What Counts as “Good Faith Security Research?”
Summary: The U.S. Department of Justice revised its policy on charging Computer Fraud and Abuse Act violations, stating prosecutors should avoid charging security researchers who operate in "good faith" when finding and reporting vulnerabilities. Legal experts including UC Berkeley professor Orin Kerr note the guidelines cannot be used as a defense in court and offer no shield against civil prosecution, and the policy follows the Supreme Court's Van Buren v. United States ruling that the CFAA does not cover misuse of information a person is otherwise authorized to access.
What's compelling: The DOJ's guidance binds only prosecutors, not the companies whose systems researchers test, and Kerr notes the line between legitimate research and something else remains murky - so a researcher who retrieves every customer record instead of a few proof-of-concept files still faces costly civil suits with no enforceable good-faith defense.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026