Hacker News Reader

Comment by Someone1234 | Hacker News Reader

Specifically which law do people believe selling exploits violates? Off the top of my head I've only got "conspiracy"-like laws and international embargoes (depending on buyer).

Should it be illegal? Yeah, potentially. Is it? Unclear.

View on HN

Why should it be illegal? From a US perspective, I don't think selling words/ideas should be illegal in most cases--especially just because it could be used for doing something illegal. For instance, there are books which describe chemical processes for synthesizing methamphetamine (https://www.amazon.com/Secrets-Methamphetamine-Manufacture-U...). But they are not illegal, because if they were it would infringe upon freedom of speech. Deciding what can and cannot be sold/published is a very authoritarian path to go down. It is better to just outlaw the criminal behavior.

I'm extremely wary of a law that would potentially criminalize that. It would almost certainly have to be very vague and prone to being abused by malicious prosecutors. How would you set it up such that it's illegal to sell an exploit to a supposedly malicious actor, but not illegal to sell or negotiate prices with the company maintaining the software or some other company that they deem to be their agent for managing security reports, per current White Hat practices?

Conspiracy convictions usually require proof that the suspect had created a plan to commit a serious crime and has taken active steps towards the execution of that plan, even if they haven't committed the actual crime yet.

We're already perilously close to US Federal Prosecutors being able to lock up anybody they don't like indefinitely. It's so exorbitantly expensive to fight Federal charges that hardly anybody really does, much less does successfully. The last thing we need is more vague Federal criminal laws with poorly thought out evidence and mens rea requirements.

There's no selling/negotiation in the current model. If you go to Google and say "I found this bug, I'll tell you what I did for $50K", that's extortion. If you disagree with their classification or payout, you can contest that classification in the system - but you are not arguing on the price of the exploit, you are arguing on what the exploit is.

At least accessory to crime if the exploit is used in a criminal activity, I presume?

If you traded it off tor with a burner computer at a cafe or something, there is absolutely no way anybody could trace it back to you. It took the FBI to catch the silk road guy several years and iirc they pinned him on buying a hitmans services, not drug trafficking.

While I agree with you, any competent lawyer could frame this under the Computer Fraud and Abuse Act

Reply on news.ycombinator.com