How can you legally threaten someone and not face consequences, but if you threaten someone with physical violence you can go to jail?
That's already the case. Lawyers can be disbarred for filing frivolous lawsuits.
The general form of such a "legal threat" (threat relating to the law) is perfectly reasonable, normal, and legal (as in, conforming to the law). It's a standard part of practicing law.
However, in this specific case, they do appear to have broken one professional rule, regarding the threat of criminal prosecution conditional on a civil demand.
Aside from that one professional rule, the Fizz/Buzz letter was probably perfectly technically accurate. Whether the DA would take up the case, I doubt, but that's up to their discretion/advice from the DoJ, not based on the legal code.
I think Fizz/Buzz were incredibly foolish to send such a letter, as the researchers were essentially good samaritans being punished for their good deed (probably only because customers don't like it when supposedly professional organizations are found to be in need of such basic good deeds from good samaritans, and Fizz/Buzz would rather punish the good samaritans instead of "suffering" the "embarrassment" of public knowledge).
Completely baseless stuff can get lawyers disbarred, but many things are shades of gray. The way the CFAA is written, just about any security research on someone else's machine that doesn't include "we got permission in advance" often falls into this gray area.
The fact that the DOJ doesn't prosecute good-faith security research is DOJ policy, not actual law. The law as-written doesn't have a good-faith exemption.
It's only legal to use the legal action, period. Once you pull in a THREAT, it becomes blackmail/extortion.
It's kind of a tricky gray area where similar demands might be legal, but I do think in this case it should be illegal.
> If it's a threat, then that's literally blackmail.
1. threatening violence is explicitly a crime
2. at a higher level, threatening violence is a crime because the underlying act (committing violence) is also a crime. threatening to do a legal act is largely legal. it's not illegal to threaten reporting to the authorities, for instance.
How about you don't do the action that makes you punishable with 20 years in prison?
On a more practical level, if someone is breaking into your house, should it be illegal to tell them to stop, on pain of you calling the police which presumably would cause them to be incarcerated?
Not a lawyer, but there's a fine line between extortion and not-extortion.
It's not extortion when you're making the threat to either stop an illegal behavior or secure something you already have rights to. Like, "I'm calling the cops if you don't return the kids on the time/date we agreed on in the goddamn divorce papers" is not extortion, because you have a legitimate claim to defend.
It is extortion when you're trying to use the threat of law enforcement as a means of engineering consent or coercing someone into doing something. Like, "I'm going to call the cops and tell them about your shoplifting unless you send me nudes/pay me $500/keep your mouth shut." You can't leverage withheld knowledge of a crime as a means of controlling someone. Otherwise it opens the door to "Remember that time you raped me? You need to do me another favor to make it right"-type of arrangements.
The first example would be extortion if the kids were returned late but it was not reported, and the other party continued threatening to report it after the fact to enforce future compliance.
A more equal comparison might be "If you tease a gorilla they might seriously hurt you"
It absolutely can be illegal, in the case of extortion. If you say "do this or I turn you in" that's extortion.