LayerOne 2018 - How to Security Research Without Getting Sucked into a Courtroom (Robert Adams)

Overview Robert Adams, a licensed attorney specializing in cybersecurity law, explains how security researchers can conduct technical research without legal consequences. The talk covers federal statutes, criminal versus civil liability, and practical protective measures.

Key Topics The Computer Fraud and Abuse Act (18 USC §1030) is central to the discussion. Adams distinguishes between five relevant sections: §1030(a)(1) prohibits unauthorized access to U.S. government computers with no intent requirement (accidental violations possible); §1030(a)(2) requires intentional unauthorized access to obtain "information" (broadly defined, creating ambiguity about what constitutes illegal data theft); §1030(a)(5)(a) targets malware creators who knowingly transmit code causing intentional damage; and critically, §1030(a)(5)(c)—the "fuck-you clause" for researchers—makes it illegal to intentionally access a system where that access causes any damage or loss, regardless of whether damage was intended. The term "protected computer" is extremely broad, covering federal systems and any system affecting interstate or foreign commerce, encompassing nearly all modern computers.

The Digital Millennium Copyright Act (17 USC §1201) prohibits circumventing technological measures controlling access to works, applying to authentication handshakes, code signing, and protocol encryption.

Adams emphasizes the distinction between the U.S. legal system and justice system: courts determine what can be proven, not what is fair. He addresses defamation risks, noting that truth is a defense and researchers should stick to factual statements with supporting evidence rather than opinions or assumptions. First Amendment protection exists for speech but not freedom from consequences; prior restraints on speech violate the First Amendment except in narrow contexts like national security or illegal content.

Technical Details and Protections To avoid §1030(a)(5)(c) violations, Adams recommends: adding detailed code comments documenting intent; implementing request throttling to limit server impact; researching target infrastructure (hosting location, pricing model) to assess potential costs from access; and avoiding generating excessive traffic that could constitute measurable damage or loss.

For vulnerability disclosure, Adams strongly advises never requesting payment (extortion/blackmail risk), though accepting offered bounties is acceptable. He recommends conducting disclosure through an attorney rather than directly, allowing attorney-client privilege to shield identity and creating legal buffer against injunctive relief attempts.

Other protections include screenshotting evidence, staying informed about state-specific laws, obtaining and understanding liability insurance exclusions (many exclude unpatched systems), and understanding that once banned from a system, returning constitutes intentional access, nearly guaranteeing CFAA violation.

Criminal Procedure If arrested, Adams advises: comply with lawful orders without resistance; provide only name, address, and birthdate; immediately request an attorney; cease all questioning if an attorney is requested; and avoid providing any information through seemingly innocent questions, as even minor statements can incriminate.

Civil Liability Under CFAA §1030(g), companies can sue for compensatory damages or injunctive relief. Compensatory damages cover direct costs; consequential damages include labor, server replacement, backup restoration, and increased operational costs (especially for cloud-hosted systems charged per transaction). A two-year statute of limitations applies from discovery, not access. A "negligent design" clause provides defense if code comments demonstrate unintended behavior.

Takeaways Security research operates within a legal framework with significant gray areas. Researchers must understand that access-based liability depends on system impact, not intent to damage. Practical measures—documentation, throttling, legal counsel—substantially reduce risk. The legal system rewards those who can prove their actions and intentions; detailed code comments and evidence collection are defensive essentials. Using an attorney as intermediary for disclosure provides substantial protection through privilege and shifts legal exposure away from the researcher.