I'm from Canada, and I'd like to know one thing. I know a bug on one website. I'm not sure if it's legal here to search for bugs on a website and NOT use them; instead, tell its company about it.
It is legal to tell them about the bug, giving them a detailed description of the bug and how you came across it.
What is unpredictable is the company's reaction. It could vary to something such as them sending you a reward/small gift (has happened to me), to them trying to prosecute you as a criminal (tipping them off anonymously could help with this issue). If the bug compromises the website and it's information, make it clear that you have not used the bug in this way.
If you have the knowledge, try to make suggestions on how to fix the bug, to make it even clearer to the company that you are trying to help them out (something I did as well).
Important note: If the company refuses to recognise the vulnerability, do not seek way to exploit it and get it attention. This will most likely result in legal action against you.
In Canada it appears as though that you're safe ... for now. Anywhere else, it depends on whether by "search bugs" you mean to find exploits on someone's site that might violate their Terms and Conditions of usage for the website (Eg. Penetration Testing).
There are a couple of different ways this could go, depending on the reaction of the person who receives the e-mail, how the message is worded, and declared steps to reproducing the problem.
Typical Legal Polite Example:
The following might not be interpreted as legal:
Sometimes presentation is everything and while people may have the best of intentions, testing exploits or reconfirming an exploit might be taken the wrong way. This is typically not a good legal example because it's letting the server's admins know their Terms of Service have at the least been violated by the person submitting the notice:
Actively testing exploits on someone else's site is definitely illegal in some municipalities. Servers maintain access logs, so if anything questionable has happened, and then the admins were notified, it might throw up a flag for them when they go back through the logs. Then they can use any information in the e-mail (including headers) and anything they have access to directly in order to try and trace what happened. Tracking cookies on the client machine may be used as evidence in an investigation.
Once an investigation is initiated, actions are dependent on the laws in regard to the location of the server (physical control), the laws of the country in which the server resides, the maintainer of the server (who is responsible for the server's content in some countries), and extradition policies based on whether guilty until proven otherwise or vice versa.
If a bug is found (eg. Code spilling out on the page.), it's not normally illegal to let someone know.
Most of the sites where I've tried to inform someone about an exploit usually end up with a canned response, something like:
or they'll say:
Remember that "No good deed goes unpunished." Hacking laws are becoming more strict and the interpretation of those laws often fall into the hands of the uninformed. To be on the safe side, I always remember to document everything.
Many websites have a disclaimer that forbids you to conduct any security tests on their website.
Therefore, if you really want to do it, I suggest that you report the bug anonymously and like others said, make sure to mention you've only done this to help them.
I like a few of the answers here, but thought to mention another possibility - disclosure through a legal representative. I'm not saying this might be worth your trouble, but can work in a situation where you don't want to disclose any information that could lead to identifying you (inspection through server logs for matching activity as @AbsoluteƵERØ mentions in his answer, or revealing your identity later on while trying to notify web server's respective owner).
In a sense, your legal representative would be testing the grounds, and can possibly even agree on non-prosecution disclosure terms. You can then later decide either to proceed with detailed disclosure that might help the owner to mitigate any potential vulnerabilities found, or simply walk away, if you don't have reasons to trust the owner, fear prosecution, or your legal representative advises you so. This is usually referred to as an informed tactical decision in legal lingua (I'm obviously not a lawyer, mind you).
Legal representative is obliged to protect your interests, and can not be forced to disclose any incriminating information and reveal your identity, unless a clear threat to lives, or similar level of danger is presumed (depending on local laws). These laws are relatively similar in most democracies, tho I wouldn't know specifically for Canada. It shouldn't cost anything to ask a lawyer directly though, legal advice is usually (and should be) free, while the cost of handling the agreed upon disclosure protocol can be covered by disclosure's benefiting party (the owner).
Anyway, just thought it's worth mentioning this option. If you deem it too involved and time-consuming, then I suggest you follow suggestions by those answerers that understand you might get yourself in trouble and suggest what to pay attention to and how to go around this issue. Seeing this question sufficiently covered before my answer, I didn't want to repeat the points already made.
Edit to add: One thing is not particularly clear though, that might limit our ability to give a more meaningful and relevant answer. What exactly do you mean by "find bugs"? Did you stumble upon them by chance, by normal use of their website, you just so happen to know some bug is exploitable and whatever you did to learn about them is repeatable by any other ToS respecting user, or have you actively been searching/scanning for bugs and vulnerabilities? This is IMO the most decisive factor whether you could disclose findings without fear of prosecution, or you should take precautions (as already covered in other answers).
It probably depends on how you found it. If it is something that you found casually using the site, it's probably pretty unlikely that anything could be done to you if you report it to the company. If you were digging for bugs and actively trying to find problems, then it could be a very different story.
It can vary based on local laws, but in general, the heart of the issue is based around if you were using the system in the way they intended it to be used when the bug was found. If you were using the site correctly and stumbled across it, then you should be ok.
If you were seeing what whacky input you could put in and found a way to get an invalid response, then you might be in trouble unless they have an established bug hunting program where they have asked people to try to find problems in their system.
If it isn't clear if they have a bug hunting program like this, a possible way to approach it is contact them asking if they mind if you did some testing of the site and provide them with your findings. If they ask you not to, then don't tell them about the bug. If they say fine, wait a couple days and then let them know what you found.
It depends on what you mean by bug. If what you mean is one that could be exploited to cause harm or access to a server, then in the US it would probably be found illegal under the Computer Fraud and Abuse Act. Several white-hat hackers have been arrested in the US even though they did not cause any damage See this article and notice Adrian Lamo.
It sounds like it could be illegal under Canada's criminal code in section 342.1.
It has been mention by syb0rg that some companies are okay with you find bugs and others are not.
I would advise that you contact the company first and ask their permission. That way you avoid any legal problems that you may not have been seen.
Notifying them is typically not illegal, but searching for bugs typically is. Many people have gotten jail time for what you are suggesting.
Actually, it would fully depend upon the terms of your use of the site. If the site says you cannot do any type of security testing, and you do, you may find yourself in violation of the CFAA (18 U.S.C. § 1030 (a)(2)(c) in particular) (assuming you or the site is in the US) which can bring felony charges and jail time. That being said, almost every internet user is in violation of the CFAA yet very few people get punished under it, so it is really up to how the company in question will react and how much political power they can swing. Also, there is a difference between finding a bug via normal use and actually looking for bugs, so it may also depend upon the websites terms.
But, for us to be fully concerned of the legality, we would need to bring lawyers in. For example, is there some kind of good Samaritan protection? Perhaps in your jurisdiction but not where the website is being hosted at. In such a case, which law applies?
In conclusion the laws are too complex for a simple conclusion, and while I and others I know would be thankful for the help in fixing any problems, I cannot speak for the owner of the website(s) in question.
protected by AviD♦ Jun 12 '13 at 11:30
Thank you for your interest in this question.
Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.
Would you like to answer one of these unanswered questions instead?