Hacker News Reader

Comment by jonny_eh | Hacker News Reader

That may be considered black-mail by some courts.

Can you explain it more? What can make it a black-mail and why?

If there is no intent to abuse the bug when not paied then there is no additional threat there from simply notifying the company that some threat is already present. How it can become a black-mail?

So every report about discovered bug can be considered as black-mail? If one discovers a bug, reports it to the company and says that after 3 months it will be public it's a black-mail too?

Or the payment request makes it different? And if person doesn't threat to publish the bug then it's ok?

Definition: Blackmail involves a threat to do something that would cause a person to suffer embarrassment or financial loss, unless that person meets certain demands. [0]

[0] https://www.justia.com/criminal/offenses/white-collar-crimes...

The longer a bug goes without being reported, the greater the potential impact. So not reporting a bug could be considered a form of abusing the bug. There's probably a moral obligation to report bugs promptly. Bug bounty programs that companies have are ultimately a reward for being a nice person, as opposed to being a payment for services rendered.

Yes, it's the payment request.

In the US, blackmail has a very specific meaning: it is a threat to inform law enforcement of a violation of federal law under demand of a thing of value. This would actually be extortion, which is defined in 18 USC 875(d):

Whoever, with intent to extort from any person, firm, association, or corporation, any money or other thing of value, transmits in interstate or foreign commerce any communication containing any threat to injure the property or reputation of the addressee or of another or the reputation of a deceased person or any threat to accuse the addressee or any other person of a crime, shall be fined under this title or imprisoned not more than two years, or both.

https://uscode.house.gov/view.xhtml?path=/prelim@title18/par...

I dont think apple is entitled to that information on any basis, and i dont think its a legitimate threat to expose actual ill behaviour

I think they're talking about the implication that if Apple don't pay, then the vulnerability is published.

I agree with you on a moral basis: what difference does it make if I get payed not to publish it vs. If I just publish it without even asking to get paid. But I'm not sure the law would agree with us.

I think, like in many legal matters, precedent and intent is key. Without ill intent there is no 'mens rea', or "guilty mind".

In this case you aren't just a vigilante targetting apple, there is established practice stretching decades.

There is also a duty on you as a security proffeshional, and there is a significant public interest in knowing about the vulnerability. So , most likely, it will be you doing your job.

All blackmail involves exposing something that someone doesn't want exposed - usually because the "something" is illegal. And yet, blackmail itself is illegal.

Most countries have a culture against whistleblowers, starting from childhood ("don't be a tattletale", "don't be a rat").

And that anti-whistleblower culture enables fraud like theranos to be undiscovered for years

It's only blackmail if the threat is to do something you are not otherwise legally allowed to do. It is legal to, say, announce a zero-day on Twitter. Or to sell the zero-day to the NSA, or some grey hat broker like Zerodium.

In the US at least I don’t believe the act has to be illegal.

No it's not. Pay me $10,000 or I tell everyone you slept with your secretary is blackmail.

Ok, you got me. But there must be more to the definition of blackmail than simply, pay me or else. If that were the definition, then everyone would be a blackmailer by virtue of "pay me for this or else I'll sell it to someone else," which is a "threat" we all implicitly make every day.

I guess that's true. Whats the end state if Apple refuses to pay?

“It would be a shame if someone used this vulnerability”

Then Apple gets a reputation for refusing to pay, less folks look for and responsibly disclose vulns in Apple products, and their security posture as as whole suffers.

Reply on news.ycombinator.com