A Legal Defense Fund for Hackers

The speakers open with the legal risk that good-faith researchers face when they test or report vulnerabilities. Even where US law offers defenses, such as the DMCA security-research exemption, many researchers cannot find good counsel, and even bogus threats can cost enough to silence them. They argue that vendors and users all lose when researchers stay quiet, and that a chilling effect leaves more flaws unfixed.

The talk presents the Security Research Legal Defense Fund, a nonprofit that has recently been recognized as a 501(c)(3) public charity. It pays the researcher's attorney rather than the researcher directly. Grants depend on three things: the work must count as good-faith research under a definition taken from US law, the researcher must show financial need, and an independent board must approve the grant. The speakers announced a first grant, to researchers in Poland who found a backdoor in train software and were threatened with lawsuits. They also described remaining gaps, including trafficking liability for exploits and state computer crime laws that lack a charging policy.

The closing part is a call to action. Attendees are asked to spread awareness, and to donate, since the fund cannot rely on a single source and needs community support to last. Questions covered how grants are scoped, how donations work, turnaround times, and how bug bounty programs might route payments. The takeaway for practitioners is that legal support now exists for ethical researchers, and that its credibility rests on researchers acting in good faith.