So, this panel is the hackers, the lawyers, and the defense fund.
I am Harley Geiger, and I am your moderator for this panel.
There is unlikely to be a hacker at this conference that has not contemplated at some point the
potential legal trouble that they may face as a result of good faith security testing.
And many people have experienced this directly themselves, and many more will experience
it at some point in their hacking careers.
So, one of the things that makes the security community so effective is that it is always
pushing the boundaries of permissible behavior.
And by pushing that boundary, it helps define that boundary, it also creates space to innovate
and to simulate criminal attacks so that we can better prepare ourselves to defend and
preempt those very attacks.
This is how we fix vulnerabilities before malicious actors get a hold of them.
In many ways, the law has recognized this now and are working to accommodate
this kind of security research activity.
But, there are, you know, so we're seeing more coordinated vulnerability disclosure in laws,
like in the United States, at the state level, abroad.
However, we are also seeing that the hacker continues to face legal threats from various sources,
like the governor of Missouri threatening a newspaper.
And some of these are bogus or empty, but some are also quite serious.
So, what...
What is it like for a hacker that faces legal threats?
And what sort of resources are available for security researchers that run into legal complications?
So for this panel, we're going to hear first from a hacker that has lived this and faced
legal threats, that is Miles McCain.
Second, we'll hear from Charlie Schneider from Google about how the ecosystem benefits
from the work of security researchers.
And that the chilling effect that legal...
Legal threats can have.
Third, we'll hear from Kurt Opsal.
He is the Associate General Counsel at Filecoin Foundation and has provided legal representation
to many security researchers.
And then we'll hear from Hannah Zhao from the Electronic Frontier Foundation about
the ways that EFF provides legal services to hackers through the Coder's Rights Project
and impact litigation.
And then lastly, we'll hear again from me about the Security Research Legal Defense Fund.
This defense fund was recently launched.
It aims to provide funding for the defense of good faith security research.
So one last thing before we kick that off, which is that nothing you hear on this stage
should be construed as legal advice.
You do need a lawyer.
Lawyers are really great, but they're not sitting up here at this moment.
So Miles, if you wouldn't mind, please introduce yourself and tell us your story.
Awesome.
Thanks, everybody.
Hey, everyone.
I'm Miles.
I am a college student, open source software developer, and enthusiast.
security researcher.
Right now, I'm just going to briefly share my experience receiving a legal threat for
good faith security research, and then I'm going to zoom out and talk about some key
takeaways that I had from this experience.
But before I do that, I want to give a shout out to Adi right there and the whole Stanford
Applied Cybersecurity crew.
If you want to stand up and just wave as I say this, Adi was one of my co-conspirators
on the Vulnerability.
One disclosure that I'm about to talk about.
And we would not have been able to stand up for ourselves in the way that we did had it
not been for the amazing support of the Stanford Applied Cyber community.
So thanks for being here.
All right.
So this is a fun story.
Last October, a Stanford student startup called Fizz was getting super popular on campus.
This was an anonymous social media app that claimed to be 100% secure.
What?
What could go wrong with something like that?
Well, you know, me and a few security-minded friends, Adi being one of them, we were drawn
like moths to a flame when we heard that.
And so one Friday night, we decided to evaluate whether Fizz really was 100% secure like
they claimed.
Well, dear audience, as you might be able to tell from me sitting here, they were not.
Within a couple hours, we were able to gain full read-write access to their database where
they were storing all posts and users and everything you could imagine entirely de-anonymized.
100% secure.
All right.
So at this point, we did what any good security researcher is supposed to do, which many
of you have probably done, which is that we responsibly disclosed what we found.
We wrote a detailed vulnerability disclosure report.
We suggested remediations.
And we also proactively agreed to not talk about it.
We didn't want to talk about our findings until an embargo date, which was a fair amount
in the future.
We wanted to give them time to fix the issues.
Then we sent them the report via email.
At first, they were super grateful.
They said, hey, fixing these issues is our absolute top priority.
And every couple weeks, like I said, every week or so, they would send us an update.
And then one day, they sent us a threat.
This was a crazy threat.
I remember it really vividly.
I was just finishing up a run, and I looked at my phone, and my heart rate went way up.
That is not what's supposed to happen after you finish a run.
In the threat, they said that we had violated state and federal law.
We had conspiracy to commit a felony.
They also brought up the Stanford disciplinary code, which I thought was pretty odd.
And then at the very end of their threat, they left a demand.
Don't ever talk about this publicly.
If we ever talk about this, then we will not pursue legal action.
Well, as you can probably tell by me sitting here, we did not agree to that demand.
And I'll talk about why.
But clearly, they wanted to scare us into silence.
So what do you do when you get a letter like this?
Well, I totally freaked out.
I was angry and scared.
I usually try to be a pretty level-headed person.
But this was something different.
I was scared.
But the very first thing that our friend Cooper, who was another of our co-conspirators,
said in our disclosure group chat when we got the threat was, stay calm, don't do anything
fucking stupid, we're going to need a lawyer.
And if you can't tell from this advice, this was not Cooper's first time receiving legal
threats.
So we started asking for help in our network.
And within a few days.
We were connected to Kurt, who's sitting right here, and Andrew Crocker at the Electronic
Frontier Foundation.
And after talking with them a little bit, Kurt and Andrew generously agreed to represent
us in our response to the letter pro bono.
So we walked them through our disclosure and our documentation.
And with their advice, we made the decision to not cave to the threats.
Also, hey, I see a big crowd of AC people who just walked in.
Love y'all.
And so Kurt and Andrew drafted a response to Fizz, and they totally shut the threat
down.
And as an aside, the Stanford Daily published both the threat and our response.
This is public.
I really recommend you read it if you haven't.
Anyway, after we responded, the Fizz team asked to meet, and we were able to resolve
the situation amicably.
We pushed Fizz to proactively disclose the vulnerability to their users publicly.
And we were able to resolve the situation amicably.
Which they did eventually do.
So taking a step back, getting a legal threat for our good faith security research was incredibly
stressful.
And the fact that it came from our classmates just added insult to injury.
And I have three sort of key takeaways from this experience that I want to share.
First, keep your research above board and really well documented.
Ahead of time, think about what you're trying to accomplish, write it down, and make sure
that you don't cross any ethical lines.
A big reason why we were able to resolve the situation amicably was because we played
by the rules.
We didn't save or leak the data that we had access to.
We didn't mess with anyone's account.
We didn't cause any damage.
And we kept really detailed documentation of absolutely everything we did.
And that clean documentation helped us as we were writing our disclosure, and I imagine
it also probably helped Andrew and Kurt as they were drafting the response.
Second thing, stay calm.
I cannot tell you how much I wanted to curse the Fizz team out over email, oh my god.
But no, we had to keep it professional.
Even as they were resorting to legal scare tactics.
Your goal when you get a legal threat is to get out of it.
To resolve the situation amicably.
To not go to jail.
That is it.
And the temporary satisfaction of saying, fuck you, while absolutely real, is just not
worth giving up the possibility of resolving the situation amicably.
And the third and final takeaway is get a lawyer.
And I'm not just saying that because I'm on a panel with a bunch of lawyers.
We could have tried to navigate this process on our own.
But that would have been...
That would have been an absolutely profound mistake.
They would have escalated.
After all, they were banking on us being naive and falling for their scare tactics.
But thankfully, Kurt and Andrew stepped in and really saved the day.
Now I recognize that not everyone has the ability to get the Electronic Frontier Foundation
to represent them pro bono, and they don't have the ability to represent everyone who
faces a legal threat.
But there are an increasing...
An increasing number of resources available for good faith security researchers who do
receive legal threats.
We're going to be talking about those on this panel.
And you should absolutely try to make use of them.
Do not try to fly solo.
Now I will hand it off to Charlie, who is the head of security policy at Google and
who has spent a long time on the other side of the vulnerability disclosure process.
Thank you, Myles.
So yeah.
So as Myles said...
I kind of am here to represent the other side of the equation, the bug collectors.
And throughout my career, I've had the privilege of collecting bugs from skilled researchers
all over the world.
And my career has been spent exclusively in very, very large organizations who in theory
hold a lot of power and leverage over hackers.
And so...
At the...
The Department of Defense, I helped found and manage the first bug bounty pilot called
Hack the Pentagon.
And I wrote their first vulnerability disclosure policy.
Later I worked at a financial institution where I led researcher engagement in their
bounty programs.
And now at Google, I get to work with our bug collector teams all over the company.
And in all of these experiences and throughout, I've seen kind of firsthand the power and
leverage that organizations...
Like mine can hold over researchers.
Even before we could found and start the Hack the Pentagon bug bounty pilot, I first had
to kind of search through the massive defense department bureaucracy to identify who within
the department had been machine gunning out cease and desist letters to anyone they could
find who had been scanning any part of our slash eight IP ranges.
So...
I talk about sending a mixed message as you're trying to get a bug bounty program started.
And during the first bug bounty, one of our very top contributors to the program who I
believe has continued being one of the top contributors to all the various kind of DOD
vulnerability disclosure programs was an individual who ran afoul of U.S. computer hacking laws.
And he served his time.
And he got out.
And...
Was in the first wave of people to...
To raise their hands to contribute to government security in kind of the first bug bounty.
And I think that took a lot of courage to have gone through what that person did and
faced those risks and still come back to help us.
And at Google, we see there as well kind of the power that companies have to chill security
research.
Sometimes...
Sometimes we receive reports from researchers for bugs in other companies' products.
Because those researchers are afraid of what those companies might do, their reputation
on disclosure issues.
And so they come to us instead.
And...
You know, I think that's really unfortunate.
And that's ultimately, you know, those companies' loss.
And I think it's all of our loss if hackers can't contribute.
You know...
And from the other sector's perspective, you know, we want hackers to be able to engage
on an equal footing with us, without fear of legal reprisal.
With more kind of legal certainty in the equation, we can have more open and deeper collaboration
and conversations.
And ultimately, from a company's perspective, we're going to get more and better bugs.
And...
You know...
Each new report gives us a...
An opportunity...
to close off an avenue of attack and protect users but when you know vague laws and companies
behaving badly allow kind of the the creation of this chilling effect on security research
i think ultimately the only ones who truly win are attackers and it's users who lose so that's
why i'm super excited to be here and why i'm glad that the legal defense fund exists now and i think
all companies and all kind of bug collectors should be glad it exists um so i'll turn it now to kurt
hey everybody
it doesn't appear to me
hey everybody ah that is on uh hey my name is kurt opsall
i'm the associate general counsel for cyber security and civil liberties policy with the
filecoin foundation and i also volunteer my time with eff as a special counsel
and for many
many years i was working with eff on the coders rights project i've been in this uh community
trying to help by the legal situation since the alexa park days back in the uh defcon 13
was my first one we're in an exciting time with uh uh security researcher mike lynn at cisco and
some disputes over a program that had to be uh physically removed from the from the program book
uh due to some threats uh and i've really enjoyed working with like countless people in the security
research community and how to help them out avoid situations or deal with situations that occurs
i want to talk to you a little bit about some of that uh that experience so just to set the stage
a bit sort of broadly speaking uh there are two types or categories of legal issues that come up
for security researchers the first are issues around doing the research itself
legal issues that may arise because of you know are you uh you know how are you earned
Hacking onto someone's system, will that be considered an intrusion?
Is there an anti-circumvention issue arising out of the Digital Millennium Copyright Act?
An end-user license cream or terms of service will have a potential contractual provision that might go on.
If you're doing wireless research, it may involve getting contents of communication, which brings up what the law likes to call wiretapping.
And so there's a host of issues that can come up in the course of it and how you navigate those in order to minimize risk.
And the second large category is the disclosure.
And this comes out where if there is a vendor or a commercial entity, especially, who you are exposing a vulnerability, they may become sad and upset.
Now, these days, it's actually fairly well established.
It's been established for technology companies that, you know, people who have been around this space for a long time, receiving bug reports.
They may have a bug bounty program that's been going on successfully for a long time.
And this has been a really great, you know, advantage to the community to have bug bounty programs.
You can look at, see what the rules are, work with it, have points of contact.
But it's not always the case.
More old-school industries, sometimes I call it first contact situations, the first time that they have been reached out to by the security community to say,
you know, you're.
Your security is broken.
People can, you know, see all this info.
And sometimes they panic or they want to make sure this shuts down.
Are they thinking of it from a sort of a comms point of view, a communications point of view of trying to not have that communication?
So.
The good news is for disclosing vulnerabilities, if you disclose truthful information about a vulnerability.
That is strongly protected by the First Amendment.
You know, that there is, it is hard for someone to build a case around saying you should not say something which is truthful,
even if that is something that is embarrassing or awkward.
But some of the tension arises is that these two issues can be interrelated.
One of the issues is that if perhaps there were something was a towards the edge of legal lines
or can be confused.
Strewed that way in the course of doing the research, publicly disclosing it will one, if done
uncarefully might involve admitting to things on on stage that will can and will be used against you.
But also, even if there is, you did play by the rules, you did it well.
There's a threat of litigation over it and the possibility that you'll be sort of facing a very awkward situation, getting these these threats that may
If you do, it will be very much like trying to hack.
worry you
not about the legality of the disclosure, but they may go after you for the underlying research.
So,
What should hackers do in these kinds of circumstances?
Well,
a lot of it,
first of all, have a lawyer with you at all times.
But that is somewhat inconvenient and hard to, hard to do.
So
It's a question of, like, when should you reach out?
And also, what can you do to help mitigate some of these things as early as possible?
And so, you know, when I talked to a security researchers,
Some of the advice is very dependent on what stage things are at.
If it's early on, you can minimize the risk in doing the research itself.
So, for example, if it's a hardware bug you're trying to find, if you own the hardware, then that resolves whether you are intruding on somebody else's hardware.
You'd be amazed at the number of machines that you can buy on eBay that, like, if you wanted to test, say, you know, voting machines in the early days,
it was very hard to get cooperation from the voting vendors, but you could buy used voting machines on eBay.
Someone was doing a test of some TSA scanning machines.
It turns out those are available on eBay as well.
So you can do a lot of that stuff.
Wireless communications, well, you can minimize risk around wiretapping by just having your own communication,
that is, say, where you've consented or, you know, you and your buddy, but not doing it more broadly to strangers.
So there's a lot of things that can be done early on, though sometimes.
First contact with our first contact with a researcher is after some of that research is done, and it's about trying to navigate the path forward.
But I would say one of the things you can and should reach out, if you have some questions about that, reach out to the Coders Rights Project at EFF,
and Hannah will talk a little bit more about that to avoid some of these problems.
But at the disclosure stage, I would say probably the key thing to start out with, if you're about to disclose,
is make sure that you, again,
get someone who understands security or is an engineer trying to establish sort of a geek-to-geek protocol communications,
not going through marketing or legal, but with an engineer.
And sometimes people in this community know somebody there, or you can check the disclose.io has a list of points of contact.
But if you can have an engineer, they probably will understand it.
Even if it's an engineer working in an old-school firm, it might be an internal advocate for, like, yeah, this is embarrassing, but this happens,
and we've got to deal with it.
But sometimes the only path forward is going through a more public, like, comms channel, or things get escalated.
And that is a sign. A sign things might be going weird.
That is an excellent time to reach out for a lawyer. There are signs if you're a lawyer is getting back to you,
even if it's not a threat, if they're asking some weird questions,
maybe you want to talk to your own lawyer for a response.
As Miles was saying, like,
document some things, especially if there are, you know, documenting things that show that you did the right thing,
you behave properly, that you didn't mess with customer information.
And also, if they say nice things about how much they appreciated early on,
save a copy of those emails later, because in case things get weird later, it's good to have.
And most of the time,
these things can be resolved.
And everyone goes away ultimately happy, and there's some, you know, awkward moments along the way.
But,
more often than not, it can be resolved.
And even when there is this kind of, let's say, Barbara Streisand is your friend,
the Streisand effect is, as many of you I'm sure know, is when the
news about the dispute gets more coverage to the issue than the issue
they're trying to cover up would have gotten anyway.
And I think that, you know, helped to have the Stanford Daily publish the cease and desist and response letters.
And,
also, on my mind today is that many years ago, I think it was 2008,
there was a presentation here at DEF CON about a subway hack, the Charlie card, and the MBTA.
And the MBTA did get very upset, in fact, so upset they went to court trying to get the talk shut down.
They got a temporary restraining order, and that led to the talk being replaced to a press conference about how they had squelched speech about their security.
Um,
which ultimately probably had more people in attendance than your average talk and got it into big news.
So that's a strong incentive if someone is behaving rationally on the other side,
that them going ballistic on you will actually hurt them far more than trying to resolve it amicably.
But of course, not everybody is rational.
And oftentimes we say that you can guess what a rational person might do,
but your opponents in litigation are not always rational.
And so that's when things step up to litigation.
And one of the challenges is that while you can get some great pro bono services,
and I think definitely reach out to EFF, EFF can't represent everybody in litigation.
Litigation is a much more time-consuming and legal-intensive process.
It can.
It can be fun as a lawyer doing this, but it is not fun to be the person in the litigation.
Even if you're going to win, it still sucks to be along the way, but it's good to have counsel on that.
And so one of the things I like about the Security Legal Defense Fund is in those circumstances
where some money will help get an attorney that is where pro bono resources have been used as best they can,
but are not enough to have that fund available.
And hopefully, like, it's one of those things that hopefully never gets used.
But having it available can help reduce the chilling effect that comes from these recent assists,
these often nasty grams, as Miles was just describing, it's just full of bluster and threats.
And some of that bluster is just trying to scare you.
Some of the, you know, ridiculously short deadlines, things like that, trying to induce panic.
And part of that is the bullying that's going to go after someone who is not represented,
sees the scare thing, and just stops speaking about it, even though they have every right to.
And so having some of that.
That reassurance available can help out and make sure the talks continue to happen.
And so the good news on the MBTA is I was just seeing yesterday that some other researchers
also found some problems with the Charlie card on the MBTA.
And this time they were very nice to the researchers.
They listened to what the vulnerability was.
They talked it through politely.
And so things can change and get better.
And it went from a bad first contact situation.
To now, the way we'd like to see vendors, researchers working together to solve this common problem we have of security.
And one last thing before I pass this on, we talk a lot about I'm a U.S.
lawyer, talked a lot about the situation in the United States.
But security research is a global phenomenon and is done all over the world.
And one of the things that is cool about the United States is there's a long tradition of pro bono legal representation.
And a lot of lawyers, you know, even ones who work
at big law firms and such, see it as part of their their job to give back some of their time to the community through pro bono work.
But this is not a universal tradition.
And in many places around the world, your choice isn't pro bono counsel is not readily available or not available at all.
And so that is another reason it's good to have some some funding available to try and help people who are in a bad spot somewhere outside of the U.S.
So with that, let me turn it over to Hannah.
Hi, everyone.
Hi, everyone.
My name is Hannah.
I'm a staff.
Excuse me.
I'm a staff attorney at the Electronic Frontier Foundation, and I'm part of EFF's Coders Rights Project.
So I'm going to talk a little bit about Coders Rights Project, the kind of help that we offer to security researchers and the kind of counseling that we can provide for you all.
So first, EFF, I'm sure a lot of you are familiar with, but it was actually
founded.
Over 30 years ago in order to defend developers and programmers legally.
So Coders Rights Project currently continues that tradition of representing and counseling tinkerers and hackers and people who want to innovate while protecting their rights and promoting innovation.
So if you are someone who is doing security research, what happens when you need help?
How should you reach out to us?
Well, there are several ways that we get our clients at the Coders Rights Project.
The first way is through intake, which is our email info, info at EFF dot org.
You can email your questions there and say that you're seeking legal counsel about your issue.
Those emails that we exchange thereafter will be privileged.
And so you can disclose a lot more information so that we can help you.
Um.
Another way that we get folks is through informal referral network.
So this means that people might say sort of like what happened with Miles.
You know, people are asking around.
Maybe they're in some sort of trouble or they receive a cease and desist letter or something like that.
And other people will say, well, I know someone at EFF or you should reach out to EFF.
And those folks reach out to us.
And then the last way that happens all the time is here at conferences like DEF CON.
And other security conferences where people will come up to us after our talks or come up to the booth and say, hey, we have these issues and we can give out our contact information.
So, again, please do not talk about the possible felony that you committed in a room full of people.
But we will have a private conversation instead about it so that we can ensure that your privilege is protected.
We do get a lot of requests
through intake.
We are able to provide counseling for the vast majority of folks who reach out to the Coders Rights Project.
And what that means is that we will sit down with you.
We'll get information from you to make sure we have no conflicts of interest.
Then we will get, you know, details on what you did, how you did it, and what exactly your worries are and what your goals are.
And we will tell you about the legal risks, the possible, you know,
laws that could be invoked by adverse parties and the different things that, you know, could happen and what, you know, whether they're more likely to happen, less likely to happen.
It's hard to talking absolutes in the law, but we can definitely give you an idea of what your choices down the road can bring.
So when should you reach out?
Well, the earlier, the better, because the earlier, you know, if you have even an inkling,
that maybe there might be some legal legal problems down the road, you should you shouldn't wait until you get that cease and desist letter.
Reaching out early is really helpful because we can lay out the path before you and you can make informed decisions based on your risk tolerance and your priorities about what actions you want to take and what actions you don't want to take.
Because now you know what kind of risks those decisions can bring in the future.
So earlier is all.
Always better
as as was mentioned before, EFF doesn't always represent our coders rights clients in litigation.
And they're the reason for that is because EFF is an impact litigation firm.
And that means we are always either trying to make good law with cases or trying to prevent bad laws from happening with cases.
And so that means
that when we are thinking about what case to take, we think about things like the facts of the case, whether they are good, whether they might be in a good jurisdiction,
who are the judges that are likely to listen to this case and whether those judges are friendly to the arguments that we're making.
So those type of considerations come into play.
And the reason we can't take on everyone is because we have limited resources.
And there's a saying in Chinese that says you need to use the good steel
on the blade of the sword.
So you don't want to use it for the hilt.
You don't want it to use it for the sheath.
You want to use it on the blade itself.
And because we have limited resources, we really want to make sure that we're
creating the most impact when we spend those resources.
Now, individual representation, on the other hand, means you want to fight the best for your individual client.
So I used to be a public defender before I joined EFF.
And, you know, no matter who my client was,
I had to defend them.
I made the best legal arguments I could for their case.
I don't think about things like, are those arguments good for the community?
Whereas with impact litigation, you think about are the arguments we're
going to argue going to be good for the security research community as a whole?
So that's another reason why we don't take on
every one of our client or our counseling clients as our litigation clients.
But that's not to say it never happens.
Just a couple of years ago, Cara Gagliano, another member of the Coders Rights team,
as well as I, we represented another college student, actually, who was also a security researcher.
He looked into the code of the Proctoring software that his university used,
and he realized there were references in that code to two functions that Proctorio,
the Proctoring software company,
claimed that they don't have in their software and that they never do.
So he posted the snippets of those code online and criticized the company.
Proctorio took a bunch of different actions to take down the criticism as well
as the code, and he came to us and we began to counsel him on how to help him
respond to the takedown notices so that his code gets and his criticism gets
listed back up on Pastebin and GitHub.
And later, as we were in the process of counseling him,
we actually decided to take him on as a client in litigation.
And we filed a suit against Proctorio for what it was doing.
And the reason that we did that was
because that this case had a lot of specific facts about it that was good.
First, we think that it's very important to protect security researchers.
When they expose hypocrisy and inconsistencies in a company's claims
versus what its software seemingly is actually doing.
And we think that it is good for the security research community as a whole.
On top of that, it also concerned various other issues
that EFF is involved with, including student privacy and copyright.
So, like I said, it's not impossible for us to take on.
Our counseling clients as direct litigation clients.
But it doesn't happen all the time.
And with that, I will hand it off to Harley.
All right.
So I'm going to talk about the security research legal defense funds and sort
of round us out, we may or may not have time for questions because of the sound
issue earlier, so we're running a little bit behind, but we'll get to it if we can.
I am Harley Geiger and I am a counsel at Venable LLP.
I work on cybersecurity and privacy law and have been doing so for
about 15 years and I'm also the coordinator of the world's first security
research legal defense fund. I'm going to talk about that as a resource
that security researchers facing legal threats are able to to use.
So the defense funds is an independent nonprofit organization.
The defense fund is intended to help individuals who face security threats due
to good faith security research, sorry, I said security threats, legal threats
due to good faith security research or vulnerability disclosure.
The defense fund is not going to provide direct legal representation, so it's not
going to act as your attorney, you know, you have to find your own attorney.
However, the defense fund will provide funds for legal representation if you meet
certain criteria, so some of the criteria for being eligible are mostly these are
mostly centered around making sure that the defense fund is independent and acts
in the public interest. So one, the defense fund has an independent board.
The board approves.
Who can qualify for funds?
The board is presently Amy Stepanovich from the Future of Privacy Forum.
James Dempsey from UC Berkeley and Kurt Opsal from the Falkland Foundation.
Security researchers.
Second criteria security researchers have to show some financial need.
They don't necessarily need to be completely indigent, but in order to get
community funds, to be fair, there has to be some sort of financial need.
And then, as I mentioned a little bit earlier, the defense fund aims to help individuals for
threats related to good faith security research and vuln disclosure.
So and that definition loosely is testing or investigating security flaws for the
purpose of enhancing the security of the devices, the users or the systems.
The defense fund has to act in the public interest.
And so it's not going to defend even if
you're normally a good faith security researcher, if you commit an act of
extortion, you know, or if you have deliberately harmed the system or exfiltrated
PII, things like that, then you may not qualify.
Malicious attacks cannot qualify.
So for an example, as an example,
an independent hacker finds a vulnerability in a smart product.
They reach out to the product manufacturer to disclose the vulnerability.
The manufacturer, the manufacturer threatens a lawsuit against the hacker
unless they sign an NDA about the vulnerability.
And the hacker has an attorney but can't really afford to resist the lawsuit.
So the hacker can reach out to the security
research legal defense fund and ask for help.
The defense funds.
They will hear the background of the of the threats and the board will vote on
whether or not to help the hacker push back on the threat of lawsuit.
If the board votes yes, then it will help pay security and court fees for the hacker.
So our vision is that the security research legal defense funds will help
deter unfounded or overaggressive legal threats against hackers that are acting
in good faith. We also expect that this will help cut into the chilling effect.
That security researchers face if they know that this resource is out there
to potentially help them if they're acting in good faith.
And then lastly, we view the defense fund as encouraging hackers to model good
behavior because you will not qualify for the funds unless you are acting
in good faith and doing good faith security research.
So a note on the status and how the community can help.
And then we'll see if we can take questions if we're allowed
so that the security research legal
defense fund has launched.
It is operational.
You can visit the website now at security research legal defense fund dot org.
Or if that's too much, s r l d f dot org.
We have applied for 501 C three charitable status with the IRS.
And of course, the legal defense fund is a fund.
And so the funding model for the defense fund is driven by community donations.
And so the community is in a position to help itself.
Those donations are tax deductible.
And I believe.
Google has an announcement to make on on the donations to the fund.
Sure. Yeah.
So I actually have kind of two PSAs and and one announcement.
So first is a public service announcement for fellow corporate overlords in the
audience, different companies consider finding a way to to donate to the program.
Second, PSA is for researchers that if you are inclined to donate bug bounty
winnings for for any reason, either for its own sake or because maybe by the terms
of your employment contract, you're not allowed to accept winnings.
Consider donating to the funds.
And I'm happy to announce that any researchers in our Google bug hunters
program that opts to donate to the fund, Google will quadruple that donation.
That's amazing.
So beyond donations, the community can also help just by letting other people know this
resource is out there.
We need awareness in order for this to best serve the community.
So that's it.
I hope that you enjoyed this panel and I hope that you find it inspiring that the
security community has these champions like Kurt, like like Hannah, like like
Marcia Hoffman, you know, and others who have been defending security researchers
for so many years and hope that you find it inspiring that you have these assets
like the Coders Rights Project or the Security Research Legal Defense Fund and
key supporters like Google who are out there trying to ensure that good face
security research helps the community.
I think we should take pride in knowing the progress that the community has made.
Together, we're strong and we will continue to secure the world.
If we can take one or two questions before dissipating, is that not sure if that's
going to get a thumbs up or a thumbs down?
I think I have a thumbs up. All right.
Two thumbs up. Let's take questions.
I will say, though, please don't discuss personal legal
information in your question.
Privilege does not extend to the DEF CON floor.
We have a question.
It appears we do not have a microphone for this fine gentleman, so you're going
to have to scream.
The Best
bacteria,
good.
Great.
Thank you.
Didn't you want?
First of all,
you sound like you have a really cool job.
Seconds,
whether we take it in Bitcoin,
I don't see why not,
but that's going to have to be something
that will be discussed at the board level.
I think right now,
I don't think that we have the mechanism for that,
but I think that cryptocurrency,
EFF also takes donations.
We do take cryptocurrency donations.
So yes, I think eventually,
now whether we want to take it
from a shadowy quasi person
who has been called
and collaborating with people
who are possibly under sanction,
that's a different matter.
But thank you.
All right, I think we need to go
to make room for the next panel.
Thank you all so much.
We really appreciate you being here.
Thanks, everybody.
Let's take a group picture.