion or threats of public exposure. 4. **The Hacker Directory:** A curated list showing which organizations offer full safe harbor, partial safe harbor, or have uncertain status, along with contact details and policy links.

### Takeaways Both researchers and program managers operate with apprehension: researchers fear legal prosecution under vague laws, while organizations fear out-of-scope exploitation. Adopting standardized, transparent safe harbor frameworks like disclose.io reduces ambiguity and fosters bilateral trust. Disclose.io is expanding from its US base to work with Canadian attorneys, and Messdaghi encourages hackers, program managers, and legal professionals to participate in and support this community-driven movement.