Morrison Foerster is an international law firm with lawyers practicing throughout the United States, Asia, and Europe. Click to discover more.

mofo_share_image.jpg

Morrison Foerster

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Terms / Notices

Cookies

Privacy Policy

Attorney Advertising

Secure Login

Alumni

  Facebook

MoFo Facebook

  Linkedin

MoFo LinkedIN

Twitter

MoFo Twitter

YouTube

MoFo Youtube

Morrison Foerster - Footer

You have not solved the recaptcha challenge yet or session expired, try again.

Disclaimer

Unsolicited e-mails and information sent to Morrison Foerster will not be considered confidential, may be disclosed to others pursuant to our <a href="https://www.mofo.com/about/privacy-policy.html">Privacy Policy</a>, may not receive a response, and do not create an attorney-client relationship with Morrison Foerster. If you are not already a client of Morrison Foerster, do not include any confidential information in this message. Also, please note that our attorneys do not seek to practice law in any jurisdiction in which they are not properly authorized to do so.

Feedback

mofo-logo-2022.svg

People

Capabilities

Resources

About

Culture

Offices

Careers

Stay Connected

A wide range of organizations have embraced vulnerability-disclosure programs (VDPs) that actively encourage members of the public to hack into their own company systems. Under a VDP, a company invites “good” or “ethical” hackers to explore the company’s systems and then to report back about any discovered weaknesses. The information reported is then used to fix the vulnerability and to implement stronger protections going forward. A form of VDP surging in popularity is the bug-bounty program (BBP), in which financial or other incentives are offered to outsiders for reporting relevant information.

Bug-Bounty Programs: A Valuable Tool to Be Used Carefully

About Morrison Forester

people-default-header-desktop.jpg

people-default-header-mobile.jpg

Default Meta Data

A wide range of organizations have embraced vulnerability-disclosure programs (VDPs) that actively encourage members of the public to hack into their own company systems. Under a VDP, a company invites “good” or “ethical” hackers to explore the company’s systems and then to report back about any discovered weaknesses. The information reported is then used to fix the vulnerability and to implement stronger protections going forward. A form of VDP surging in popularity is the bug-bounty program (BBP), in which financial or other incentives are offered to outsiders for reporting relevant information.BBPs have come into favor because they represent a cost-effective “force multiplier” that can augment existing efforts a company may be pursuing to identify and remediate vulnerabilities. Companies are understandably attracted to the idea of making a $500 payout (the approximate average reward for a discovered bug of any severity)<a href="#_ftn1" name="_ftnref1" id="_ftnref1" class="anchor">[1]</a> as an alternative to enduring an incident that could ultimately cost millions of dollars.<a href="#_ftn2" name="_ftnref2" id="_ftnref2" class="anchor">[2]</a> Some companies see such programs as a lower-cost complement to increasing investment in internal security measures. Even large institutions that make substantial investments in internal security experts recognize the value of enlisting outside actors with a new perspective to stress test and supplement those efforts.As the benefits of having a BBP have become widely known, a growing range of companies have decided to adopt them. Such programs are no longer the exclusive province of technology companies, including giants like Google,<a href="#_ftn3" name="_ftnref3" id="_ftnref3" class="anchor">[3]</a> but also include retail and service companies, such as Starbucks.<a href="#_ftn4" name="_ftnref4" id="_ftnref4" class="anchor">[4]</a> Over the past year, we have seen companies of all sizes and industries institute these types of programs to good effect.Notably, the U.S. government has joined these efforts with programs such as “Hack the Pentagon,” a bug-bounty program instituted by the U.S. Department of Defense in 2016 after a successful pilot.<a href="#_ftn5" name="_ftnref5" id="_ftnref5" class="anchor">[5]</a> As then-Secretary of Defense Ash Carter observed, “We know that state-sponsored actors and black-hat hackers want to challenge and exploit our networks. . . . What we didn’t fully appreciate before this pilot was how many white-hat hackers there are who want to make a difference, who want to help keep our people and our nation safer.”<a href="#_ftn6" name="_ftnref6" id="_ftnref6" class="anchor">[6]</a>While there are considerable benefits to gain from having a BBP, companies must be careful in how they design and implement these programs to avoid legal and reputational risk. Both the design phase of the program as well as the response to specific reports can pose challenges that must be navigated carefully.Based on what we have observed, there are several topics organizations must pay special attention to:<ul><li style="margin-bottom: 10px;">When designing the program, think carefully about what network components and data to include and consider making sensitive information off limits. This point was emphasized in Department of Justice (DOJ)-issued guidance on VDPs.<a href="#_ftn7" name="_ftnref7" id="_ftnref7" class="anchor">[7]</a> Entities must consider a number of factors when deciding what should be included within the scope of a BBP. Such factors include the sensitivity of the information, the safeguards already in place, and any applicable regulatory or contractual restrictions. To the extent an organization decides to include within its BBP a system that contains sensitive information, organizations might consider implementing technical methods that prevent participants from being able to access the information.</li><li style="margin-bottom: 10px;">When drafting the publicly available policy for the program, be clear on the scope of authorized conduct. It may be useful, for instance, to prohibit participants from engaging in any intentional conduct that changes user-generated data, impairs or disables systems, or that otherwise makes data inaccessible or includes the downloading of any company information. Not only does this clarity avoid creating questions later in a civil-suit context about what may have been “authorized” through its program, it also removes a potential impediment to DOJ bringing a criminal case under the Computer Fraud and Abuse Act arising out of a malicious hack of the company’s systems.</li><li style="margin-bottom: 10px;">Consider what federal agencies have stated about VDPs. DOJ is not the only federal agency thinking seriously about VDPs. The Federal Trade Commission, National Highway Traffic Safety Administration, and Food and Drug Administration have issued guidance on best security practices that include consideration of VDPs.<a href="#_ftn8" name="_ftnref8" id="_ftnref8" class="anchor">[8]</a></li><li style="margin-bottom: 10px;">Decide in advance what proof is needed to confirm a hack. Companies also should specify how that information should be shared with them.</li><li style="margin-bottom: 10px;">Assign a central point-of-contact to receive vulnerability disclosure reports and be clear about which personnel are authorized to answer questions about the program. It is easier to respond to unusual reports and difficult questions if there is a clear point of reference for report processing. Questions that raise new and unanticipated legal issues should be handled carefully.</li><li style="margin-bottom: 10px;">Be clear and transparent about whether and how you will pay a bounty. This means setting reward amounts for different discoveries. Additionally, while some organizations offer cash rewards, others, like Massachusetts Institute of Technology<a href="#_ftn9" name="_ftnref9" id="_ftnref9" class="anchor">[9]</a>, offer alternative perks.</li><li style="margin-bottom: 10px;">Only pay a bounty if it is for an activity that is specifically authorized by your policy. It is important to create rules and to follow them closely. Otherwise, a company might put itself into an unfavorable negotiating position with participants.</li><li style="margin-bottom: 10px;">Consider using test accounts. This will help to ensure that customer data is not unnecessarily compromised through the BBP.</li><li>Consider a third-party host. Depending on the company, there may be value to using a third-party platform to host the program.</li></ul>Each organization is different in terms of the types of information it holds, the legal regimes to which its information is subject, and the contractual and other obligations that may restrict disclosure. Additional legal issues arise where a company stores data or conducts activities outside the United States. The International Organization for Standardization and the International Electrotechnical Commission published standards on designing VDPs and, like DOJ, recommend that any company that adopts a VDP obtain legal advice in order to ensure that their programs are consistent with local laws.<a href="#_ftn10" name="_ftnref10" id="_ftnref10" class="anchor">[10]</a>The bottom line is that BBPs are a valuable tool that should be carefully designed and deployed to maximize benefits and reduce risks to the organization. The above lessons should not dissuade organizations from giving BBPs serious consideration. But they highlight the value in taking time to design and implement the programs thoughtfully.<div data-type='hr' style='border-top: 3px solid #bbb'></div><a href="#_ftnref1" name="_ftn1" id="_ftn1" class="offset">[1]</a> Hacker-Powered Security Report of 2017, Hackerone, 15 (2017), <a href="https://www.hackerone.com/sites/default/files/2017-06/The%20Hacker-Powered%20Security%20Report.pdf" target="_blank">https://www.hackerone.com/sites/default/files/2017-06/The%20Hacker-Powered%20Security%20Report.pdf</a>.<a href="#_ftnref2" name="_ftn2" id="_ftn2" class="offset">[2]</a> Marten Mickos, Should a company have a bug bounty program?, Quora (Mar. 4, 2017), <a href="https://www.quora.com/Should-a-company-have-a-bug-bounty-program" target="_blank">https://www.quora.com/Should-a-company-have-a-bug-bounty-program</a>.<a href="#_ftnref3" name="_ftn3" id="_ftn3" class="offset">[3]</a> Google Vulnerability Reward Program (VRP) Rules, <a href="https://www.google.com/about/appsecurity/reward-program/" target="_blank">https://www.google.com/about/appsecurity/reward-program/</a> (last visited Feb. 11, 2018).<a href="#_ftnref4" name="_ftn4" id="_ftn4" class="offset">[4]</a> Starbucks Bug-Bounty Program Policy, <a href="https://hackerone.com/starbucks" target="_blank">https://hackerone.com/starbucks</a> (last visited Feb. 11, 2018).<a href="#_ftnref5" name="_ftn5" id="_ftn5" class="offset">[5]</a> Hackerone Hack the Pentagon, <a href="https://www.hackerone.com/resources/hack-the-pentagon" target="_blank">https://www.hackerone.com/resources/hack-the-pentagon</a> (last visited Feb. 11, 2018).<a href="#_ftnref6" name="_ftn6" id="_ftn6" class="offset">[6]</a> U.S. Dep’t of Defense, Remarks by Secretary of Defense Ash Carter at Hack the Pentagon Ceremony (June 2016), <a href="https://www.defense.gov/News/Transcripts/Transcript-View/Article/802660/remarks-by-secretary-carter-at-hack-the-pentagon-ceremony/" target="_blank">https://www.defense.gov/News/Transcripts/Transcript-View/Article/802660/remarks-by-secretary-carter-at-hack-the-pentagon-ceremony/</a>.<a href="#_ftnref7" name="_ftn7" id="_ftn7" class="offset">[7]</a> Last year, DOJ issued guidance on designing and implementing VDPs. The guidance covers four areas: (1) the design of the program; (2) the plan for administering the program; (3) the drafting of the vulnerability disclosure policy; and (4) the implementation of the program. While the DOJ guidance is not mandatory and does not have the force of law, it reinforces many sound practices. See U.S. Dep’t of Justice, A Framework for a Vulnerability Disclosure Program for Online Systems (July 2017), <a href="https://www.justice.gov/criminal-ccips/page/file/983996/download" target="_blank">https://www.justice.gov/criminal-ccips/page/file/983996/download</a>.<a href="#_ftnref8" name="_ftn8" id="_ftn8" class="offset">[8]</a> See Federal Trade Commission, Start with Security: A Guide for Business, 12 (June 2015) (noting that, in one case, “the FTC charged that the company didn’t have a process for receiving and addressing reports about security vulnerabilities.”), <a href="https://www.ftc.gov/system/files/documents/plain-language/pdf0205-startwithsecurity.pdf" target="_blank">https://www.ftc.gov/system/files/documents/plain-language/pdf0205-startwithsecurity.pdf</a>; National Highway Traffic Safety Administration, Cybersecurity Best Practices for Modern Vehicles, 14 (Oct. 2016) (highlighting that members of the automotive industry should weigh whether to create vulnerability reporting policies), <a href="https://www.nhtsa.gov/staticfiles/nvs/pdf/812333_CybersecurityForModernVehicles.pdf" target="_blank">https://www.nhtsa.gov/staticfiles/nvs/pdf/812333_CybersecurityForModernVehicles.pdf</a>; Food and Drug Administration, Postmarket Management of Cybersecurity in Medical Devices, 13-14 (Dec. 2016) (suggesting that vulnerability disclosure programs can play a beneficial role as part of a cybersecurity risk management program), <a href="https://www.fda.gov/downloads/medicaldevices/deviceregulationandguidance/guidancedocuments/ucm482022.pdf" target="_blank">https://www.fda.gov/downloads/medicaldevices/deviceregulationandguidance/guidancedocuments/ucm482022.pdf</a>.<a href="#_ftnref9" name="_ftn9" id="_ftn9" class="offset">[9]</a> Massachusetts Institute of Technology Bug-Bounty Program Policy, <a href="https://bounty.mit.edu/" target="_blank">https://bounty.mit.edu/</a> (last visited Feb. 21, 2018).<a href="#_ftnref10" name="_ftn10" id="_ftn10" class="offset">[10]</a> See ISO/IEC 29147. Information Technology – Security Techniques – Vulnerability Disclosure (2014), <a href="https://www.johner-institut.de/blog/wp-content/uploads/2017/02/ISO_IEC_29147_2014.pdf" target="_blank">https://www.johner-institut.de/blog/wp-content/uploads/2017/02/ISO_IEC_29147_2014.pdf</a>.