ethical-hacking
Legal status of responsible disclosure
<p>In the current security landscape it is common to offer responsible disclosure to (ethical) hackers to report vulnerabilities in such a way that the company does not pursue legal action against this person if the report was filed according to the rules set by responsible disclosure.</p>

<p>However, hacking is illegal is most countries (for reference, I'm from the Netherlands), it certainly is here. Can responsible disclosure be seen as an open invitation to try and penetrate a website or service legally? Or what is the legal status of responsible disclosure in relation to illegal hacking?</p>

<blockquote>
  <p>Can responsible disclosure be seen as an open invitation to try and
  penetrate a website or service</p>
</blockquote>

<p>Yes. Hacking is lawful if the person who gains access to the system(s) is authorized by its owner to do so (by <em>owner</em> I mean the proprietor or the systems/network administrator in charge of the system). The lack of authorization would trigger Section 138ab of the <a href="https://www.unodc.org/res/cld/document/nld/1881/penal-code-of-the-netherlands_html/Netherlands_Penal_Code_1881_as_amd_2014.pdf" rel="nofollow noreferrer">Dutch penal code</a>. An open invitation certainly amounts to authorizing anyone to try to hack the system.</p>

<p>Beware that <a href="https://www.legislationline.org/download/action/download/id/6415/file/Netherlands_CC_am2012_en.pdf" rel="nofollow noreferrer">this English translation</a> of the Dutch penal code is flawed and misleading. It portrays Section 138ab as defining the concept of "<em>unlawful entry</em>" purely in terms of the <em>method</em> of gaining access, irrespective of the existence or absence of owner's authorization. The translation inaccuracy lies in automatically attaching to "the act of penetrating" (that is, <em>binnendringen</em>) a connotation of "unlawful".</p>

<p>The key word in the legislative language of Section 138ab is <em>wederrechtelijk</em>, which means "<em>without agreement by the right/title holder</em>" (<em>zonder toestemming van de rechthebbende</em>, see <a href="https://01-strafrecht-advocaat.nl/rechtvaardigingsgrond/" rel="nofollow noreferrer">here</a> or <a href="https://www.jonkersvangemert.nl/over-cybercrime/hacken/" rel="nofollow noreferrer">here</a>).</p>

<p>As for your follow-up <a href="https://law.stackexchange.com/questions/35962/legal-status-of-responsible-disclosure?noredirect=1#comment64788_35962">question</a>:</p>

<blockquote>
  <p>If I start to try and hack a website, but I do not find a
  vulnerability to report, I did something illegal. does responsible
  disclosure still apply?</p>
</blockquote>

<p>An open invitation or individualized authorization is crucial for immunizing yourself against prosecution or liabilities.</p>

<p>Although the language of Section 138ab is strictly in terms of <em>actually</em> gaining access to the system, the mere attempt to hack a system might trigger other sections of the penal code. For instance, a failed attempt that has the effects of a DOS attack could "<em>hinder the access to or use of a computerised device or system by [...] sending data</em>", Section 138b. Similarly with the first item of Section 139c, or item 1 of Section 139d. Hence the importance that the attempt to penetrate a system be <a href="https://www.iusmentis.com/beveiliging/hacken/computercriminaliteit/computervredebreuk/#goedebedoelingen" rel="nofollow noreferrer">authorized beforehand</a>: <em>Wie dus andermans beveiliging wil testen, kan dat maar beter vooraf vragen</em>.</p>
