united-states internet software hacking
Is it legal to disclose a technical vulnerability publicly that might cause a monetary loss to millions of people?
<p>I'll cite an example that came to my mind to crisply explain the essence of my question. It might contain some extreme assumptions not rooted in real world examples.</p>

<p>Computer scientist John Doe who is working on his own pet project detects a vulnerability in a mobile hardware related to fingerprint storage while analyzing bunch of social media posts. He found that whenever a user posts something from their popular social media application, the device adds some data to that post that leaks the information related to their fingerprint. Anyone with fair technical understanding can then reproduce the fingerprint from such posts. These fingerprints are the gatekeepers to all the funds that are stored by the users on their devices.</p>

<p>John Doe is now in a dilemma (legal not ethical). He is uncertain whether revealing this vulnerability publicly is legal or he should do it discreetly to the manufacturer. This smartphone manufacturer has 40% of the market share and this public revealing might lead to loss of funds for all the users who have used this fingerprint storage option. </p>

<p>The legality and generally accepted ethics for security professionals differ on this point.</p>

<p>From a legal perspective, unless John Doe has signed a legal agreement to not reveal the information (most commonly a Non-Disclosure Agreement, or NDA) or has a responsibility to keep the information private, there is no legal penalty for revealing <strong>truthful</strong> information*. Generally, one is safe revealing truthful information unless one has agreed to not do so, or one is doing so specifically to harm someone else.</p>

<p>Generally, security professionals will alert software manufacturers first and give them a reasonable amount of time to work on a solution before announcing the vulnerability publicly. This is generally seen as a way to give manufacturers a "head start" in crafting a solution to the problem before the increased knowledge of the flaw can lead to increased exploitation.</p>

<p>*If John Doe asks for money to delay or stop the announcement that may constitute extortion, but that is outside of the scope of this question.</p>
