Software Screws Around, Reverse Engineering Finds Out

The talk starts from a basic problem: it is hard to know what software actually does. Cloud-hosted components, silent updates and opaque AI features hide behavior from users, researchers and regulators. Trade secret doctrine makes this worse, since it can block access through public records exemptions, criminal discovery and misappropriation claims. The speakers frame software security as a credence good, a product whose quality buyers cannot judge without expert analysis, which they say leads to chronic underinvestment.

To test how much accountability depends on outside researchers, the team built a dataset from 102 privacy and security cases the Federal Trade Commission brought from 2017 onward, then traced how the agency first learned of each problem. About a quarter of the individual counts (26.5%) began with independent research, and more than a third of cases had at least one count tied to it. The share climbed sharply in cases about deceptive disclosure of data practices, where roughly two-thirds relied on outside analysis. Journalists, academics, industry staff and unaffiliated researchers all contributed.

The speakers argue that reverse engineering should be treated as a public good, that contracts barring analysis of critical technology such as voting machines should be restricted, and that gag orders and some bug bounty terms discourage disclosure. Their advice to researchers is to think carefully before joining bounty programs that buy silence. They released the dataset publicly and asked for reports of missed cases and errors.