I just don’t get why Apple wouldn’t cite the law if that’s the reason? Surely doesn’t look good on them if they’re just holding back bounties for undisclosed reasons.
"Oh, you can't pay because we are in Russia, just pay to our Massachusetts subsidiary!"
I would still call this a "refuse to" vs "can do", but hey, Apple can keep that money - keeps the layoffs away.
It's not the first time we've seen Apple not playing nice with their bug bounty programme, so it's something of a pattern of behaviour. "A show of good will" is exactly what they need.
... and who knows where that could lead. Why, the rabble might get the idea that they're allowed to disapprove of decisions Apple makes!
It clearly has. There are lots of hackers and security researchers who will make very different decisions depending on if they expect Apple will honor their bounties. Traditionally, people who report security bugs have been treated poorly, and arbitrary rejections certainly helps move the incentives towards the exploit market instead.
Makes total sense to me.
Any potential downside far outweighs the upside. Apple does not want to get on the State Department’s shit list, period, and certainly not to do goodwill efforts for the Russians.