The Risks of Pointing Out the Emperor is Buck Naked
Renderman and Tom Dang share first-hand accounts of facing legal retaliation when reporting government vulnerabilities, urging reform in public disclosure policies.
Summary
The Chilling Effect of Flawed Disclosure Paths
Despite national public slogans encouraging citizens to report safety concerns, security researchers reporting critical government software vulnerabilities frequently face threats of arrest.
Personal Accounts of Bureaucratic and Legal Retaliation
Renderman and Tom Dang recount personal experiences attempting to report critical flaws in public sector systems, facing aggressive legal investigations, jurisdictional conflicts, and reputational damage.
Root Causes of Disclosure Failures
The speakers analyze the systemic factors that derail coordinated disclosure: ambiguous reporting channels, superseding statutes (like the CFAA), organizational fear, and executive ego.
Building Standardized Safe Harbor Policies
The presentation outlines legislative proposals and practical templates for government agencies to implement binding vulnerability disclosure policies and legal safe harbors.
Related talks
Voting Village·15 min
Miracle Owolabi
Advocates for expanding legal safe harbor protections for election security researchers globally, drawing on lessons from research barriers in Nigeria.
Voting Village·55 min
Tori Noble
Breaks down the Digital Millennium Copyright Act (DMCA) Section 1201 security research exemptions that protect independent voting system audits at the Voting Village.
Main Stage·46 min
Jeff Moss · Katie Moussouris · Harley Geiger
DEF CON launches a structured program for hackers to anonymously report vulnerabilities to US federal agencies.