BSidesSF 2018 - Hacking the Law: Are Bug Bounties a True Safe Harbor? (Amit Elazari)

### Overview In this talk, Amit Elazari discusses the growing legal risks faced by white-hat security researchers participating in bug bounty programs. Using the high-profile case of researcher Kevin Finster—who discovered a critical vulnerability in DJI's drone systems, was offered a $30,000 bounty, but ultimately walked away after being threatened with legal action under the Computer Fraud and Abuse Act (CFAA)—Elazari illustrates how bug bounties can fail to protect researchers. Although the bug bounty economy is expanding rapidly into corporate and government sectors (including the Pentagon, US Army, and Department of Homeland Security proposals), legal protections for researchers remain the exception rather than the rule.

### Key Topics - **The Legal Landscape and Fine Print:** Analysis of bug bounty terms reveals that programs often focus extensively on technical scope while leaving legal authorization vague or nonexistent. Many policies shift legal liability entirely onto researchers or reference standard End User License Agreements (EULAs) that strictly prohibit unauthorized access or reverse engineering. - **Anti-Hacking Statutes and Authorization:** The CFAA and the Digital Millennium Copyright Act (DMCA) penalize unauthorized computer access and circumvention of technical controls. Because these laws hinge on consent and authorization, contractual terms must explicitly grant authorized access for in-scope activities to shield researchers from criminal and civil liability. - **Lack of Standardized Safe Harbor:** Research analyzing 177 policies on HackerOne found that only 17 offered even partial safe harbor (commitments not to pursue legal action). Furthermore, 60% of surveyed hackers cite fear of legal action as a reason not to disclose vulnerabilities.

### Technical Details & Frameworks - **Department of Justice (DOJ) Guidelines:** The DOJ published a framework in July recommending explicit CFAA authorization for in-scope testing in vulnerability disclosure programs. Elazari expanded upon this model on GitHub (with assistance from Ed Overflow) to include DMCA protections and state anti-hacking law authorizations. - **Leading Examples:** Dropbox adopted a comprehensive policy that incorporates DOJ recommendations and explicitly waives DMCA claims, allowing others to reuse its language. Additionally, following public backlash, DJI launched an updated, pro-hunter policy offering CFAA and DMCA safe harbor.

### Takeaways - **Demand Safe Harbors:** Hackers should "vote with their fingers" and avoid participating in programs lacking clear legal safe harbors ("say no to no safe harbor"). - **Standardization and Education:** The security community, platforms, and vendors must adopt standardized legal templates (analogous to Creative Commons or open-source licenses) to reduce transaction costs and clarify expectations. - **Platform Accountability:** Bug bounty platforms should actively vet program terms, simplify complex disclosures, and help align the legal protections of researchers with vendor expectations.