Liability for damages in the U.S. for finding and disclosing &quot;0-day&quot; computer exploit In the IT/Programming security world, usually people contact the vendor/owner of a particular software if they find a bug or security vulnerability and give them time to patch it before releasing the bug or vulnerability for public scrutiny/awareness. This is usually as a courtesy though unless you're bound by contract. But as asked in If I Find or Create a 0day: What if I find a vulnerability in a widely used piece of software? Can I be held liable for damages if I release "Proof of Concept" code to the public without giving the vendor time to properly patch and update its vulnerable code? UPDATE: After having a discussion about this question with some peers, I realized I need to be a bit more specific with the question: Security researchers usually work with the vendor to try and patch (fix) the error/vulnerability. If after sufficient (30 days?) time has passed and the vendor has not fixed the code then a full disclosure is released publicly. Can I be held liable for damages caused after the release of a "Proof of Concept" code if the software/vendor is open source? What if the vendor/software is closed source?
Can you be liable for damages? Under Tort Law, yes. Let's assume someone developed a virus based on your code. The virus caused millions of dollars of damage. The plaintiff (software vendor) can argue that: You have a Duty of Care to avoid acts or omissions which you can reasonably foresee are likely to injure your neighbor Donoghue v. Stevenson (1932) (UK) The concept of Duty of Care is also found in U.S. law, for example in MacPerson v. Buick Motor Co. (1916), which established that negligence does not require a contract. Breach of Duty: A reasonable person can foresee that the "proof of concept" can cause harm. The act of releasing code, therefore, falls short of the expected standard. If you are a IT professional, it is going to be difficult to defend this point. There is a causation relationship between your code release and the resulted damage. You are liable for negligence. Damage: It is likely that users will sue the software vendor for their loses. The software vendor will then sue you, since because of you, the software vendor has to compensate to its customers. This, of course, depends on what exactly did you release to the public. For example, if significant effort is needed to convert your "proof of concept" to an actual exploit, and you have provided a workaround to avoid this vulnerability, you may defend yourself by arguing that the cause and effect linkage is too remote. So I must keep the report private? What if the software is open source? Not really. You should take reasonable measure to ensure that your "proof of concept" is not an actual exploit, and a hacker needs considerable time to develop a functioning malicious software. CVE is a platform where vulnerabilities are publicly shared. What if you have given the vendor reasonable time to fix the vulnerability? It does not matter (to you) if time has been given for the vendor to fix the vulnerability. It does matter for the vendor, because if something happens later, the vendor is liable for knowing the problem well in advance and have not allocated the appropriate resources to correct the problem. To demonstrate a vulnerability exist does not require instruction of how to utilize this vulnerability. For example you can record a video showing the effects of the hack. Here (Wayback Machine; original link is dead) is an interesting read about Motorola taking matters into their own hands after they discovered a vulnerability on the Xerox CP-V system and Xerox did not patch the problem.
could this mean my employer owns the idea and anything I develop --since I would use the same technology for my idea that I do at work? No, unless by &quot;technology&quot; you mean the employer's materials or resources (see condition 3 of the clause). Your remark that &quot;this is completely and utterly unrelated to [employer's] business model&quot; survives items 1 and 2. Likewise, working on your idea outside hours survives the corresponding part of item 3. Would this also mean that any open-source software I develop outside of work automatically belongs to my employer? No, unless the software you develop is &quot;based on [your] knowledge [etc.] of (COMPANY)&quot;.
There are two common approaches. The first approach is simply to let copyright law apply. Under the default terms, the IT provider has no rights to copy your software. Running software is allowed, of course, and not a problem that you need to deal with vis-a-vis the IT provider. You still can sue them if they copy your software, even in the absence of a contract. That is the chief function of copyright, after all! The second approach is to allow the customer to subcontract third parties to act on behalf of them, while acknowledging that such subcontracting does not dissolve them from any responsibilities towards you. In other words, if the 3rd party would do something unauthorized, you have a claim towards the customer and they have a distinct but related claim towards their IT supplier.
This is part of an indemnification clause. Basically, the idea is that the service provider guarantees that if your business gets harmed because they let in an intruder, then they will absorb the losses if somebody sues you, as long as they have control of the court case and you cooperate with them in defending the court case. So, for example, imagine you are using a web hosting service. Suppose there is a vulnerability in the hosting service computers, and a hacker is therefore able to break into your web site and steal your customer information. Your customer sues you for allowing their credit card to fall into the hands of a hacker. The web hosting service's insurance will pay the damages if the lawsuit succeeds, as long as you let their lawyers (ie the insurance company's lawyers) run the defense of the lawsuit and you cooperate with them. The reason this language is there is because the "service provider" has an insurer that is guaranteeing them if they get hacked or something, then the insurer will cover any damages. The insurer requires them to make all their clients (like you) sign an indemnification agreement which includes the control clause.
Not legal advice - you should consult an attorney who knows your local jurisdiction. That's a general statement, but especially true here because the GDPR does not include personal liability for directors (or others) in the event of a data breach, but domestic laws may indeed do just that. The UK is one example where certain circumstances can lead to criminal liability for directors of a firm in the event of a breach. That said, your company should care. The fines for knowingly allowing a breach or not reporting it properly in a timely manner have been made more significant than the prior Directive. There are things you could do to potentially mitigate consequences in the event of a breach and a fine being levied on the company, such as aligning with best practices and getting certifications. In sum, the actual punishments for noncompliance will vary by jurisdiction, but any business that handles data in the EU should undoubtedly be ensuring it is aware of what, if any, obligations it has and taking steps to comply before May's deadline.
NDA provisions in general are rather similar. In particular the ones covering the exceptions to the confidentiality obligations required to the receiving party. Such provisions normally have the following wording (more or less): Information shall not be treated as Confidential if: - at the time of disclosure is already in the public domain or becomes available to the public w/o breach by receiving party; - the receiving party receives it from a third party free to lawfully disclose such information; - was in the prior lawfull possession of the receiving party; - was independently developed by the receiving party; - is approved to be released by the disclosing party; or - the receiving party is required by law to disclose in response to a valid order of a court or by a government agency. Your particular case might not necessarily fall under any of this exceptions (i do not know the exact wording of the NDA you're referring to) but in any case, please note that simply telling a third party that you are discussing the development of "an app similar to x but with a better UX and simpler design", might already be considered as a breach of confidentiality. Surely the NDA is identified as being Confidential itself and it probably also contains a section saying something like: "This Agreement and its contents shall be treated as Confidential Information".
What would be the legal validity of this behaviour? Your changes to the browser source of the website contract or license of Terms of Service (TOS) - essentially a "click-wrap" license - before agreeing to it means nothing in a legal sense, other than to void the contract. The other party (the website) can't possibly agree to those contract changes without them being submitted as contractual changes and agreeing to them, if they did agree to them. That's basic contract law. That website TOS probably has a clause that says that if you don't agree to the TOS in full, as written, without modifications, you can't use the website. And the TOS may also say that they reserve the right to prevent you from using the site by closing your account or even blocking your access. Your "witness" to the contract changes is meaningless, as your witness is not a party to the contract. And any witness to the fact that you have changed the terms of the TOS before agreeing to it would work against you in a civil proceeding as proof of your attempt at modifying the contract.
The employee must, during and after employment, without limitation in time, observe a duty of confidentiality regarding [...] the Company's internal affairs such as business plans, profitability, pricing, employees, methods, processes, routines, code and the like as well as other information that the Company typically wants to keep secret The pure information that the company had at some time a security problem with their product is internal knowledge you only gained through working there. By what is written here, you are indeed prohibited from speaking about it. If it were public knowledge, you could point to a press release and say &quot;I did that, that was me fixing the problem&quot;. That would work. Because it doesn't share anything that isn't public anyway. But you cannot share things the company wants to keep secret. Finding out whether that contract is legally enforcable in your country and juristiction is the job of a real lawyer, but just as written, they are right. You signed a contract to not do that, not talk about it an certainly not publish it on the internet. So you should not do that, unless a good lawyer you trust tells you otherwise. That said, &quot;I found a security flaw&quot; is about as impressive as &quot;I found a dollar on the floor&quot;. Maybe you can talk about your knowledge to prevent something like it happening. That says nothing about whether or not it happened in your old company, and for me as an employer it is much more valuable to have you on board with structured knowledge you can apply, than with your memories of being lucky once.