The Law and Economics of Bug Bounties

on YouTube ↗48m

" summary

Presents results from reading hundreds of bug‑bounty and VDP terms and finds widespread legal risk for researchers: examples include Kevin walked away from $30,000 after disputed authorization, study data showing only 17 of 77 programs had partial safe harbors, and only about 22 companies with explicit safe harbors today. Recommends explicit authorization under CFAA/DMCA, follows the DOJ framework, and offers an open Legal Bug Bounty repo of model clauses that platforms and vendors can adopt to reduce legal threats.

AI-written summary · about

" chapters (9)

1. 0:00Start
2. 13:22So why we are still attacking friendly hackers instead of helping them to help us?
3. 14:31Companies often put hackers in "legal" harm's way, shifting the risk for liability towards hackers instead of authorizing access and creating "safe harbors"
4. 19:01While programs usually clearly disclose the "technical scope" of authorization given to the researcher, the legal scope of "authorization" and "access" is often ignored, non-existing or lacking. Safe harbor is the exception not the standard.
5. 20:41The threat of legal action was cited by 60% of researchers as a reason they might not work with a vendor to disclose
6. 28:43Careful and Clear Scoping: Consider whether any of the network components or data within the scope of the vulnerability disclosure program implicates third-party Interests
7. 31:24How many programs adopted an Explicit Safe Harbor (clear authorization) - 1 Year after the publication of the DOJ framework?
8. 38:24Dropbox revamps vulnerability disclosure policy, with hopes that other companies follow suit
9. 41:05This community has the power to change this reality, and this can start right now

" related talks

• 33mHacking the Law: Are Bug Bounties a True Safe Harbor?Amit Elazari · BSidesSF 2018
• 51mBug Bounty: Keeping Hacks Ethical in 2022Daniel Garrie, David Cass · RSA Conference 2023
• 25mEverything Old Is New Again: Legal Restrictions on...Kendra Albert · USENIX Security '25
• 50mTo bounty, or not to bounty? Security@ insights from 500 organizationsAlex Rice · OWASP AppSec California 2016
• 15m"You've Got Your Nice List of Bugs, Now What?" Vulnerability Discovery and ManagementSerge Egelman, Primal Wijesekera, Noura Alomar, Edward Qiu · SOUPS 2020
• 55mYour License for Bug Hunting SeasonCasey Ellis, Jim Denaro · AppSecUSA 2016
• 52mPractical Tips For Running A Successful Bug Bounty ProgramGrant McCracken, Daniel Trauner · AppSecUSA 2016
• 50mBug Bounty Programs: Successfully Controlling Complexity and Perpetual TemptationCassio Goldschmidt, Michael Gallagher, Sean Martin, Sean Melia, Michael Stoker · AppSec USA 2017