Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

As I'm sure most people here are aware, there has been quite a lot of attention brought to the USA's Computer Fraud and Abuse Act (CFAA) recently. Brief back story: A security researcher discovered that a cell phone carrier made email addresses of their customers available through a non-authenticated service. He pointed it out and now could spend several decades behind bars. More Info: http://www.f-secure.com/weblog/archives/00002460.html

Without getting into "#FreeWeev" craze, I'm curious about how security minded folks are processing this information and whether it would deter you from reporting a legitimately identified security concern. Obviously people in the USA will have a bit more context on the issue but I openly welcome all points of view on the issue.

Will these rulings keep you from your work, or change it? If so, how?

Thanks!

share|improve this question

closed as not constructive by D.W., Terry Chia, Rory Alsop Nov 22 '12 at 8:57

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
This question is probably not a good fit for this site, as it appears to be more of an open-ended poll. This is a question-and-answer site, not a discussion site or forum. The site is best-suited for specific technical questions with an objectively definable correct answer. Chatty, open-ended questions, or subjective questions where every answer is equally valid, are off-topic. I encourage you to read through the FAQ for more, especially the section labelled What kind of questions should I not ask here?. –  D.W. Nov 22 '12 at 0:48

2 Answers 2

With respect to how (and whether) to disclose vulnerabilities, that subject has been covered extensively already on this site.

With respect to dealing with a potentially-embarrassing flaw with a powerful organization, remember this little gem:

Powerful organizations do not like to be embarrassed. And one way for them to save face is to incriminate the messenger ("see, we're not irresponsible, he's a terrorist"), and so when doing so, some certain amount of self-protection is in order. Perhaps you should remain anonymous. Perhaps you should seek legal counsel. Perhaps you should work through a third party (e.g. security firm).

Certainly what you should not do is flaunt the vulnerability in a spectacle of sarcastic derision and self-promotion. It may be safe to poke the bear with a long enough stick, but the only way to know for certain is in a post-mortem analysis of the events. Probably best not to poke the bear if you want to stay on the safe side.

share|improve this answer
    
Sound advice. I usually disclose to the vendor anonymously, then disclose it publicly under my own name if it goes well. –  Polynomial Nov 22 '12 at 8:59

This general topic area has been covered at At what point does "hacking" become illegal?, which includes references to other security professionals who were affected by these laws.

See also Found huge bug, what should I do?, which covers a related area.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.