USENIX Security '18 - The Law and Economics of Bug Bounties

Amit Elazari Bar On
Doctoral Candidate, Berkeley Law, Center for Long-Term Cybersecurity Grantee

Abstract:
Bug Bounties are one of the fastest growing, popular and cost-effective ways for companies to engage with the security community and find unknown security vulnerabilities. Now it’s time to make them fair to the most important element in the Internet’s immune system: security researchers. This talk will showcase how lacking policies in bug bounty programs put hackers at legal risk and affect their incentives, and how to fix this problem that affects all of us, researchers, security practitioners and technology users.