Hack the Planet Gently With a Code of Practice

The panel opens with a problem: security researchers who test systems can face legal threats, and people outside the field, including lawmakers and companies, struggle to tell legitimate good-faith research from misconduct. The discussion asks whether the community could agree on voluntary norms, short of regulation or certification, that outsiders would recognise as legitimate.

Panelists review the legal landscape in the United States. They cover the Computer Fraud and Abuse Act, a DMCA exemption process that created a good-faith security research protection, and a Justice Department charging policy that declines to prosecute good-faith research. They note that this policy does not bind private lawsuits or state laws. Historical attempts at disclosure norms are also reviewed, from early hacker-written policies to a vendor publicly stating it would not pursue good-faith reporters. Speakers acknowledge the tension: accidental damage to fragile systems, vendors that lack capacity to handle reports, and the risk that a formal code becomes a restrictive legal document.

Most participants agree that vendors must still carry responsibility, and that self-organised norms could help avoid being regulated or certified from outside. For practitioners, the practical advice is to state up front that you are disclosing a vulnerability, check whether the vendor follows published handling standards, and escalate through known contacts if there is no reply. The panel closes without a firm answer on whether a code of practice is worth pursuing.