KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#developer-tools #typescript #dsh #dsh-plugin #ai-agent #codex #ai-agents #deepseek-harness #claude-code #cli #react #mcp

research-threats

★ 328 Open GitHub ↗

Collection of legal threats against good faith Security Researchers; vulnerability disclosure gone wrong. A continuation of work started by @attritionorg

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Research Threats

### Legal threats against good-faith security researchers — an open-source archive of vulnerability disclosure gone wrong.

*Part of **[the disclose.io Project](https://disclose.io)** — the open, vendor-neutral infrastructure for vulnerability disclosure. [Browse the ecosystem →](https://github.com/disclose)*

</div>

---

**An ongoing, open-source collection of legal threats made against security researchers** — over-reactions, demands, and cease-&-desist letters against good-faith research. In homage to, and continuing, [@attritionorg](https://github.com/attritionorg)'s work documenting historical researcher threats.

📖 **Read it on the web:** [threats.disclose.io](https://threats.disclose.io)  ·  🐙 **On GitHub:** [disclose/research-threats](https://github.com/disclose/research-threats)

Includes many historical legal events copied with permission from [@attritionorg](https://github.com/attritionorg), originally at [https://attrition.org/errata/legal_threats/](https://attrition.org/errata/legal_threats/), which is still maintained. Crowd-sourcing this data through this repository is strongly recommended by all parties.

It doesn't matter that just about every company and product ships with vulnerabilities; security should be built into a product, rather than applied as a band-aid solution. Secure products are better, and a responsive security team should be an integral part of the development life cycle of that product. Vulnerabilities will happen; the response to those reports are what is important. Burning bridges and dismissing the good will of researchers offering to help secure your products does not benefit anyone.

## Is an incident missing from this list or want us to investigate?

Create an issue :)

If you want to submit something more privately, you can email any of hello [at] disclose.io, jericho [at] attrition.org threats [at] sick.codes using the following key: [https://raw.githubusercontent.com/disclose/research-threats/master/researchthreats.asc](https://raw.githubusercontent.com/disclose/research-threats/master/researchthreats.asc). This is a shared key between the three people mentioned above.

Issues with links and information are welcome, [pull requests are even better](https://github.com/disclose/research-threats/edit/master/README.md)!

### Please sanitize Personally Identifiable Information (PII) from PDF, PNG, JPG files before uploading to the [goodies folder](goodies)!

In the interest of Security Researcher safety, and prevent you from doxxing yourself, you may want to remove all EXIF data from uploads.

From time to time, you may wish to upload documents, screenshots, or even photographs to the [goodies folder](goodies).

See [ExifTool installation instructions here in the goodies folder](goodies).

```bash
exiftool -all='' document.pdf
exiftool -all= image.png
exiftool -all= image.jpg
exiftool -all= *.png
```

## For Companies

Find examples below of **what *not* to do**.

Embrace security researchers. Learn from the documented examples in this archive. Researcher's who have been threatened by naive entities while legitimately working to improve the security of a product should be a source of collaboration; they may know more about your systems than you do. Put researchers who voluntarily submit bugs & vulnerabilities in touch with your internal security teams, work together to fix vulnerabilities, and coordinate the disclosure to your customers and the public.

- An **excellent coordinated disclosure** generally **boosts a company's public image** & customer confidence. It encourages researchers to work with you, not against you.

- A **negative experience** can exponentially generate **negative publicity, [sometimes even viral](https://en.wikipedia.org/wiki/Streisand_effect)**.

- Providing researchers **safe harbor for reporting a vulnerability** to you is critical to working towards a **more secure product and ecosystem**.

Entities that engage researchers and respond quickly to security events are more likely to generate a positive experience.

Entities with no security response team, may be more likely to experience a negative disclosure event.

## For Researchers

Find examples below of **what *can* happen when things go wrong**.

Shield yourself from threats by always acting in good faith, following a company's vulnerability disclosure terms and visit the [EFF's Coders' Rights Project](https://www.eff.org/issues/coders). Work with companies and respect their timelines for implementing fixes. What may seem like an "easy fix" to you may be more complicated for a vendor maintaining multiple code trees across hundreds of platforms supporting thousands of customers.

Companies fear negative publicity; but companies also ship bugs & vulnerabilities out into the wild. Any publicity that may challenge the security aspect of a product may lead to legal threats or calls to law enforcement.

Engaging a company with an extensive, well managed security vulnerability program, will almost never lead to legal action. In fact, you may even be protected from violating a license agreement, while conducting good faith research, under safe habor.

Engaging a company that favors profit over ethics, or considers protecting the bottom line as more important than doing the right thing, may lead to challenges. Some companies welcome vulnerability reports. Some companies don't, but that does not make them immune from exploitation.

---------

# Researcher's Rights: Threatened Security Researchers Walk of Fame & Hall of Shame

Below, you will find an ongoing & maintained collaborative effort to document some of the most *bizarre* reactions to otherwise trivial security events.

Historical archives were taken with explicit permission to continue wonderful work started by the folks at [@attritionorg](https://github.com/attritionorg), and are hosted in their originality at [https://attrition.org/errata/legal_threats/](https://attrition.org/errata/legal_threats/).

### Researcher Threat Template Row:

---------

### Confirmed Threats Made Against Researchers

| **When** | **Entity** | **Researcher(s)** | **Topic** | **Status** |
|---|---|---|---|---|
| 2026-05-29 | [Microsoft](https://www.microsoft.com/) | Nightmare Eclipse | Microsoft criticized for threatening a security researcher with a potential criminal investigation after public disclosure of Windows vulnerabilities. | Nightmare Eclipse publicly disclosed multiple unpatched Windows vulnerabilities and proof-of-concept exploit code. Microsoft argued the researcher had not followed its Coordinated Vulnerability Disclosure process and issued a public statement referencing its Digital Crimes Unit and potential law-enforcement cooperation against actors who facilitate cybercrime. Members of the security community interpreted the statement as a threat directed at the researcher; Microsoft later clarified it did not intend to pursue legal action solely for legitimate security research. [View Story](https://techcrunch.com/2026/05/29/microsoft-under-fire-for-threatening-security-researcher-with-criminal-investigation/). |
| 2024-07-29 | [City of Columbus, Ohio](https://www.columbus.gov/) | [Connor Goodwolf](https://linktr.ee/connorgoodwolf) | City gets hacked and sues researcher for investigating the Dark Web data. | On July 18 2024, Columbus Mayor Andrew Ginther's office released a statement saying the city's department of technology "found evidence of an abnormality in its system on July 18." Various city services were taken offline. Rhysida ransomware group demanded nearly $2M ransom for 6.5TB of stolen city data. Two class-action lawsuits were launched against the city for failing to adopt sufficient security practices. As usual, the city responded by telling its residents to enroll in Experian, which involves entering additional personal information online. An innocent security researcher, Connor Goodwolf, a resident of the city at the time, informed local news station 10tv the extent of the breach and what information was available in the hacked data. The data allegedly contained driver license information from City Hall, prosecution data including victims, suspects or recipients of subpoenas. Connor, who was helpful in informing people if they were be affected by the city-wide breach, received a restraining order, preventing Connor from discussing further what Rhysida ransomware group had stolen. [View Story](https://www.10tv.com/article/news/local/city-columbus-sues-cybersecurity-expert/530-fc59233d-39cb-463f-9454-0234f1c8cced). In the judge's restraining order against the security researcher, who was merely reporting on the stolen data, the city was seeking $25,000 in damages, with the total amount determined at trial. Instead of taking the Rhysida ransomware group (the bad guys), the city responded by requesting a restraining order and court proceedings against the security researcher (the good guy). The city filed four claims of relief against the security researcher: Damages for criminal acts, Invasion of privacy, Negligence, Civil conversion. On September 11, 2024, Goodwolf agreed to a preliminary injunction barring him from sharing sensitive findings from the leak ([NBC4, September 11, 2024](https://www.nbc4i.com/news/local-news/columbus/city-hack/columbus-handling-of-ransomware-attack-draws-global-attention/)). **Resolved:** On October 25, 2024, the city filed a motion to dismiss its own lawsuit, and Goodwolf received a dismissal with prejudice — the city cannot sue him again over the same conduct. The dismissal came with a caveat: a permanent injunction upholding the preliminary terms, under which Goodwolf may only share data considered public records with written approval from the city ([NBC4, October 25, 2024](https://www.nbc4i.com/news/local-news/columbus/city-hack/columbus-drops-lawsuit-against-data-leak-whistleblower-connor-goodwolf-but-with-a-catch/) ([archive](https://web.archive.org/web/20250512044750/https://www.nbc4i.com/news/local-news/columbus/city-hack/columbus-drops-lawsuit-against-data-leak-whistleblower-connor-goodwolf-but-with-a-catch/)); [Dark Reading, November 4, 2024](https://www.darkreading.com/cloud-security/city-of-columbus-drops-case-on-cyberattack-whistleblower) ([archive](https://web.archive.org/web/20250209211037/https://www.darkreading.com/cloud-security/city-of-columbus-drops-case-on-cyberattack-whistleblower))). The chilling effect stands: the researcher who corrected the mayor's public claims ended the case permanently enjoined from discussing the stolen data without the city's written approval. |
| 2024-01-18 | [Modern Solution GmbH & Co. KG](https://www.modernsolution.net/) | Unnamed security researcher | Researcher reports vulnerability, vendor denies it, researcher ends up being sentenced by a court. | A programmer who analyzed software for a customer and discovered a security vulnerability was later sentenced to a fine of 3,000 euros for unauthorized access to third-party computer systems and spying on data. Modern Solution GmbH & Co. KG connected stock management with online marketplaces in Germany, and the software involved inventory, product and customer tracking data. The identity of the researcher is not available, but heise.de claims they [know the identity of the researcher](https://www.heise.de/news/Datenleck-bei-Modern-Solution-Hausdurchsuchung-statt-Bug-Bounty-6222165.html). With the assistance of an e-commerce blogger, Mark Steier, the researcher reported the vulnerability to the company (Modern Solution). According to Heise.de, "Modern Solution denied that there was a vulnerability." Subsequently, Modern Solution took the vulnerable service offline and the [researcher made their report public](https://wortfilter.de/warnung-datenleck-beim-jtl-partner-modern-solution-gmbh-co-kg/). In the post released June 23, 2021, it shows a connection being made to a database, on the domain ModernSolution.net, and customer data was accessible with screenshot proofs provided in the post. Given the complex GDPR environment in the European Union and threat of massive crippling fines for accidental data breaches, it is now seemingly more common to see researchers in the crosshairs of companies trying to blame their breaches on the good guy. On September 15, 2021, [a search squad from Criminal Investigation Department 22](https://www.heise.de/news/Datenleck-bei-Modern-Solution-Hausdurchsuchung-statt-Bug-Bounty-6222165.html) of the Aachen police showed up at the researcher's door. According to the researcher's account, the officers posed as parcel carriers, gained access to the apartment and pushed him against the wall. The police confiscated a PC, five laptops, a mobile phone and five external storage media - all of the programmer's work equipment. Modern Solution even published a data breach notification, [as seen in this PDF](https://wortfilter.de/wp-content/uploads/2021/06/moso-1.pdf). In June 9 2023, the [case was actually rejected](https://www.heise.de/news/Modern-Solution-Anklage-gegen-Aufdecker-von-Sicherheitsluecke-gescheitert-9182813.html) because Modern Solution had failed to protect the password. It took nearly one and a half years for the researcher to get their computer and hard drives back. This is a perfect example of how a good faith researcher attempted to do the right thing, and was later brought before a judge and fined 3,000 euros. In the breach notice itself, Modern Solution calls the researcher an 'ethical hacker'. In court, however, the public prosecutor spent a significant portion of time alleging that the defendant had decompiled the program code of Modern Solution's software in order to obtain the password for the database connection. The defendant stated that he had simply looked at the file in question (MSConnect.exe) with a text editor and had thus read out the database password in plain text. |
| 2023-12-27 | [NEWAG](https://www.newag.pl/en/) | [Serwis Pojazdów Szynowych (SPS)](https://serwispojazdowszynowych.pl/), [Dragon Sector](https://dragonsector.pl/) | Security researchers find disturbing DRM on trains, get sued. | A country-wide scandal erupted in Poland between 2023 and 2025, as train manufacturer Newag was found to have added bizarre DRM-style features to prevent its vehicles from being repaired at competitors' workshops. The DRM triggers included geolocking, parts pairing, long inactivity detection, and even a timebomb triggered on November 21, 2021 in one case. SPS Mieczkowski (a train servicing company) failed to start Newag trains after maintenance work, and took matters into their own hands hiring security researchers from Dragon Sector to get more information. One of the researchers, Michał Kowalczyk, "discovered the manufacturer’s interference in the software, which led to forced failures." On 27th December, 2023, the researchers [published some of their findings during a talk](https://media.ccc.de/v/37c3-12142-breaking_drm_in_polish_trains) at CCC. The software locks described by the researchers were designed to deter competitors from working on the trains. In a statement from Newag, "We have not, do not, and will not introduce into the software of our trains any solutions that lead to intentional failures. This is slander from our competition, which is conducting an illegal campaign of black PR against us," the [statement read](https://www.railway-technology.com/news/the-story-of-the-great-polish-train-hack/?cf-view). Newag alleged that Poland’s SPS Mieczkowski was "attempting to avoid having to pay contractual penalties of as much as $500,000 for not completing the servicing". A whirlwind of accusations and deflections continued over 2024, including Newag claiming that the software locks aren't real, and is driven by a PR campaign to avoid paying, tank their stock price, and other political reasons. Dragon Sector [was threatened by Newag](https://www.404media.co/polish-hackers-repaired-trains-the-manufacturer-artificially-bricked-now-the-train-company-is-threatening-them/), and finally [sued in June 2024 for copyright infringement and unfair competition](https://social.hackerspace.pl/@q3k/112693911864133850) and then [again in September 2024 for defamation and unfair competition](https://social.hackerspace.pl/@q3k/113787197240610657). Both court cases continue as of May 2025. Sieć obywatelska Watchdog [classified both lawsuits as SLAPPs](https://siecobywatelska.pl/od-niedzialajacych-pociagow-do-slapp-u/) (Strategic Lawsuits Against Public Participation). |
| 2023-07-23 | [Ford](https://www.ford.com/) @ford, [Rapid7](https://www.rapid7.com/) @rapid7 | [Ben Sadeghipour](https://x.com/nahamsec/) | Rapid7 asks NahamSec to take down a video about Ford. | On August 23, 2023, Ben Sadeghipour (nahamsec) [tweeted](https://x.com/nahamsec/status/1694388639994675568) that he had received an email from Rapid7 about one of his YouTube videos. Rapid7 claimed that nahamsec was "operating illegally" and is "active in aiding criminals in their fradulent activities". @Rapid7 was acting on behalf of @Ford, as part of Rapid7's effort to allegedly, "neutralize active cyber threats that endanger their brand, customers and employees." In a twitter reply, nahamsec stated that he replied to the email, "I told them I have done nothing wrong and that if they want it gone they'll have to wait a bit." |
| 2023-07-16 | [Arm Ltd](https://www.arm.com/) | [Maria Markstedter "Azeria"](https://x.com/Fox0x01) | Arm submits abuse report to researcher's domains about IP. | On August 16, 2023, Maria Markstedter [received an abuse report](https://x.com/Fox0x01/status/1691774253014618222/) about one of her domains, arm-assembly.com related to copyright infringement. Arm, a computer architecture, and Arm Ltd., a company about to go public at the time, through the abuse report states that Maria was unauthorized in using the domain name arm-assembly.com.  Arm had known about Maria's domains for years, and suddenly decided to take her domains by IP force. In an [interview with The Register](https://www.theregister.com/2023/08/31/a_star_star_domains/), Maria stated that she wrote her thesis about Arm security and exploit mitigations for Arm and that she had previously given internal talks at the company. Another Cease & Desist came which included all of Maria's other related domains  arm-reversing.com, arm-exploitation.com, arm-basics.de, and azeria-labs.com and all were taken down by the registrar. She eventually transferred the domains with the word "arm" to Arm, and Maria changed her domain to leg-assembly.com. This incident is another example of great research being shut down by an IP holder, with which the researcher had an ongoing legacy relationship with. The chilling effect of this is that Azeria, who is a leading Arm researcher, was punished by the brand, and it deters other researchers from researching and sharing knowledge of brands, like Arm. |
| 2023-04-12 | [FreeHour](https://www.freehour.eu/) | Giorgio Grigolo, Michael Debono, Luke Bjorn Scerri and Luke Collins | Students arrested, stripped naked, violated by Police. | On October 18, four computer-science students emailed [FreeHour](https://www.freehour.eu/) about software vulnerabilities in their student timetabling app, with a hefty 90 day disclosure window. Alongside their responsible disclosure to [FreeHour](https://www.freehour.eu/), the students asked if their good-faith advisory would be eligible for a possible bounty, once the bug had been patched. One or more imbeciles at [FreeHour](https://www.freehour.eu/) lied to the Police about the nature of the student activity. [Scerri, Grigolo and Debono received serach warrants, all their homes were raided by the Police](https://timesofmalta.com/articles/view/we-wanted-help-students-arrested-exposing-freehour-security-flaw.1024757), and instead of receiving a bug bounty reward, they were heinously strip searched, had their computers violated as a result of the inadequeate response by FreeHour. Originally, the authorities told them that their items would be returned within several weeks but they are currently still having their right violated. Collins was in England studying for his PhD, yet was questioned when he returned to the country for Christmas. [FreeHour](https://www.freehour.eu/) founder and CEO [Zach Ciappara](https://www.linkedin.com/in/zach-ciappara/) said that, once he received the e-mail from the four students in October, he contacted the office of the Information and Data Protection Commissioner (IDPC) and the Cyber Crime Unit for advice. After the situation began to escalate for FreeHour, the CEO subsequently [published a statement on Instagram](https://www.instagram.com/p/Cq712wtITdm/). According to another statement, "Due to the mention of payment, changes to the app’s front end & a 90 day ultimatum, FreeHour was legally advised to report this to the Police as a potential threat. [The company is starting to do cyber now](https://www.freehour.eu/post/what-freehour-is-doing-after-learning-what-happened-to-the-4-students), and is apparently committed to doing so on an ongoing basis. "We are also willing to work with the four students to assist in improved security, and to implement new measures. Moreover, we are undergoing internal training in INFOSEC, GDPR and data integrity," CEO Zach Ciappara added. It is unclear whether the students would be willing to work with the company again, given they were stip searched, raided, violated, and arrested. |
| 2022-02-12 | [Cole County Prosecuting Attorney @ The State of Missouri](https://colecounty.org/430/Attorneys) | [Josh Renaud](https://twitter.com/Kirkman) - [View Statement](https://joshrenaud.com/pd/josh-renaud-personal-statement.pdf) | Prosecutor Drops Charges After Four "Anxious" Months | On February 11th, the public received a statement from [Josh Renaud](https://twitter.com/Kirkman), who was previously unnamed in the incident below, dated 2021-10-15 involving [The State of Missouri](https://www.mo.gov/) & [St. Louis Post-Dispatch](https://www.stltoday.com/). In [Renaud's statement](goodies/josh-renaud-personal-statement.pdf), Renaud was accused on television as a malicious "hacker". [In his statement](goodies/josh-renaud-personal-statement.pdf), Renaud details the significant harm caused by this investigation, which is, "entirely legal and consistent with established journalistic principles." It is also the only way to report bugs: to the vendor, of course. Renaud's statement details that this, "has been one of the most difficult seasons of [his] nearly 20-year career in journalism. But [he had] found strength in the prayers and support of my family and friends and so many others across the country." This entry has been entered as a separate update as Renaud was previously unnamed. The statement speaks for itself and should be a wake up call to those who persecute others for political gain, as stated by the state Senate, "more care was given to political gain than the harm caused to a man and his family.” Renaud's experience, "hasn’t been easy." Renaud was, "politically persecuted," and was even used & abused in "attack ads" aired by his political action committee. [The full statement is well & truly worth reading. Possibly one of the most important statements a researcher has made in recent times.](goodies/josh-renaud-personal-statement.pdf) |
| 2021-10-21 | [Apple](https://apple.com/), [@apple](https://github.com/apple) | [Denis Tokarev](https://twitter.com/illusionofcha0s), [@illusionofchaos](https://github.com/illusionofchaos) | DMCA Takedowns of Mirror | iOS App Developer & Security Researcher [Denis Tokarev (illusionofchaos)](https://github.com/illusionofchaos) has developed an interesting relationship with Apple since early 2021. The researcher participated in Apple's Bug Bounty program in hope's of receiving a payout for his research having submitted the details between March 10 and May 4 of 2021. Four months later, Tokarev published his (Disclosure of four 0-day iOS vulnerabilities and his opinion of the [Apple Security Bounty Program](https://habr.com/en/post/579714/). To this day, Tokarev is still not listed on the [Apple Security Advisory for iOS 14.7 and iPadOS 14.7 security advisory.](https://support.apple.com/en-us/HT212601). In his words, "_When I confronted them, they apologized, assured me it happened due to a processing issue and promised to list it on the security content page of the next update. There were three releases since then and they broke their promise each time._" Frustrated with the lackluster **communication** between Apple's illusive security team, Tokarev eventually published his Proofs of Concept on GitHub: ["iOS gamed exploit (fixed in 15.0.2)"](https://github.com/illusionofchaos/ios-gamed-0day), a redacted ["Analyticsd pre-14.7 exploit"](https://github.com/illusionofchaos/ios-analyticsd-pre14.7-exploit), ["nehelper enumerate installed apps 0-day (iOS 15.0)"](https://github.com/illusionofchaos/ios-nehelper-enum-apps-0day), and ["Nehelper Wifi Info 0-day (iOS 15.0)"](https://github.com/illusionofchaos/ios-nehelper-wifi-info-0day). A Jailbreak community member, [@rllbe](https://github.com/rllbe), released a [patch exclusively for Jailbroken devices named entitlementfix](https://www.reddit.com/r/jailbreak/comments/pvaztb/free_release_entitlementfix_workaround_for_the_3/). This is great for Jailbroken phones but does not help the millions of regular iPhones which are still vulnerable to attacks, namely information disclosure. Valued at $100,000 or more on the Example/Dummy Bounty payout page, or perhaps an exponentially higher value on the grey market, Tokarev has yet to receive a bounty, nor recognition, other than an email from Apple stating that they made an error in crediting his research. Apple silently patched one of the exploits in July with the release of iOS 14.7. To add to the already difficult relationship, Tokarev discovered and mirrored a helpful website with API documentation named "Atlas" for research purposes. ["Atlas is developed and maintained by the Hardware Test Engineering (HWTE) Software Platform group."](https://web.archive.org/web/20211019101209/http://101.132.96.154/) The repository [is currently serving the DMCA takedown notice Apple sent him](https://github.com/illusionofchaos/apple-atlas-docs). What makes this takedown unique is that the fact that the original server is still live; Tokarev mirrored a documentation resource, which is very common procedure on GitHub. Along with the GitHub DMCA notice, Tokarev [had multiple tweets also taken down](https://twitter.com/illusionofcha0s/status/1450588596407259139). The DMCA content removal [takedown notices on GitHub are publicly etched into GitHub's DMCA repository](https://github.com/github/dmca/blob/master/2021/10/2021-10-18-apple.md); the [Lumen database copy can be viewed here](https://lumendatabase.org/notices/25498447). The researcher was also [locked out of his Twitter account at one point](https://twitter.com/illusionofcha0s/status/1450902601864732679/photo/1). As per DMCA submission rules on Twitter, the firm representing Apple, swears, "_under penalty of perjury,_" that the the documentation is Apple's copyright. What makes this case seem targeted is that **only** Tokarev's content has been DMCA'ed by Apple- absolutely no other reply, public tweet, or image containing the IP address has apparently been removed from Twitter. [An archive of the alleged offending content page, while still live, is archived.](https://web.archive.org/web/20211019101209/http://101.132.96.154/). On October 25, 2021, [@apple](https://github.com/apple) eventually added the contribution, in Analytics affecting iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation). It was issued CVE-2021-30871 and the impact statement was, "A local attacker may be able to access analytics data." NIST analysts scored the bug [5.5 CVSS MEDIUM](https://nvd.nist.gov/vuln/detail/CVE-2021-30871).|
| 2021-10-15 | [The State of Missouri](https://www.mo.gov/) | [St. Louis Post-Dispatch](https://www.stltoday.com/)  | State law vs. Good-faith research, alleged hacktivism. | On October 12th, the Missouri Department of Elementary & Secondary Education was made aware of a vulnerability in a portal that was leaking personal information of Missouri educators. Missouri Gov. Mike Parson, [in a press conference](https://www.youtube.com/watch?v=NxJjLWa9R2g) stated that at least 3 educators' data was specifically accessed. It is not known whether these 3 educators' data were used to validate the vulnerability, or whether they were specifically targeted by the researcher. It was stated that it would not be possible to download all of the personal data at once. Under 2017 Statute 569.095 of Missouri Law: *"A person commits the offense of tampering with computer data if he or she knowingly and without authorization or without reasonable grounds to believe that he has such authorization: Accesses a computer, a computer system, or a computer network, and intentionally examines information about another person; a class A misdemeanor."* The Gov. stated that this may cost at least [$50 million dollars to patch](https://www.npr.org/2021/10/14/1046124278/missouri-newspaper-security-flaws-hacking-investigation-gov-mike-parson), diverting Missouri State resources for Legal costs, the Cole County Prosecutor, and Missouri State Highway Patrol Digital Forensics Unit to investigate the alleged wrongdoing. Therein lies the issue, that had this vulnerability not been reported to the vendor, it would remain to be vulnerable and the state would likely be unaware of it being exploited for malicious purposes. To complicate matters for both the researcher and the vendor (ITSD who programs & maintains the portal), it was alluded to during the press conference that the researcher was going to use the information for political gain, under the guise of research. In Missouri, it is unlawful to access "encoded" data (the passwords were allegedly base64 encoded), which may include viewing HTML source code or to compromise systems to embarrass the state and allegedly, "sell headlines," for their new outlet. Two issues that should be highlighted in this event is that is can be argued that is a Class A misdemeanor in Missouri to essentially push the F12 key while browsing a website, but the researcher has also been alleged to either be employed by or have provided the data to a local news outlet, as a "political vendetta," which could fall under bad-faith research, or hacktivism, if the data was published. Regardless, the embarrassment of a leaky portal lies with the developer of the website, [and the St. Louis Post-Dispath](https://www.stltoday.com/news/local/education/missouri-teachers-social-security-numbers-at-risk-on-state-agency-s-website/article_f3339700-ece0-54a1-9a45-f300321b7c82.html), stated "The newspaper delayed publishing this report to give the department time to take steps to protect teachers’ private information, and to allow the state to ensure no other agencies’ web applications contained similar vulnerabilities." |
| 2021-08-04 | [CDU](https://www.cdu.de/) (German political party) | CERT, Politics, hacktivism, back-tracking | [Lilith Wittmann](https://lilithwittmann.medium.com/) | In 2021, during the election campaign for the German Bundestag, a security researcher named Lilith Wittmann [discovered and published](https://lilithwittmann.medium.com/wenn-die-cdu-ihren-wahlkampf-digitalisiert-a3e9a0398b4d) data security issues in the election campaign app used by the German parties CDU, CSU and Volkspartei. The CDU [pressed charges](https://www.heise.de/news/Sicherheitsluecken-in-CDU-connect-App-Strafverfahren-gegen-Entdeckerin-6154663.html) against Wittmann but [withdrew](https://www.heise.de/news/CDU-zieht-Anzeige-wegen-CDU-connect-App-zurueck-und-bittet-um-Entschuldigung-6155229.html) later after a public outcry and apologized.|
| 2021-07-13 | [Apple](https://apple.com/), [@apple](https://github.com/apple) | [Corellium](https://www.corellium.com/), [@corellium](https://github.com/corellium),  | Relentless dissmissed copyright infringement lawsuits of good faith research platform | [Apple](https://github.com/apple)'s [Bug Bounty rules](https://developer.apple.com/security-bounty/requirements/) permits Security Researchers to, "copy, decompile, reverse engineer, disassemble, attempt to derive the source code of, decrypt, modify, or create derivative works of such [Apple](https://github.com/apple) software," provided they share the results with [Apple](https://github.com/apple). However, in 2019, [Apple](https://github.com/apple) filed a lawsuit against Corellium, stating that it participates, "with no license or permission from [Apple](https://github.com/apple)." Moreover, "[Apple](https://github.com/apple) approved of [Corellium](https://www.corellium.com/) participating in its invitation-only Security Bounty Program (“bug bounty program”) with a promise to [pay for software bugs identified by Corellium](goodies/Corellium_10-28-2019_Case_9:19-cv-81160-RS_Document_41_Entered_on_FLSD_Docket.pdf) in court documents dated 10-28-2019." [Apple](https://github.com/apple) gladly accepted and utilized bugs submitted by Corellium as part of this program [yet] broke its promise to pay for them." Apple's bug bounty began in 2016, but was only opened to the public in 2019. This means anyone can participate. Corellium was a participant of the invitation-only program. Corellium claims it is owed $300,000 in unpaid bounties. Apple is known to change the prices, with Apple originally offering up to [$1,500,000](https://developer.apple.com/news/?id=12192019a) as the maximum payout, but that has since come down to $1,000,000. Moreover, an "iCloud" bounty is listed with a [maximum payout of $100,000](https://developer.apple.com/security-bounty/) on the main page, however, a "limited" iCloud bypass is only a [mere $25,000](https://developer.apple.com/security-bounty/payouts/). Apple has previously, ["made eBay remove a listing that offered a prototype iPhone for sale for $10,000"](https://www.vice.com/en/article/8xw7gx/iphone-emulation-company-sued-by-apple-says-its-making-iphones-safer). Bizarrely, Apple only offers the "Security Research Device" (SRD) for the iPhone, abandoning the iPadOS, macOS, tvOS, and watchOS which do not have Research Devices. The number of vulnerabilities discovered on SRDs is extremely    low, with many vulnerabilities coming from ZDI as well as anonymous researchers. [Apple](https://github.com/apple) sued Corellium in 2019, for copyright infringement. The copyright claim is a disgrace to researchers, far and wide, and even stated 08-15-2019, ["Apple strongly supports good-faith security research on its platforms, and has never pursued legal action against a security researcher,"](goodies/Corellium_08-15-2019_Case_9:19-cv-81160-RS_Document_1_Entered_on_FLSD_Docket.pdf) yet is pursuing the only platform that empowers researchers to participate in [Apple](https://github.com/apple)'s program. [Apple](https://github.com/apple) lost that lawsuit, demonstrating a clear & apparent disconnect between the company and good faith Security Researchers. The UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF FLORIDA dismissed every single one of [Apple](https://github.com/apple)'s claims. The COURT ruled on 05-11-2020 ["Corellium does not infringe any of Apple's copyrights."](goodies/Corellium_05-11-2020_Case_9:19-cv-81160-RS_Document_456_Entered_on_FLSD_Docket.pdf) Apple ignored the ruling, filing another lawsuit, casting a shadow of legal uncertainty over the entire Security Research community. [Apple](https://github.com/apple) admits to trying to buy Corellium, in which Corellium was approached by Federighi, Andrews, & Krstic, who are Apple's Senior Vice President of Software Engineering, the Vice President of OS Software Engineering, and the Head of [Apple](https://github.com/apple)'s Security Engineering and Architecture, respectively. The case was "DONE AND ORDERED in Fort Lauderdale, Florida, [on] 29th day of December 2020, noting [Corellium may make fair use of iOS](goodies/Corellium_12-29-2020_Case_9:19-cv-81160-RS_Document_784_Entered_on_FLSD_Docket.pdf), but it is not absolved of potential liability for allegedly employing circumvention tools to unlawfully access iOS or elements of iOS." However, Apple's Bug Bounty program specifically permits the above, if you report the bugs to [Apple](https://github.com/apple). This series of lawsuits destroys credibility in the Security Research community, and Apple's lower-than-expected payouts deters researchers from reporting the bugs to Apple, with many researchers opting to sell their exploits elsewhere. One such example, is the clear fact is the sheer volume of submissions that come through the Zero Day Institute. [More court documents](goodies/Corellium_07-13-2021_Civil_No._19-81160-cv-Smith-Matthewman.pdf) relating to Apple attempting to reintroduce new witnesses, in a case that should already be over. On May 10, 2023, EFF [released their own statement](https://www.eff.org/deeplinks/2023/05/federal-appeals-court-gets-it-fair-use-protects-security-research-tools) on the case.|
| 2021-04-29 | [what3words](https://what3words.com/), [@What3Words](https://github.com/what3words) | [Aaron Toponce](https://twitter.com/aarontoponce) | "Proprietary" Worldlists | [@What3Words](https://github.com/what3words), a company that sells its wordlist permutations to emergency services, threatened Toponce for exposing their method of generating permutations. In September 2019 IP lawyer [JaKemp.com](www.jakemp.com), acting on bahalf of [@What3Words](https://github.com/what3words), issued [whatfreewords.com with a direct threat of legal action](goodies/whatthreewords_SCIP_-_Ecommerce_Takedown_Notice_-_W3W_19_Sept_2019.pdf). Later, the actual wordlist permutation formula was posted online by [@cybergibbons](https://twitter.com/cybergibbons/status/1387164574294712321). On April 29 2021, Toponce [received a letter](goodies/what-three-words-legal-threat.jpg) demanding that he stop using the What Free Words software, an Open Source derivative of what3words. What3Words chief executive Chris Sheldrick referred to his own software as, "a set of non-trivial, proprietary binary data resources." Summary and more details [in TechCrunch article by Zack Whittaker](https://techcrunch.com/2021/04/30/what3words-legal-threat-whatfreewords/). |
| 2021-03-25 | [Apperta Foundation](https://apperta.org/) Supported by [NHS England](https://www.england.nhs.uk/), [NHS Digital](https://digital.nhs.uk/) | [Rob Dyke](https://twitter.com/robdykedotcom/) | Sensitive Public Info | Dyke [discovered](https://twitter.com/robdykedotcom/status/1374667465955938306) that Apperta had sensitive information on their GitHub repo and informed them. Apperta [reported Dyke](https://twitter.com/robdykedotcom/status/1374667465955938306/photo/1) to the Northumbria Police department despite them making the serious error and him being a good citizen. They also [revoked the license](https://twitter.com/robdykedotcom/status/1374720875086413828) to the materials published under NHoS, which they funded, after [pledging full transparency](https://twitter.com/robdykedotcom/status/1374671205287002114) to other matters in years prior. Summary and more details [in BleepingComputer](https://www.bleepingcomputer.com/news/security/engineer-reports-data-leak-to-nonprofit-hears-from-the-police/). |
| 2021-03-02 | [Xerox](https://www.xerox.com/) | [Raphaël Rigo](https://syscall.eu/) / Airbus Security Lab | Attacking Xerox Multi Function Printers | Per an [article at The Daily Swig](https://portswigger.net/daily-swig/xerox-legal-threat-reportedly-silences-researcher-at-infiltrate-security-conference), researcher Raphaël Rigo was scheduled to give a presentation on Xerox printers at Infiltrate 2021. An hour before the presentation, the conference informed attendees the talk would not happen due to "pending legal action". On April 22, 2021, Raphaël was finally able to give the talk. [Click here to view slides](goodies/INFILTRATE2020-RIGO-Xerox-final.pdf). [Click here to watch the live recorded presentation on Vimeo](https://vimeo.com/showcase/8085537/video/539693997).  |
| 2020-09-10 | [Giggle](https://joinagiggle.com/) | [Digital Interuption](https://www.digitalinterruption.com/) | Giggle App | After attempting to contact the CEO and several Giggle staff to disclose the vulnerability directly to them, Digital Interuption was blocked each time, and threatened by Giggle users/fans after the CEO insulted them publicly. After disclosing the vulnerability, Giggle threatened the researchers with an unspecified legal threat. |
| 2020-03-06 | [Talkspace](https://Talkspace.com/) @Talkspace | [John J Hacking](https://johnjhacking.com/) | Talkspace | John found out that he could use company "coupon codes" to sign up and use Talkspace for free, as noted by [Zach Whittaker](https://techcrunch.com/author/zack-whittaker/) who published a story about @Talkspace's denial of such claims. [In the article](https://techcrunch.com/2020/03/09/talkspace-cease-desist/), John describes that he was able to sign up to @Talkspace using promo codes that belonged to other companies, who have paid for the service. @Talkspace refuted the claims, which were clearly documented by @johnjhacking. The [Cease and Desist Letter can be found here.](goodies/Talkspace-cease-and-desist.pdf) |
| 2020-01-30 | [Iowa Supreme Court](https://example.com/), [Dallas County Sheriff Department](https://www.dallascounty.org/departments/sheriff) | [Coalfire Red Teamers Arrested at work](https://www.coalfire.com/insights/news-and-events/press-releases/charges-dismissed-against-coalfire-employees) | Red team falsely arrested. | The state of Iowa hired Coalfire to conduct a penetration test, or Red Teaming exercise on their physical premises. The ["Scope" can be viewed here](Coalfile-get-out-of-jail-free-letter.jpg). In September 2019, during the engagement, two of the [Coalfire employees were actually arrested while working](https://www.cnbc.com/2019/11/12/iowa-paid-coalfire-to-pen-test-courthouse-then-arrested-employees.html). Justin Wynn and Gary Demercurio were arrested "while working". A Sheriff arrived, and despite being well aware of the situation, arrested the two employees on burglary charges. [Coalfire had already been conducting the same pen tests with the Iowa Supreme Court](Coalfire_Investigation_Report_0F05C8A1131D1.pdf) since 2015. It took **four months** until January 30 2020 for the charges to be dropped... by the same state that they were trying to protect. [Click here to view an interview with the two Pen Testers & Brian Krebs](https://www.coalfire.com/insights/news-and-events/press-releases/charges-dismissed-against-coalfire-employees). This event highlights the seriousness of staying in scope, or removing scope altogether; a threat actor does not follow the scope. |
| 2019-11-05 | [Boeing](https://www.boeing.com/) @Boeing | [Chris Kubecka](https://twitter.com/secevangelism) | Companies without disclosure policies | Chris discovered fundamental flaws in Boeing's network security and Boeing attempted to "cover up" the incident, [according to CSOOnline](https://www.csoonline.com/article/3451585/boeings-poor-information-security-posture-threatens-passenger-safety-national-security-researcher-s.html). Chris spoke at a public event about her research. Boeing was apparently infected with actual malware, ran testing environments exposed to the public internet, [and discovered XSS vulnerabilities](https://twitter.com/SecEvangelism/status/1154495096605175808). Boeing is alleged to have threatened her with legal action, to prevent her from publicly speaking about the research, and Boeing is said to have considered publicly tarnishing Chris' reputation. Chris is a well-known Security Researcher, and an Air Force veteran.
| 2017-12-20 | [Keeper](https://keepersecurity.com/) | [Dan Goodin](https://arstechnica.com/information-technology/2017/12/microsoft-is-forcing-users-to-install-a-critically-flawed-password-manager/) | Keeper sues reporter over vulnerability story | On December 14 2017, [Tavis Ormandy reported on Google's Project Zero](https://bugs.chromium.org/p/project-zero/issues/detail?id=1481) about a concern that Windows came pre-installed with a copy of Keeper password manager. Moreover, he published screenshots of a PoC, and showed that the pre-installed software, came with a vulnerability that could be used to potentially perform "drive-by" password theft. Subsequently, [Dan Goodin covered this story in Ars Technica](https://arstechnica.com/information-technology/2017/12/for-8-days-windows-offered-a-preloaded-password-manager-with-a-plugin-vulnerability/). Keeper obviously did not like the original version of Goodin's story and demanded a trial by jury, alleging that the article contained, "false statements," and was missing facts. Keeper argued on the court filing that Goodin failed to speak to Keeper, before writing about a bug tracker post about vulnerabilities in the Keeper password manager, that came pre-installed with Windows. Keeper even tried to argue that although it was pre-installed on the computer, the customer had to "use the software", to be vulnerable. As of 2017, software is designed to be used. [[Case number 1:17-cv-09117](https://www.documentcloud.org/documents/4333677-Keeper-Security-Inc-v-Goodin-et-al.html)] |
| 2017-08-03 | [MIT](http://web.mit.edu/) [@MIT](https://github.com/mit) | [Bill Demirkapi](https://github.com/D4stiny) [@D4stiny](https://github.com/D4stiny) | Web Site Security | Bill Demirkapi discovered an exposed Wordpress debug log 4GB in size on a publicly accessible MIT service. An unnamed individual at MIT threatened Bill with 5 years jail, and determined that he had caused, "significant disruption and inconvenience for @MIT Libraries staff and patrons." MIT head of IT responded and said that scanning was "problematic." Moreover, the original threatener begins to make condescending remarks to Bill, "your understanding of the law is very limited." Bill was 16 at the time, and later went on to work for [@Zoom](https://github.com/zoom) in Offensive Security. The email exchange can be viewed at: [MIT threatened to sue after I reported a security vulnerability #27 pdf file](goodies/MIT_threatened_to_sue_after_I_reported_a_security_vulnerability_#27.pdf) |
| 2019-07-17 | [Budapesti Közlekedési Központ (BKK)](https://bkk.hu) | Unknown 18 Year Old | Transit System Security | An unknown 18 year old was arrested in Hungary, for reporting a "shamefully stupid bug" in the new Budapest e-Ticket system. As a result of the arrest, thousands of 1-star reviews were left on the T-Systems (T-Mobile) and the BKK Facebook pages. The NFC/Smart Card system was apparently trivial to defeat for the unknown 18 year old security researcher. A number of flaws were reported, including passwords being emailed in plain text when asking for a password reminder, an IDOR allowing accessing the data of other users by manipulating the UR, the ability to clone tickets, the ability to change the price of tickets, and the admin password being "adminadmin". [Read an archive summary of the research on marai.me](https://web.archive.org/web/20200202080209/https://blog.marai.me/2017/07/24/18-year-old-arrested-bkk-tsystems-e-ticket/). After arresting the innocent security researcher, the story went viral, and resulted in T-Systems Hungary hosting a press conference 4 days later, and that the researcher had conducted an "illegal hacking attempt", yet reported the bug to the vendor. The BKK CEO told the press that they didn't receive the original report from the security researcher, because he sent it to the wrong email address, which this fact was completely debunked with a screenshot from the researcher. The original research appeared to have been released on Facebook, but a copy of the FB message can be [seen here](https://www.ibtimes.co.uk/dont-shoot-messenger-teenager-arrested-showing-security-flaw-hungarian-transport-system-1632472). A 500 person protest was subsequently held on Monday 24th July 2017 [Video](https://index.hu/video/2017/07/24/tuntetes_bkk_bkv_hacker_hekker/). "It is not clear whether any further legal action [was] taken against the young man." |
| 2016-11-17 | [Chase Bank](https://www.chase.com/) | [Chad Scira](https://www.linkedin.com/in/chadscira/) | Web Site Security | Before Chase created a coordinated disclosure policy or bug bounty program, Scira found a vulnerability that allowed creating unlimited reward points. Scira documented and shared with Chase via Twitter. They organized a call with an SVP and engineer where he showed them everything that "went well". After, Chase terminated his credit card of five years as well as terminating a family member's card. Scira disclosed this on 2020-11-04. |
| 2016-12-07 | [PwC](https://www.pwc.com/) | [ESNC GmbH](https://www.esnc.de/) | PwC ACE Software | ESNC attempted to coordinate disclosure of vulnerabilities in PwC software. During the process, PwC sent two Cease & Desist orders trying to silence research. ESNC ignored them and [disclosed the vulnerabilities](http://seclists.org/bugtraq/2016/Dec/6) along with a timeline. [[ZDNet](http://www.zdnet.com/article/pwc-sends-security-researchers-cease-and-desist-letter-instead-of-fixing-security-flaw/)] [[TechDirt](https://www.techdirt.com/articles/20161213/07484536261/researchers-find-vulnerability-that-enables-accounting-fraud-pwc-decides-best-response-is-legal-threat.shtml)] |
| 2016-06-18 | [Nerium International](https://www.shopnerium.com/) | [Steven Jensen](http://s3jensen.blogspot.com/) | Vulnerability in customer portal | Steven Jensen found a simple enumeration vulnerability in the Nerium customer portal that allows any customer to see any other customer's details, including credit card, address, and more. Nerium ignored his attempts to report it and only contacted him after he posted enough details to show it was a real issue. That contact came in the form of a cease and desist letter. Jensen removed the post, and replaced it with a [timeline of the incident](http://s3jensen.blogspot.com/2016/06/nerium-vulnerability-disclosure.html). |
| 2015-12-23 | Infoba | Henrik Høyer | Vulnerability in Infoba solutions | Høyer found vulnerabilities in his son's kindergarten's computer systems, created by Infoba. He was accused of accessing sensitive information of other students, a claim which he denies. Rather than fix the vulnerabilities, charges were filed against him. [[Full story](http://ekstrabladet.dk/112/far-tiltalt-for-at-hacke-sin-soens-boernehave/5883755)]. He was originally found guilty in local court but was found not guilty in March 2017 on appeal to a higher court due to lack of evidence. [[Acquital Notice](https://www.version2.dk/artikel/derfor-blev-henrik-hoeyer-frifundet)] |
| 2015-10-06 | Unspecified | Gianni Gnesa | [Surveillance camera vulnerabilities](http://gsec.hitb.org/sg2015/sessions/session-004/) | Gnesa, scheduled to speak Oct 14, 2015 at Hack-in-the-Box GSEC, pulled his talk due to legal threats from one of the three vendors of the security cameras he tested that were found to have vulnerabilities. This threat came after Gnesa had privately disclosed the vulnerabilities to the vendor in advance. [[Threatpost](https://threatpost.com/canceled-talk-re-ignites-controversy-over-legitimate-security-research/114932/)], [[The Reg](http://www.theregister.co.uk/2015/10/08/hitb_remote_exploit_ip_cameras/?mt=1444351029389)] |
| 2015-09-25 | Good Technology | Max Moser, Tobias Ospelt, David Gullasch (modzero) | [XSS in Good for Enterprise administration console](https://www.modzero.com/advisories/MZ-13-03-GOOD-XSS.txt) | "Vendor provides legal threat against publication of advisory." No further details provided. Then, in 2015, modzero added a follow up to this incident, "remotely exploitable [vulnerability in Good's Mobile Device Management (MDM)](https://www.modzero.com/modlog/archives/2015/09/24/on_responsible_full_disclosure/index.html) Suite "Good For Enterprise" that allowed remote attackers to hijack administrative accounts". Interesting, this was filed under the researcher's website categories as, "mobile, security, modzero, rant, advisory." Good Technology, threatened modzero in the following statement, "I could get our legal team to provide the exact language, but it pretty much disallows doing certain things with the software (i.e. no reverse engineering or other activities designed to discover our "secret sauce") - E-mail from GOOD, July 11th 2013". Once again, this shows companies historically claiming that their EULA is the law and insinuating that it is illegal to find & publish bugs in their software. |
| 2015-08-13 | [FireEye](http://www.fireeye.com/) | Felix Wilhelm, ERNW | [Finding/reporting vulnerabilities in FireEye products](https://www.ernw.de/download/ERNW_44CON_PlayingWithFire_signed.pdf) | On May 7, 2015, Wilhelm/ERNW had the first of several conference calls regarding vulnerabilities in FireEye products. On August 6, 2015, FireEye sent a cease-and-desist letter to ERNW, and followed up via the District Court of Hamburg, who issued an injunction preventing Wilhelm from disclosing some, but not all, of the details of his research. As of Sep 10, 2015, Wilhelm's presentation and slides still contain redacted information. [FireEye's own advisory](https://www.fireeye.com/content/dam/fireeye-www/support/pdfs/fireeye-ernw-vulnerability.pdf) for the issues does not contain vulnerable versions, use CVE identifiers, include CVSS scoring, and has the advisory timeline section not filled out. More details are available via an [article by Richard Morrell](https://thestack.com/security/2015/09/10/major-web-security-company-sought-to-conceal-that-it-ran-compromised-servers/). [Wired Article](http://www.wired.com/2015/09/fireeye-enrw-injunction-bizarre-twist-in-the-debate-over-vulnerability-disclosures/). [ENRW Blog](https://www.insinuator.net/2015/09/sending-mixed-signals-what-can-happen-in-the-course-of-vulnerability-disclosure/). |
| 2015-07-13 | [Impero Software](https://www.imperosoftware.co.uk/) | slipstream ([@TheWack0lian](https://twitter.com/TheWack0lian/) | [Disclosing vulnerabilities in their product](https://gist.github.com/Wack0/bcc5a196f0874a39b08f) | slipstream posted information and a functional exploit for a vulnerability in Impero's Education Pro software. Impero [sent a letter via their lawyer Gateley Plc](<goodies/Letter to Mr Zammis A Clark dated 13 July 2015.pdf>), saying it violated the user agreement, discloses confidential information, caused damage to Impero, and hurt their reputation among other things. A day after posting the letter, the information is still public. [[The Register article on it.](http://theregister.co.uk/2015/07/16/school_software_firm_calls_in_lawyers_after_researcher_goes_full_disclosure/)] |
| 2015-07-07 | [Magic Software Argentina](http://www.msa.com.ar/) | Joaquín Sorianello | Vulnerabilities in MSA Vot.ar Electronic Voting System | In what appears to be a convoluted story, the protected Twitter account [@FraudeVotar](https://twitter.com/FraudeVotar) published information regarding MSA Vot.ar systems and a vulnerability related to SSL certificates. Joaquín Sorianello saw the information and reported it to MSA as a warning about the issue, but had nothing to do with the account or finding the issue. Weeks later, a group of researchers that does not include Sorianello, [published a paper about a different vulnerability in the Vot.ar system](https://docs.google.com/document/d/1aH6kvoLR8O1qWOpEz89FAB2xFcBNB-QqHgZpXxg0vGE/preview?sle=true). After this paper was published, Argentinian metro police conducted a raid of Sorianello's residence per judge's order, despite him not finding or publishing either vulnerability. The story of Sorianello was [published by Ars Technica](http://arstechnica.co.uk/tech-policy/2015/07/police-raid-programmer-who-reported-flaw-in-argentinian-e-voting-system/) and [further summarized and commented on by TechDirt](https://www.techdirt.com/articles/20150707/06204631571/argentina-rewards-programmer-who-exposed-e-voting-vulnerabilities-with-complimentary-home-police-raid.shtml). The original Tweets are still protected, and the subsequent research still available online. |
| 2015-05-04 | [CyberLock](http://www.cyberlock.com/access-control/cyberkey-smart-keys) | Mike Davis / IOActive | [Vulnerabilities in a product](https://plus.google.com/118103547235676487972/posts/aGNWAgCsvoR) | A lawyer for a firm representing CyberLock threatened a law suit based on the DMCA. Mike Davis posted the legal threat and says "they're working on it.. lawyers being lawyers.. hopefully at some point we can talk about the technical issues, it was a fun random project..". A day after the legal threat was made public, IOActive [published the research on CyberLock CyberKey](http://www.ioactive.com/pdfs/IOActive_Advisory_CyberLock.pdf). Articles covering this have been published by [Ars Technica](http://arstechnica.com/security/2015/05/05/lawyers-threaten-researcher-over-key-cloning-bug-in-high-security-lock/), [Wired](http://www.wired.com/2015/05/lock-research-another-battle-brews-war-security-holes/), and [The Reg](http://www.theregister.co.uk/2015/05/05/ioactive_security_research_gagging_order/). |
| 2015-03-26 | [Blue Coat](https://www.bluecoat.com/) | Raphael Rigo | Security assessment information on Blue Coat ProxySG technology | [According to Forbes](http://www.forbes.com/sites/thomasbrewster/2015/03/26/hackers-slam-blue-coat-claiming-it-pressured-security-researcher-into-cancelling-talk-on-its-tech/), shortly before scheduled to speak at [Syscan '15](https://www.syscan.org/index.php/sg/cft), the researcher, [@trou](https://github.com/trou), cancelled his talk on Blue Coat security. According to Lim, founder of Syscan, this was due to some form of pressure from Blue Coat who asked him to pass it on to Rigo. Blue Coat has not responded to requests about the nature of the pressure and if it involved a legal threat. As of 2015-03-27, Rigo's research is not public, and his employer says they are working with Blue Coat to "jointly share the findings" in the future. However, as of 2021-04-14, the researcher confirmed that he was able to present the talk months later at Ruxcon and Black Hat Europe. See https://github.com/disclose/research-threats/issues/8 and the slides & video are available at https://syscall.eu/ |
| 2014-07-09 | [FireEye](https://www.fireeye.com/) | Jean-Marie Bourbon | Security flaws in FireEye's Malware Analysis System | [According to Forbes](http://www.forbes.com/sites/thomasbrewster/2014/07/09/researcher-i-was-suspended-for-finding-flaws-in-fireeye-security-kit/), after sending details of the vulnerabilities to be posted on Exploit-DB, Bourbon was suspended from his day job, due to pressure from FireEye who has denied involvement. Ultimately, FireEye patched the issues, released an advisory, and credited Bourbon. |
| 2014-01-15 | [Covered California](https://www.coveredca.com/) | Kristian Erik Hermansen and Matt Ploessel | [Security flaws in Covered California website](http://www.forbes.com/sites/kashmirhill/2014/01/15/so-you-found-an-obamacare-website-is-hackable-now-what/print/) | Video taken down from Youtube and the researchers were visited by the FBI and asked to stop discussing the issues. |
| 2014-01-08 | [Public Transport Victoria](http://www.ptv.vic.gov.au/) | Joshua Rogers | [Security flaws in PTV website](http://www.theage.com.au/technology/technology-news/schoolboy-hacks-public-transport-victoria-website-20140107-30fkg.html) | Company referred incident to Victoria Police |
| 2013-12-16 | [ZippyYum](https://www.zippyyum.com/) | Daniel Wood | [Insecure Data Storage in iOS Subway ordering app](http://seclists.org/fulldisclosure/2013/Dec/39) | Researcher says no NDA was signed and has retained an attorney to handle any potential legal action [[Mailing List Thread](http://seclists.org/fulldisclosure/2013/Dec/160)] |
| 2013-11-10 | [Christchurch Public Transport Card (ECan)](https://www.ecan.govt.nz/) | [William "AmmonRa" Turner](https://twitter.com/amm0nra) | Insecure Public Transport Card System | At [Kiwicon 7](https://2013.kiwicon.org/the-con/talks.1#e112) (2013-11-09), researcher "AmmonRa" [disclosed a series of vulnerabilities regarding Christchurch's "Metro Card" bus fare system](https://www.rnz.co.nz/news/the-wireless/370448/smart-cards-not-so-smart). He previously reported the security flaw to Environment Canterbury, the group that oversees the bus network, three months prior, but nothing had been done. Without merit, after disclosing the vulnerability publicly, [Environment Canterbury director operations Wayne Holton-Jeffreys had called the police](https://www.stuff.co.nz/the-press/news/transport/9386649/ECan-public-transport-card-hacked) (but was unsure if any charges would be laid). In essense, the Director of operations, Wayne Holton-Jeffreys, failed to protect their own systems and passed the buck to a hacker for exposing a loophole where 70,000 free rides were allegedly ridden following the talk at Kiwicon. ECan "called the police" over the flaws that they themselves created, and ignored. |
| 2013-07-26 | [Volkswagen](http://www.volkswagenag.com/content/vwcorp/content/en/homepage.html) | [Flavio Garcia, University of Birmingham](http://www.cs.ru.nl/~flaviog/) | Security flaws in Volkswagen cars | The High Court in the U.K. issued an injunction against Garcia, preventing him from disclosing vulnerabilities in Volkswagon luxury cars that allow an attacker to start them [[Article](http://www.guardian.co.uk/technology/2013/jul/26/scientist-banned-revealing-codes-cars)]. Paper and slides ultimately [posted to USENIX site](https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/verdult) two years later after the injunction. [[Ars Technica](http://arstechnica.com/security/2015/08/researchers-reveal-electronic-car-lock-hack-after-2-year-injunction-by-volkswagen/), [Bloomberg](http://www.bloomberg.com/news/articles/2015-08-14/vw-has-spent-two-years-trying-to-hide-a-big-security-flaw)] |
| 2013-07-09 | [VideoLAN Organization](http://videolan.org/) | [Secunia](http://secunia.com/) | Security flaws in VLC Media Player | Secunia discovered a [UAF bug in VLC Media Player](https://web.archive.org/web/20161231113619/http://secunia.com/advisories/51464/). After [threatening Secunia with legal action](<goodies/footnote 8.txt>), Secunia updates their entry to reflect a vulnerability is 'patched' even though it likely is not, and then changed back to 'unpatched' after even more analysis. VLC threatened that [the tweet](https://twitter.com/Secunia/status/336497866308743169) had been screenshot by a lawyer, and demanded quick turn-around in closing the report. Secunia [writes an extensive blog on the saga](https://web.archive.org/web/20151006081501/http://secunia.com/blog/shooting-the-messenger-372/), as has [Jean-Baptiste Kempf from VideoLAN](http://www.jbkempf.com/blog/post/2013/More-lies-from-Secunia). Bug report can be read here: [https://trac.videolan.org/vlc/ticket/7860](https://trac.videolan.org/vlc/ticket/7860) |
| 2013-06-13 | [Zamfoo](http://www.zamfoo.com/) | Patrick | Security flaws in Zamfoo's products | After two weeks of not patching a vulnerability, Patrick threatens to post a POC if it isn't fixed faster. Zamfoo replies by [threatening to sue him](http://www.webhostingtalk.com/showpost.php?p=8724914&postcount=6). ([Full Thread](http://www.webhostingtalk.com/showthread.php?t=1275572)) |
| 2013-04-05 | [Keeper](https://keepersecurity.com/) | [Fox IT](https://www.fox-it.com/) | Security vendor threatens legal action against research group | According to Fox-IT: "Fox-IT has [reported the vulnerability](https://blog.fox-it.com/2013/04/05/security-advisory-unencrypted-storage-of-confidential-information-in-keeper-password-data-vault-v5-3-for-ios/) in Keeper® Password & Data Vault to Keeper Security Inc. within 24 hours of its initial discovery. Unfortunately, Keeper Security Inc. has refused to constructively engage in a responsible disclosure procedure and has requested all further communication to be addressed to the company’s legal counsel. Keeper Security Inc’s legal counsel has since notified Fox-IT that “that the issue raised […] has been addressed and resolved in the new version of Keeper (Version 6.0) which is available on the App Store”. However, the description of the update on the App Store does not specify this version resolves any security issues. Fox-IT was also notified that the public disclosure of the issues that are described in this advisory may be met with swift legal action." |
| 2013-01-20 | Dawson College / Skytech | Ahmed Al-Khabaz | Security flaws in Skytech's Omnivox portals, used by schools | Found vulnerability that exposed 250k student records, brought it to attention of college. Did not try to conceal his identity, did not misuse the information, did not try to profit. Skytech threatened to press charges and send him to jail [if he did not sign an NDA](https://nationalpost.com/news/canada/youth-expelled-from-montreal-college-after-finding-sloppy-coding-that-compromised-security-of-250000-students-personal-data). |
| 2012-10-25 | (unknown international utility) | Ralph Langner | Nuclear power plant vulnerabilities (SCADA) | Talk was cancelled last minute at the 12th ICS Cyber Security Conference An unnamed vendor objected to the talk on the grounds that "the review would disclose problems in its equipment" and threatened to sue, "even though plant officials had approved the presentations". This is one of two talks cancelled at the conference [according to the conference organizer](http://gadgets.ndtv.com/internet/news/legal-fears-muffle-warnings-on-cyber-security-threats-286061). |
| 2012-05-28 | [E-Soft (UK)](http://www.e-soft.co.uk/) | Eric Romang | [Video of Metasploit Digital Music Pad SEH overflow exploitation module](http://attrition.org/errata/legal_threats/e-soft/) | E-Soft sent a bogus copyright claim to YouTube to have the video removed. It has been reposted to the same site once by another individual. The video remains available, and there have been no reported attempts to silence news of the exploit in other manners. |
| 2012-01-31 | Smart Grid/Meter Vendor (unspecified) | [Don Weber / InGuardians](http://www.cutawaysecurity.com/blog/archives/930) | [Smart Grid Meter Security Assessment Tool Release](http://www.darkreading.com/advanced-threats/167901091/security/vulnerabilities/232500808/researchers-postpone-release-of-free-smart-meter-security-testing-tool.html) | Researcher cancelled the talk last minute, citing the desire to work with the vendor. Note: a reliable source tells Attrition that InGuardian did not reach out to the vendor until weeks after the ShmooCon CFP. Further, Weber [says there was no vulnerabilities being disclosed](https://twitter.com/#!/cutaway/status/165923445698347008), suggesting that InGuardian may have cancelled the talk when the unspecified vendor agreed to become a client. |
| 2011-11-22 | [Carrier IQ](http://www.carrieriq.com/) | Trevor Eckhart | [Carrier IQ software logs excessive information](http://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq/) | Carrier IQ [threatens Eckhart](https://www.eff.org/deeplinks/2011/11/carrieriq-censor-research-baseless-legal-threat) and sends a [cease & desist letter](https://www.eff.org/sites/default/files/eckhart_cease_desist_demand_redacted.pdf). Shortly after negative attention, Carrier IQ [retracts the threat](https://www.eff.org/sites/default/files/Marcia%20Hoffman%20Fax%2011.23.11.pdf). Research stays public. |
| 2011-10-13 | [First State Superannuation](http://www.firststatesuper.com.au/) | Patrick Webster | [Direct Object Reference vulnerability in FSS website](http://risky.biz/fss_idiots) | [Researcher received letter](http://risky.biz/minter) indicating FSS reported him to the police and threatened him with further legal action. After negative publicity, First State Super [withdraws legal threat](http://www.theregister.co.uk/2011/10/19/first_state_super_tones_it_down/). |
| 2011-08-01 | [Trans Link Systems](http://www.translink.nl/) | Brenno de Winter | [OV Transit Payment System Vulnerabilities](http://news.cnet.com/8301-27080_3-20086613-245/journalist-faces-charges-over-transit-card-flaw-reports/?part=rss&subj=news&tag=2547-1_3-0-20&dlvrit=142337) | Researcher learned he may have been facing legal charges. Vendor statement says a criminal complaint was filed and researcher was questioned, but researcher was not the target of the complaint. Instead, the Netherlands government took legal action against Brenno, a journalist, for covering the issue. [More information](https://www.techdirt.com/articles/20110802/03572015357/dutch-journalist-legal-trouble-showing-how-new-transit-card-is-easy-to-defraud.shtml). |
| 2011-04-27 | [Magix AG](http://www.magix.com/) | [Acidgen](http://www.corelan.be/index.php/forum/security-advisories/corelan-11-002-magix-music-maker-16-stack-buffer-overflow/) | [Buffer overflow in Music Maker 16 software (version 16.0.2.4)](http://www.darkreading.com/vulnerability-management/167901026/security/vulnerabilities/229402356/another-researcher-hit-with-threat-of-german-anti-hacking-law.html) | Research published despite threat. Researchers convinced Magix to change stance on vuln handling. Magix opened a [resource for security researches site](http://research.magix.com/), but try to force researchers not to disclose w/o a patch or fix available, in their [terms and conditions](http://research.magix.com/legal-information-terms-and-conditions). |
| 2011-03-21 | German telecommunications firm (unspecified) | Thomas Roth | [Amazon EC2-based password cracking software](http://www.darkreading.com/authentication/167901072/security/encryption/229000423/cloud-based-crypto-cracking-tool-to-be-unleashed-at-black-hat-dc.html) | [Roth's apartment was raided, his bank account frozen, and he had to refrain from releasing his tool during Black Hat.](http://www.darkreading.com/authentication/167901072/security/client-security/229301362/researcher-overcomes-legal-setback-over-cloud-cracking-suite.html) Injunction had since been revoked, Roth published the research. |
| 2010-08-22 | Indian Police (Mumbai) | Hari Prasad | [Vulnerabilities in Electronics Corporation of India (ECIL) Electronic Voting Machines](https://indiaevm.org/) | A paper released in April of 2010 by eight researchers, four who live in India, outlined vulnerabilities in the EVMs used by the Indian government for elections, despite repeated claims that they were "tamper-proof". On August 22, 2010, Police officers from Mumbai drove 14 hours to Hyderabad and [arrested Hari Prasad](https://freedom-to-tinker.com/blog/jhalderm/electronic-voting-researcher-arrested-over-anonymous-source/). He was not charged initially, and told him that they were under "pressure [from] the top". He was told if he gave up the anonymous source that provided an EVM to the team for their research he would be left alone. After seven days in jail, and being denied bail due to medical conditions once, Prasad was [finally released on bail](https://freedom-to-tinker.com/blog/jhalderm/indian-e-voting-researcher-freed-after-seven-days-police-custody/). The research paper and web site outlining Indian EVM problems remains public. |
| 2010-07-26 | Financial Industry Client (unspecified) | Varun Uppal and Gyan Chawdhary | [High-Speed Trading System Hacks](http://www.forbes.com/sites/firewall/2010/07/26/talk-on-high-speed-trading-hacks-pulled-from-security-conference/) | Due to financial pressure (i.e. loss of a client), the talk was pulled and not presenter anywhere else. |
| 2010-07-15 | Taiwanese Government | Wayne Huang, Armorize Technologies Inc. | [The Chinese Cyber Army: An Archaeological Study from 2001 to 2010](https://www.blackhat.com/html/bh-us-10/bh-us-10-briefings.html#Huang) | Two weeks before the conference, [the talk was cancelled](http://www.eweek.com/c/a/Security/China-Cyber-Army-Talk-Pulled-From-Black-Hat-668887/) due to "pressure from the Taiwanese government." |
| 2009-07-18 | [RSA](http://www.rsa.com/) | [Scott Jarkoff](https://web.archive.org/web/20111007083821/http://techmiso.com/about/#about-scott) | [Navy Federal Credit Union Web Site Flaws](https://web.archive.org/web/20111010114113/http://techmiso.com/2434/navy-federal-credit-union-web-site-operating-with-security-issue/) | [SliceHost / TechMiso challenges RSA, RSA backs down](https://web.archive.org/web/20111010114113/http://techmiso.com/2434/navy-federal-credit-union-web-site-operating-with-security-issue/) |
| 2009-07-17 | [Comerica Bank](http://www.comerica.com/) | [Lance James](http://en.wikipedia.org/wiki/Lance_James) | XSS / Phishing vulnerabilities on Comerica site | [C&D Sent to Tumblr](http://files.getdropbox.com/u/634884/Letter%20to%20Tumblr%20from%20P.%20Bertrand%207-17-09.PDF), information removed but vulnerability still present (2009-07-17) |
| 2009-06-06 | [Orange.fr](http://orange.fr/) | [HackersBlog](http://www.hackersblog.org/) | Multiple Vulnerabilities [[1](http://www.hackersblog.org/2009/05/25/orange-is-so-cool/)] [[2](http://www.hackersblog.org/2009/05/29/back-with-fresh-news-about-orangefr-intrusions/)] | [Apparent legal threats, details not published.](http://www.hackersblog.org/2009/06/06/so-lol/) |
| 2008-08-13 | [Sequoia Voting Systems](http://www.sequoiavote.com/) | [Ed Felten](http://en.wikipedia.org/wiki/Edward_Felten) | [Voting Machine Audit](http://freedom-to-tinker.com/blog/felten/interesting-email-sequoia) | [Research still not published](http://freedom-to-tinker.com/blog/appel/judge-suppresses-report-voting-machine-security) (2008-10-02) |
| 2008-08-09 | [Massachusetts Bay Transit Authority](http://www.mbta.com/) | Zach Anderson, RJ Ryan and Alessandro Chiesa | [Electronic Fare Payment (Charlie Card/Charlie Ticket)](http://www.eff.org/cases/mbta-v-anderson) | [Gag order lifted, Researchers hired as consultants by MBTA](http://www.eff.org/press/archives/2008/12/22) |
| 2008-07-09 | [NXP (formerly Philips Semiconductors)](http://www.nxp.com/) | [Radboud University Nijmegen](http://www.ru.nl/english/) | [Mifare Classic Card Chip Security](http://news.cnet.com/8301-10784_3-9985886-7.html) | [Research Published](http://www.ru.nl/english/general/radboud_university/vm/security_flaw_in/) |
| 2007-12-06 | [Autonomy Corp., PLC](http://www.autonomy.com/) | [Secunia](http://www.secunia.com/) | [KeyView Vulnerability Research](http://archives.neohapsis.com/archives/fulldisclosure/2007-12/0152.html) | [Research Published](http://secunia.com/advisories/search/?search=autonomy). Apparently, Autonomy also threatened CORE as well but it was not made public, yet the [information was shared with others](https://twitter.com/4Dgifts/status/643260632859574272). |
| 2007-07-29 | [U.S. Customs](https://www.cbp.gov) | Halvar Flake | [Security Training Material](http://addxorrol.blogspot.com/2007/07/ive-been-denied-entry-to-us-essentially.html) | Researcher denied entry into U.S., training cancelled last minute |
| 2007-04-17 | [BeThere (Be Un limited)](https://www.bethere.co.uk/) | Sid Karunaratne | [Publishing ISP Router Backdoor Information](http://www.theregister.co.uk/2007/04/17/hackers_service_terminated/) | [Researcher still in talks with BeThere](http://blogs.securiteam.com/index.php/archives/826), passwords redacted, [patch supplied](https://web.archive.org/web/20090318233740/http://blog.v-wall.co.uk/), ISP service not restored (2007-07-06) |
| 2007-02-27 | [HID Global](http://www.hidglobal.com/) | [Chris Paget/IOActive](http://www.ioactive.com/) | [RFID Security Problems](http://www.securityfocus.com/news/11444) | [Talk pulled, research not published](http://www.infoworld.com/article/07/02/27/HNioactiverfid_1.html) |
| 2007-??-?? | [TippingPoint Technologies, Inc.](http://www.tippingpoint.com/) | [/David Maynor / ErrataSec](http://www.erratasec.com/) | [Reversing TippingPoint rule set to discover vulnerabilities](http://erratasec.blogspot.com/2009/01/im-reading-this-blog-by-verisign-in.html) | Bulk of research [later published at BlackHat Briefings 07](https://www.blackhat.com/presentations/bh-usa-07/Maynor_and_Graham/Whitepaper/bh-usa-07-maynor_and_graham-WP.pdf). |
| 2006-09-02 | [SimpleBlog](http://www.thirstysix.com/) | [Vipsta & MurderSkillz](https://www.exploit-db.com/exploits/2296) | Reporting of an SQL injection to a vendor resulted in immediate, "legal threats." | In 2006, two researchers named Vipsta & MurderSkillz produced a [Proof of Concept on exploit-db.com](https://www.exploit-db.com/exploits/2296) which affected a popular Drupal theme named SimpleBlog. At the time, the vendor 8pixel.net (now [http://www.thirstysix.com/](http://www.thirstysix.com/) apparently threatened legal action on the same day as the report being reported to them. Two days later the, "Exploit [was] Released with no details to vendor." |
| 2005-07-29 | [Cisco Systems, Inc.](http://www.cisco.com/) | [Mike Lynn](http://en.wikipedia.org/wiki/Michael_Lynn) / [ISS](http://www.iss.net/) | [Cisco router vulnerabilities](http://archive.wired.com/politics/security/news/2005/07/68356) | [Resigned from ISS before settlement](http://www.securityfocus.com/news/11260), gave BH presentation, future disclosure injunction agreed on. Full details [on Wikipedia](https://en.wikipedia.org/wiki/Ciscogate).|
| 2005-03-25 | [Sybase, Inc.](http://www.sybase.com/) | [Next-Generation Security Software](http://www.ngssoftware.com/) | [Sybase Database vulnerabilities](http://www.computerworld.com/securitytopics/security/holes/story/0,10801,100637,00.html) | [Threat dropped, research published](http://www.securityfocus.com/news/10827) |
| 2003-09-30 | [Blackboard Transaction System](http://www.blackboard.com/Commerce-Security/Transact-Platform.aspx) | Billy Hoffman and Virgil Griffith | [Blackboard issued C&D to Interz0ne conference, filed complaint against students](http://www.chillingeffects.org/weather.cgi?WeatherID=383) | Confidential agreement reached between Hoffman, Griffith and Blackboard |
| 2003-02-05 | [Epic Games](http://epicgames.com/) | Luigi Auriemma / PivX Solutions | [Vulnerabilities in Unreal game engine](https://web.archive.org/web/20030205214924/http://www.pivx.com/luigi/adv/ueng-adv.txt) | Thor Larholm of PivX [outlines the story in a post to the Bugtraq mail list](http://seclists.org/bugtraq/2003/Feb/141). The same day, Mark Rein of Epic Games replies to Thor [apologizing for the legal threat](http://seclists.org/bugtraq/2003/Feb/144), calling them a "moment-of-stupidity reaction". Sam Varghese of smh.com.au [summarizes the story in an article](http://www.smh.com.au/articles/2003/02/12/1044927647213.html). |
| 2002-07-30 | [Hewlett-Packard Development Company, L.P. (HP)](http://www.hp.com/) | [SNOsoft](http://www.snosoft.com/) | [Tru64 Unix OS vulnerability - DMCA based threat](http://news.cnet.com/2100-1023-947325.html) | [Vendor/researcher agree on future timeline](http://www.pcworld.com/article/103853/hp_bughunters_declare_truce.html), Additional Tru64 vulnerabilities published, [HP asks Neohapsis for OpenSSL exploit code shortly after](http://archive.wired.com/science/discoveries/news/2002/08/54297) |
| 2001-07-16 | [Adobe Systems Incorporated](http://www.adobe.com/) | [Dmitry Sklyarov](https://web.archive.org/web/20010801164805/http://freesklyarov.org/) & [ElcomSoft](http://www.elcomsoft.com/) | [Adobe eBook AEBPR Bypass](http://w2.eff.org/IP/DMCA/US_v_Elcomsoft/us_v_sklyarov_faq.html) | [Elcomsoft found Not Guilty](https://web.archive.org/web/20030101045946/http://news.com.com/2100-1023-978176.html) |
| 2001-??-?? | [Tegam International Viguard Antivirus](http://www.viguard.com/en/intro_en.php) | Guillaume Tena (Guillermito) | [Vulnerabilities in Viguard Antivirus](http://web.archive.org/web/20030404161138/http://www.pipo.com/guillermito/viguard/index.html) | [Suspended fine of 5,000 Euros](http://news.cnet.com/France%20puts%20a%20damper%20on%20flaw-hunting/2100-7350_3-5606306.html?tag=techdirt) |
| 2001-04-23 | [Secure Digital Music Initiative (SDMI)](http://www.sdmi.org/), [Recording Industry Association of America (RIAA)](http://www.riaa.org/) and [Verance Corporation](http://verance.com/) | [Ed Felten](http://en.wikipedia.org/wiki/Edward_Felten) | [Four Watermark Protection Schemes Bypass - DMCA based threat](http://news.cnet.com/2100-1023-256277.html) | [Research published at USENIX 2001](http://en.wikipedia.org/wiki/Edward_Felten#SDMI_Lawsuits) |
| 2000-08-17 | [Motion Picture Association of America (MPAA)](http://www.mpaa.org/) & [DVD Copy Control Association (DVD CCA)](http://www.dvdcca.org/) | [2600: The Hacker Quarterly](http://www.2600.com/) | [DVD Encryption Breaking Software (DeCSS)](http://news.cnet.com/2100-1023-244620.html) | [DeCSS ruled 'not a trade secret'](http://www.linuxinsider.com/story/32672.html) |

Notes about this page:

-   Companies that broadly use the [DMCA](http://en.wikipedia.org/wiki/Digital_Millennium_Copyright_Act) may not be included. This page focuses on companies that specifically use legal threats to stifle **security** research.
-   Many companies may use financial threats to stifle research, threatening to pull funding, support contracts or influence customers. There is an arguably fine line between legal threats (costly) and financial threats (also costly). These may be included if they can be properly documented.
-   Companies that fire off Cease & Desist (C&D) letters but do not follow-up will be included here if applicable.

The following incidents are either **not confirmed** as legal or financial threats, or are confirmed and still cross the line to some degree. They are being included here in the hopes that someone will come forward with additional information or clarification.

| **When** | **Company making threat** | **Researchers** | **Research Topic** | **Resolution/Status** |
|---|---|---|---|---|
| 2013-04-30 | [Wowza Media Systems](http://www.wowza.com/) | Michal J. | [Vulnerabilities in the media server's authentication](http://seclists.org/bugtraq/2013/Apr/186) | The vulnerabilities were reported to the vendor who threatened to "reevaluate" the researcher's independent consultant status as well as other indirect threats. The vulnerabilities were disclosed after the vendor refused to provide a remediation plan. The researcher has [terminated their participatin in the vendor's consultant program](http://wejn.com/wowza/). |
| 2008-10-24 | Google | Charlie Miller | Vulns in T-Mobile Google Phone | Researcher Charlie Miller discovered [vulnerabilities in a Google-based phone sold by T-Mobile](http://www.nytimes.com/2008/10/25/technology/internet/25phone.html), who notified Google who downplayed the issue. Years later, Miller disclosed that Google [went after him via his employer](https://twitter.com/0xcharlie/status/581433111944175616). When asked for details, he [clarified that it was not a legal threat](https://twitter.com/0xcharlie/status/581483558608326656), but a lecture on "responsible disclosure" to his boss at the time. |
| 2008-08-01 | [Apple](http://www.apple.com/) | Charles Edge / [318 Inc.](http://www.318.com/) | [FileVault encryption system weaknesses](http://news.cnet.com/8301-1009_3-10004627-83.html) | NDA between Edge/Apple existed already, Apple called Edge on it. Researcher "rescinded talk" but BH CFP team shows no record of talk being submitted in first place. Attrition Theory: Incident used as press fodder for 318/Edge attention. |
| 2006-12-07 | [Oracle Corporation](http://www.oracle.com/) | [Argeniss](http://www.argeniss.com/) | [Week of Oracle Bugs (WoOB)](http://archives.neohapsis.com/archives/bugtraq/2006-11/0393.html) | [WoOB cancelled, ](http://www.scmagazineus.com/Argentine-firm-scraps-Oracle-flaw-a-day-plans/article/34187/)[**rumors** of financial/legal threats](http://blogs.windowsecurity.com/parker/2006/11/29/oracle-threatens-researcher/) |

The following incidents are related to the ones above, but "cross the line". They include incidents where it was not "security research", but rather activity that was considered a crime by current laws (at the time). Instead of following a more ethical approach or going the route of responsible disclosure, the researcher chose to research and disclose the details in a manner that was questionable. While the threat of law suit of such activity is frivilous to most, the companies are being prudent because the researcher in question likely did break laws in the process.

| **When** | **Company making threat** | **Researchers** | **Research Topic** | **Resolution/Status** |
|---|---|---|---|---|
| 2010-08-23 | n/a | Hari Prasad, Netindia | Voting Machine vulnerability research | [Prasad arrested, machine given to him was apparently stolen](http://www.wired.com/threatlevel/2010/08/researcher-arrested-in-india) |
| 2008-09-12 | [Carleton University](http://www.carleton.ca/) | Mansour Moufid | Used keylogger to expose student information | [Moufid charged with computer crime](https://web.archive.org/web/20081106023458/http://www.canada.com/ottawacitizen/news/city/story.html?id=25110a8f-a73a-43a0-a2a5-1daa08d147d1) |
| 2006-04-28 | [University of Southern California](http://www.usc.edu/) | Eric McCarty | Database programming error allows disclosure of student SSN and more | [McCarty charged with computer crime](http://archive.wired.com/politics/law/commentary/circuitcourt/2006/05/70857) |
| 2003-08-18 | [Tornado Development, Inc.](http://www.tornadodevelopment.co.za/) | Bret McDanel | Secure Webmail Session Hijacking discovery | [Arrested, tried, convicted and sentenced to 16 months of prison time](http://www.securityfocus.com/columnists/179) |
| 2002-03-18 | [Harris County District Court](http://www.justex.net/) | Stefan Puffer | Insecure wireless network discovery | [Faces 5 years and $250,000 fine](http://www.theregister.co.uk/2002/07/26/ethical_hacker_faces_war_driving/). The [jury deliberated for 15 minutes before acquitting Puffer](http://osdir.com/ml/security.attrition.infosec-news/2003-02/msg00106.html). |

Over the years, many talks have been cancelled for various reasons. Sometimes, the rumor of legal threats dominate the venue and/or news, but never happened. This table will list such events, to help clarify what happened. As time allows, any case of a security talk being cancelled will be added.

| **When** | **Company making request or threat** | **Researchers** | **Research Topic** | **Resolution/Status** |
|---|---|---|---|---|
| 2012-10-19 | Hewlett-Packard | Kurt Grutzmacher | Huawei / H3C router vulnerabilities | Grutzmacher coordinated disclosure via US-CERT in August. Days before Toorcon 2012, HP sent a polite request for him to cancel, saying patches were not ready. Grutzmacher cancelled his talk. Two days later, HP released the patch, casting doubt over their intention behind the request. |
| 2012-10-10 | (none) | Pirate Bay founders Peter Sunde and Fredrik Neij | Talk titled "Data is Political" | Neij's lawyer advised his client not to travel to a highly visible public conference centered on hacking. Sunde was reportedly too ill to travel. |
| 2012-07-29 | (unknown) | Sergey Gordeychik / Denis Baranov, Positive Technologies | SCADA vulnerabilities including Siemens | The talk "SCADA Strangelove: How I Learned To Start Worrying And Love The Nuclear Plants" was cancelled a week before the conference and replaced with a different SCADA talk by another person not affiliated with Positive Technologies. No confirmation as to why, speculation is the talk was pulled due to vendor pressure. |
| 2012-01-31 | Smart Grid Meter Vendor (unnamed) | Don Weber / InGuardians | Smart Grid Vulnerabilities | Was asked to pull talk from ShmooCon 2012, complied. Presented later at BSidesLV 2012. |
| 2011-08-16 | (none) | Riley Hassel / Shane Macaulay | Google Android Vulnerabilities | BlackHat Briefings Las Vegas 2011 Hassel/Macaulay scheduled to give "Hacking Android for Profit" talk at BlackHat Briefings Las Vegas 2011. Neither presenter showed for their talk. Subsequent articles point out that Google said "The identified bugs are not present in Android", and that the presenters backed out in "fear criminals would use it attack Android phones". In another work, Hassel said "that some of their work may have replicated previously published research, and they wanted to make sure they properly acknowledged that work." |
| 2011-05-18 | Siemens / Department of Homeland Security (DHS) | Dillon Beresford / NSS Labs | SCADA vulnerabilities | TakeDownCon 2011 talk titled "Chain Reactions - Hacking SCADA" was cancelled by Beresford after concerns from Siemens/DHS were expressed. Beresford said "DHS in no way tried to censor the presentation." |
| 2010-07-15 | Taiwanese / Chinese agencies (unnamed) | Wayne Huang, Armorize CTO | Analysis of China's government-backed hacking initiatives | Talk pulled from BlackHat Briefings 2010 in Las Vegas, announced by Caleb Sima, Armorize CEO on Twitter. An earlier version of the talk was given to a small conference in Taiwain in 2007. |
| 2010-06-29 | ATM Vendors (unnamed) | Raoul Chiesa | ATM Vulnerabilities | [Initial](http://www.net-security.org/secworld.php?id=9529) [reports](http://news.softpedia.com/news/Security-Expert-Pulls-Presentation-After-Legal-Threats-146223.shtml) said that Chiesa was threatened by ATM vendors and forced to cancel last minute. [according to Chiesa](http://news.softpedia.com/news/Researcher-Dispels-Rumors-Surrounding-HITB-Europe-Talk-Cancellation-148181.shtml), no threats were made. The talk was cancelled for "logistical issues that day". Some in the industry have classified this as a publicity stunt, to garner more attention for the talk at a subsequent date. |
| 2009-06-30 | ATM Vendors (unnamed, presumed Triton) | Barnaby Jack / Juniper Networks | ATM Vulnerabilities | BlackHat Briefings Las Vegas 2009 talk cancelled by Juniper after ATM vendor expressed concerns about disclosure before customers were fully protected. Information published at BlackHat 2010. |
| 2008-07-02 | Apple | Unamed 'Apple Insiders' | Apple Security Response Team | According to Trey Ford, BlackHat general manager, a panel of Apple insiders were to have a panel to discuss "the company's security-response team". When Apple's marketing department heard, the panel was abruptly cancelled.|

research-threats

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README