The Justice Department wants to help you run a vulnerability disclosure program

The Justice Department quietly released guidelines last week to help interested companies effectively design their own software vulnerability disclosure programs.

The Justice Department quietly released guidelines last week to help interested parties design their own software vulnerability disclosure programs in a manner that avoids legal issues traditionally caused when a hacker remotely accesses a computer system without prior consent.

These vulnerability disclosure programs, typically known as bug bounties, are typically created to allow participating parties to receive confidential information from independent researchers about software and hardware bugs that are affecting a company’s own systems or products. But the practice can sometimes run up against legal complications tied to the Computer Fraud and Abuse Act, or CFAA, which has been applied in different court cases in a variety of conflicting ways.

Critics of CFAA have said the law is often vague and outdated, stunting researchers’ ability to find vulnerabilities without running afoul of the law.

In short, the guidance underlines an effort by the federal government to apparently quell concerns held by some companies and researchers that hope to participate in such programs.

The eight-page government-produced advisory, which provides general tips and a list of factors to consider when launching such a program, is the first of its kind. The release underscores a broader belief by the federal government that, if properly managed, programs of this sort can offer a cost-effective way for organizations to improve their security posture. In addition, a well organized program will clarify what is and isn’t legal from an independent researchers’ perspective.

Mårten Mickos, CEO of vulnerability coordination and bug bounty platform company HackerOne, described the Justice Department’s guidance as “useful,” but said that it was missing a plan for “organizing remediation and bug fixing” and also “reporting of results to key stakeholders and decision-makers.”

“Working with hackers is the most efficient way for a corporation to improve application security because it allows security teams to focus on fixing vulnerabilities rather than bug hunting,” Mickos said.

Leonard Bailey, special counsel for national security with the Justice Department’s Computer Crime and Intellectual Property Section, announced the publication of the guidance Friday while speaking at the DEF CON hacking conference in Las Vegas.

“Some organizations are informally soliciting vulnerability reports without creating structured vulnerability disclosure programs … The Criminal Division’s Cybersecurity Unit has prepared this framework to assist organizations interested in instituting a formal vulnerability disclosure program,” the guidance reads. “[Our] framework outlines a process for designing a vulnerability disclosure program that will clearly describe authorized vulnerability disclosure and discovery conduct, thereby substantially reducing the likelihood that such described activities will result in a civil or criminal violation of law under the Computer Fraud and Abuse Act.”

The full guidance is now available on the Justice Department’s website.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure