3

I understand that the answer to questions like this depend on country, but I'd like to get an idea what the usual approach to cases like this are.

Heres the case:
I found a security hole in one of the governments services.
The flaw makes it possible for anyone to download documents that would normally require authorization from the affected service.
I did some tests and made a script that downloads a bunch of stuff from there to test what kind of security issue it actually was.
I have absolutely no intention to use this data for illegal purposes.
I also let them know about it and it should get fixed soon.

Now the questions are:
Is the cursive part illegal?
Would it be illegal for me to store the data and not delete it?
Would it be illegal to publish the data? (I assume yes)

If the cursive part is illegal, how can anyone find and let service provider know about security issue as telling about it reveals that you've used the hole to do something (in this case just to confirm that it exists)?

Improve this question
4
  • 4
    This question appears to be off-topic because it is a request for legal advice. If you want to know about the legality of something, ask a lawyer.
    – Mark
    Commented Jul 24, 2014 at 22:38
  • If you're really concerned about it, you may be able to report the security vulnerability anonymously. Just make sure to take some precautions that make it not easy for them to track it back to you. Make sure the tone of the report couldn't be misinterpreted as a threat or blackmail.
    – Lie Ryan
    Commented Jul 25, 2014 at 0:11
  • 1
    It might seem ridiculous that you can be sued for doing the right thing, but that's just the way things are in certain jurisdictions
    – Lie Ryan
    Commented Jul 25, 2014 at 0:18
  • 1
    Of course it is illegal, and this question is out of topic, we do not discuss about laws here.
    – user45139
    Commented Jul 25, 2014 at 7:08

1 Answer 1

Reset to default
3

I did some tests and made a script that downloads a bunch of stuff from there to test what kind of security issue it actually was.

In most jurisdictions it is illegal to access a computer system without permission. The fact that it has security issues does not change that. See Computer Fraud and Abuse Act.

"If the cursive part is illegal, how can anyone find and let service provider know about security issue as telling about it reveals that you've used the hole to do something (in this case just to confirm that it exists)?"

You can only look for security issues in the system if you are authorised to do so. Some vendors will publish bug bounties or responsible disclosure guidelines which allow such testing by public.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .