extortion
Withholding information about a problem as extortion - computer security research
<p>Over at Security.StackExchange, a discussion broke out over the use of the term "extortion" in a situation where an anonymous security professional sent an email to a business to say that they found a vulnerability in the business' website, but the security professional asked for money upfront before they would discuss any details.</p>

<p>The rest of the context of the email suggests that it is likely a scam (they likely have nothing of value to offer), but I want to put that aside. The actor could or could not have an actual vulnerability to discuss.</p>

<p>Does the situation satisfy the general legal understandings of "extortion"? I see that <a href="https://codes.findlaw.com/ny/penal-law/pen-sect-155-05.html" rel="noreferrer">New York State law</a> and this discussion about extortion in the <a href="https://www.unodc.org/e4j/en/organized-crime/module-4/key-issues/extortion.html" rel="noreferrer">Doha Declaration</a> suggests that it could be, but it might not fit perfectly.</p>

<p>There is an implied threat of future harm to the site or business, not by the actor themselves necessarily, that a specific, potentially existential problem exists that anyone could take advantage of. And because all security vulnerabilities are exploited by people, whether by malicious intent, accident, or mistake, then extortion laws that say that the loss/damage could be caused by another, appear to be relevant here. Protection racket discussions seem to also be relevant. </p>

<p>We could reframe the situation to something non-technical:</p>

<p>PersonA calls PersonB, who is on vacation, and says, "I know you are away from home. There is something wrong with your house. Pay me money and I will tell you what is wrong."</p>

<p>Ethics and morality aside, does the situation cross over into a general legal understanding of extortion? </p>

<p>This has an impact on how security professionals contact people with whom they have no pre-existing relationship with, to discuss the vulnerabilities they find, while hoping to offer commercial services. </p>

<blockquote>
  <p>Ethics and morality aside, does the situation cross over into a general legal understanding of extortion?</p>
</blockquote>

<p>No.</p>

<p><a href="https://en.wikipedia.org/wiki/Extortion" rel="noreferrer">Extortion</a> necessarily includes <a href="https://en.wikipedia.org/wiki/Coercion" rel="noreferrer">coercion</a>.</p>

<p>An offer to tell what is wrong (and from the point of view of the target — only <em>allegedly</em> wrong) is neither threat nor force, therefore no coercion.</p>

<p>It would have been coercion (and therefore extortion) if the guy said along the lines "<em>If you don't pay I will exploit the vulnerability, and/or tell a bunch of bad guys about it — they will be sooo thankful to me</em>".</p>

<p>Provided that the guy does not say/imply he will do something if not paid, there are no legal issues here.</p>

<p>In my opinion the specific case we are discussing is a borderline one. The other answers might be right in general, but they aren't considering the real "threatening" email that we have seen in the security community here on Stack Exchange. The OP didn't include the original email in his question, but I already knew what he was talking about because I had seen the original thread.</p>

<p>The context is necessary if we want to understand the potential threats. Whether something is extortion or not depends on how the threat is perceived by a potential victim (not really a specific victim, but on average, a reasonable person). Every tiny detail of the context might play an important role. If I told you "Buy these shoes or you will look like an idiot", that sentence will not be perceived as a threat by most people, because of several factors: context, culture, virtually nonexistent gain or loss, etc. Even if you read an advertisement saying "Buy these shoes or I'll kill you", that won't be perceived as a threat (after all, it's just an advertisement, it'd be perceived as a joke). But if you were walking alone in the dark and a masked stranger approached you saying "Buy these shoes or I'll kill you", that would feel much different. On the other hand, if a doctor says "I need more ventilators or lots of people will die from Covid-19", it's not extortion, because the threat is real and they aren't asking for a personal gain.</p>

<p>That said, here are the points I think we need to consider, to analyze the whole context:</p>

<ul>
<li><strong>Is the threat justified?</strong> Is the threat real or not? Has it been exaggerated to make it sound worse? Etc.</li>
<li><strong>Freedom or coercion?</strong> Does the potential victim feel free to make any decisions? Is the potential victim free to chose between several options, or get the service from another competitor? Etc.</li>
<li><strong>Is any personal gain justifiable?</strong> For example, if someone provides a professional service, it makes sense to pay for it. If someone wants money to give you back your data after they have stolen it, that's not a professional service.</li>
</ul>

<p>You didn't post the original email with the potential extortion, so I'll quote it here:</p>

<blockquote>
  <p>I'm a Security Researcher running a vulnerability identification service for a small group of private clients, and I accidentally found some vulnerabilities in your infrastructure.</p>
  
  <p>For a small fee, I will share the vulnerability details with you (includes POC, screenshots, and suggested solutions).</p>
  
  <p>Paypal instructions:</p>
  
  <p>Recipient: REDACTED GMAIL ADDRESS<br>
  Paying for an item or service (covered under PayPal Purchase Protection for Buyers)<br>
  Amount: $100<br>
  Add a note: [redacted, my domain name]  </p>
  
  <p>After I receive your payment, within 48 hours, I will send you an email with all the vulnerability information.</p>
</blockquote>

<p>It is borderline because on one hand there are no direct threats, but on the other hand the email lacks important information that would have helped a lot in reassuring the client and sounding more professional. For example, the introduction is fine, except the researcher's name (or his company's name) is missing. Also, the last sentence is ambiguous because "within 48 hours" might mean you have to pay within 48 hours or it might mean that they will provide the service within 48 hours after the payment. Maybe they even phrased it like that on purpose, to make it sound ambiguous.</p>

<p>Here's why it is borderline, considering the points I listed above:</p>

<ul>
<li><strong>Is the threat justified?</strong> It's hard to identify the threat. If you only consider the words in the email, there is no direct or indirect threat. They don't tell you "you will be hacked", or "you might be risking something", they don't even give any advice, whether you should or shouldn't do something about it. They only state some facts. But when you consider the context, the word "vulnerability" in itself implies there is a potential danger in the information security field. However no information is provided even on the type or severity of the vulnerability. In the INFOSEC field, a vulnerability might destroy your business within hours, or might never have any effects whatsoever, depending on its severity and who/what is affected.</li>
<li><strong>Freedom or coercion?</strong> Hard to say. The lack of details in the email won't make the recipient feel completely free of contacting the researcher, asking for more information, negotiate the price, seeking advice from a competitor, etc. They immediately talk about money, that they want upfront. Even that ambiguous "within 48 hours" might be misinterpreted and put unnecessary pressure on the recipient. However nothing stops the recipient from actually trying to contact the researcher in some way (either via the address they received it from, or via the address used for PayPal), and ask for more information.</li>
<li><strong>Is any professional gain justifiable?</strong> They are asking for a small fee and in exchange you will get a service (a report). It's ok to be paid if you provide a service. However nobody knows how professional that report will be, since we have no information about the researcher. Plus the initial approach is very unprofessional and non-standard anyway.</li>
</ul>

<p>So I wouldn't be able to decide whether this specific case is extortion or not. I would say it depends on whether it is actually possible to contact the researcher by answering to the email they sent, and then how they go on interacting with the client. If they don't answer in a reasonable time, it might well be extortion because the client might feel in danger and might not be able to decide what to do. If they do answer though (and collaborate without threatening anybody), I'd say the original email in itself should not be considered a form of extortion.</p>

<h2>Yes, it's extortion - specifically <a href="http://www5.austlii.edu.au/au/legis/nsw/consol_act/ca190082/s249k.html" rel="nofollow noreferrer">blackmail</a>.</h2>

<p>From the New South Wales Crimes Act 1900 s249K:</p>

<blockquote>
  <p>(1) A person who makes any <a href="http://www5.austlii.edu.au/au/legis/nsw/consol_act/ca190082/s249l.html#unwarranted" rel="nofollow noreferrer">unwarranted</a> demand with <a href="http://www5.austlii.edu.au/au/legis/nsw/consol_act/ca190082/s249m.html#menaces" rel="nofollow noreferrer">menaces</a>--</p>
  
  <p>(a) with the intention of obtaining a <a href="http://www5.austlii.edu.au/au/legis/nsw/consol_act/ca190082/s249n.html#obtaining" rel="nofollow noreferrer">gain</a> or of causing a <a href="http://www5.austlii.edu.au/au/legis/nsw/consol_act/ca190082/s249n.html#obtaining" rel="nofollow noreferrer">loss</a>, or</p>
  
  <p>(b) with the intention of influencing the exercise of a public duty,
  is guilty of an offence.</p>
  
  <p>: Maximum penalty--Imprisonment for 10 years.</p>
</blockquote>

<p>Relevantly, s249M(4) states:</p>

<blockquote>
  <p>(4) It is immaterial whether the menaces relate to action to be taken by the person making the demand.</p>
</blockquote>
