Security Research Safe Harbors

In the US, a 2022 DOJ charging policy directs prosecutors to decline good-faith security research cases under the CFAA, and DMCA Section 1201 grants a renewable exemption to bypass access controls when testing software you don't own. Neither is a statutory right.

The EU has no equivalent. Protection is left to each member state's computer misuse law, while the Cyber Resilience Act and NIS2 impose reporting duties on manufacturers without protecting the researchers who find defects (see C-16).

Reporting a defect and researching one carry very different legal risk.

Discussion prompts

• Would your legal team currently authorize an outside researcher to test your live product without a signed agreement first?
• What changes for a researcher working across US and EU jurisdictions with no unified safe harbor?
• Should protecting researchers be a manufacturer responsibility, an operator one, or a legal one?