Hacking the Law: Are Bug Bounties a True Safe Harbor?
summary
A survey of bug bounty contracts examines 177 HackerOne policies and finds only 17 had partial safe harbor, revealing platforms often shift civil and criminal risk onto hackers instead of granting clear authorization. The talk cites a reported $30,000 DJI bounty walked away from, the DOJ July framework, a public GitHub repo of proposed safe‑harbor clauses, and Dropbox’s DMCA waiver as concrete steps toward standardized legal terms to protect roughly 120,000 hackers participating today.
AI-written summary · about
chapters (12)
- 0:00The DJI drone incident
- 2:33Wake-up call for researchers
- 4:37Bug bounty explosion
- 7:15Hidden legal risks in terms
- 10:19Lack of safe harbor
- 12:29Contract law as a solution
- 16:07Standardizing legal language
- 18:45DOJ guidelines and adoption
- 20:46Creating a better ecosystem
- 23:09Hope and progress
- 25:10Community empowerment
- 26:58Q&A and final thoughts
related talks
48mThe Law and Economics of Bug Bounties
51mBug Bounty: Keeping Hacks Ethical in 2022
42mKeynote: Hacking Policy and Policy Hacking - A Hacker Guide to...
25mEverything Old Is New Again: Legal Restrictions on...
55mYour License for Bug Hunting Season
50mBug Bounty Programs: Successfully Controlling Complexity and Perpetual Temptation
07mLessons learned from running big bug bounty programs
12mAre Users Able to Take Control of Their Data?