2013-01-09
Abstract
Dutch government attempts to encourage responsible disclosure of vulnerabilities.
Copyright © 2013 Virus Bulletin
The Dutch government has published a set of guidelines to encourage responsible disclosure of vulnerabilities.
The reporting of vulnerabilities by so-called ‘white hat’ or ‘ethical’ hackers is often fraught with controversy as many choose to announce their discoveries publicly rather than first approaching the software or hardware company whose products are affected.
The guide published by the National Cyber Security Center (NCSC) encourages parties to work together – one suggestion it makes is for companies and governments to offer standard online forms that can be used by researchers to notify the organizations when they discover a vulnerability.
The guide also suggests that an acceptable period for the disclosure of software vulnerabilities is 60 days, while for hardware vulnerabilities (which tend to be more time-consuming to fix) it suggests a period of six months.
However, the new guidelines do not affect the current legal framework in the Netherlands. So, while the organizations themselves may agree not to take legal action against hackers who follow the disclosure guidelines, the Public Prosecution Service may still prosecute if it believes crimes have been committed.
