Is it legal to sell security vulnerabilities you found while working with a company to that company? Suppose you were working at a company for a few years, and during your time there you found a few computer security vulnerabilities that could be used by potential attackers. If you were to compile them into a report, would it be legal to sell it to that company (in the United States)? Edit: In cybersecurity, there's a term called responsible disclosure. In essence, you notify the company of a vulnerability and give them plenty of time to take care of it. Typically, if the company doesn't do anything about it, the person will publicly disclose the vulnerability to get the full attention of the company (full disclosure). What are the legal implications of full disclosure?
Well, as always, the answer is &quot;it depends&quot;. It isn't illegal per se. If both parties agree, it's good business. You get paid for the work of compiling the report. For example, let's say you leave and are no longer working for them, and they call you and say &quot;hey, you know those security vulnerabilities you were talking about last year? Yeah, the boss finally decided to give it priority, but it seems we kept no notes in that meeting. Could you compile a report for us? I know you no longer work here, but we would pay you a little more than the normal contractor rate if you are interested&quot;. That's perfectly fine. Now, not disclosing them when you found them could be seen as a breach of contract, which implicitely includes the duty of loyalty. Keeping it a secret to cash in on later is certainly sleazy. The compiled report might, depending on state laws, your specific contract, and who can pay the better lawyer, end up as their's. You can only compile that report because you worked there and you got knowledge of those vulnerabilites only as a part of your job. And finally, even if you did compile a report and it is waterproof and it is yours exclusively, it very much depends on the &quot;else&quot;. What if they just say &quot;no thanks&quot;? Selling that report to someone else is illegal. So you have exactly one legal buyer and that buyer knows it. Does not sound like a great bargaining position. If you approach them, it takes a lot of skill and maybe a bit of legal training to make sure it does come across as an offer of &quot;good business&quot;. I think it would be easy to be misinterpreted as either blackmail or selling them knowledge they legally probably already own. So unless you are certain you can fit into that &quot;good business&quot; model of selling your work compiling a report, instead of selling the knowledge of their secrets, it might be safer to not do that. If they approach you, it should not be a problem, but if you approach them, it will be a mess, no matter how well you mean it.
Not that I am aware of. A person who 'owns' a domain is entitled to utilize that domain including for the purposes of receiving emails. With physical mail, it is a crime in most countries to intentionally interfere with mail that is not addressed to you. For example - Australia. However, this is statute law and as such does not extend to emails - even if it did, if you own the domain then you are the person to whom it was addressed. I note that you seem to misunderstand "confidential" - this only arises in the context of a special relationship between the person transmitting the information and the person receiving it. Usually this is a contractual obligation between A and B but it can be imposed by law (e.g. doctor-patient, banker-client, lawyer-client, GDPR etc.). If A sends confidential (as between A &amp; B) information to C, C is under no general obligation to keep it confidential if C has no relationship of confidentiality with A or B. If C discloses it and B suffers damage, B sues A for breach of confidence (or the government prosecutes A for breaking the law); B has no case against C. For your situation, where B has allowed A to send the information to an obsolete address then B has contributed to the breach to an extent that B would be extremely unlikely to succeed in a suit against A.
It's not clear exactly what you're asking, when you say "the company I work for" – i.e. are you asking "can they fire me?" (almost certainly they can, even if their TOS thinking is legally misguided – unless in your country there are laws that prevent firing employees). To be certain, you need to hire an attorney who is sufficiently savvy about web page technology that they can accurately judge what you are doing, and whether you can fruitfully resist their demands. You seem to be skeptical of their position because you are "not affecting their servers in any way". The TOS is not about affecting their servers, it is about affecting their intellectual property. It appears that your code does a number of the prohibited actions such as and perhaps most importantly "modify". If you have distributed a program that allows users to modify company content on their own computers, then the user might be in violation of the TOS, but not you (since you're not running a server that redistributes). However, I am betting that in order to create and test the program you had to violate the TOS. Additionally, you could be vicariously liable for the infringements of others, especially if this program can only be used to infringe on copyright, and you know this fact. That is pretty much the end of the legal part. As for how you should respond, your attorney, and not Law SE, deals in recommendations.
Yes, there is legal precedent against this that would only apply to a government employee. First, let's discuss the private sector. In this case, you are a private employee that comes to your place of work and accuses you of "stealing the cookies from the cookie jar" which is a serious criminal offense. They wish to talk and your boss is in the room. You plead the 5th, but your boss says you're fired if you don't talk to the cops. This is legal because you still have the right to refuse to talk, you just lose your job. A private employer has the right to free association, and wants nothing to do with cookie thieves, alleged or actual. However, in the government employ, your boss is an agent of the government. This same situation is different because the government pays the boss and the agent... so in essence the government is saying talk or be fired. This is unconstitutional as the government cannot retalitate against you for your refusal to talk. Generally, in order to talk to you, the investigator would need either a signed Garrity Statement or a Signed Kalkines Statement. The former is a statement saying that they are investigating a wrong doing but you cannot lose your job if you refuse to speak to the investigators, where as Kalkines says you must talk but you are granted immunity for your part in the wrong doing, so long as you make truthful statements. For more on this, check this legal blog. There is also the matter that a false accusation (and let me be clear... this is academic, I'm not saying the accusation in the real life topic is false, nor am I saying that the defense is false... we're merely discussing a possibility) is made to your employer and they do not offer the job on the basis of the accusation alone, this is grounds for defamation actions... and in certain jurisdictions, it's criminal defamation, so there could be jail time. It's interesting you mentioned teachers, because this happens alot. Kids do know that there are certain things that get a teacher fired quickly, so teachers do get the occasional false accusation of sexual assault (I know one teacher who has had multiple accusations over the course of her career). One of the few good things I can say about the Teachers Union is they cover the legal defense of accused teachers. The accusations do get the teacher removed from the class for sometime, but they don't lose their jobs over this matter. It's followed up but the accusation doesn't immediately lead to the teacher getting fired..
As you have agreed, by contract, not to reverse engineer the product, technically it would be a "breach of contract" to do so, assuming such terms are enforceable where you live (or wherever the EULA selects as the choice of forum).
&quot;Wholly unconnected with your employment&quot; means exactly that. Anything that is not connected to your functions or processes that you use in the course of your employment that your employer would have an interest in either protecting or marketing. Writing a book about software development If you are just a software developer, this would be fine unless you were talking about a process unique to your employer. If you worked in a publishing house that wrote software development books, this would be connected and must be disclosed to your employer. Releasing an open source piece of software not specifically aimed at the industry the company is in Again, this probably fine not to disclose since it would not be something you would develop as part of your employment, or under the umbrella of your company focus market. Release a commercial piece of software not specifically aimed at or competing with the industry the company is in Same as above. Honestly though the best policy is being open. If you come to your company with your idea and tell them that it doesn't have any applications in your industry and would like to develop it in your own time, they would have a much harder leg to stand on in a court case when they finally figured out how to apply it.
What does your contract with your client say? What does your contract with your sub-contractor say? Typically the client contract will not specify HOW the work gets done, just the deliverable(s), the price and the liability. Unless your client contract says otherwise, it's perfectly legal for you to farm out the work. It's also perfectly fine for you to deduct the cost of the sub. As long as that's profitable the IRS will have no problem for that at all: that's a perfectly normal business practice. Things are a bit more complicated if you farm out at a loss since that could be interpreted as a tax evasion scheme. However, as long as it's reasonable, that's fine. If there are defects in the work product, the client will come after you, regardless of who did the work. It's generally your responsibility to fix the issues, cover damages etc. You, in turn, can try to recover your damages from the sub, but that depends on the nature of the contract you have with the sub.
As long as what you are posting is factual, public knowledge then you shouldn't be in violation of any SEC rules. Short-selling in-and-of itself is perfectly legal, so is exercising your right to free speech, in so far as the things you say are true and known. Now if you made up some story about Musk and it caused the stock to fall where you gain, this could be a violation. Likewise if you have come to be in possession of private knowledge and blog about that, you could be in violation of SEC rules.