60% of ethical hackers do not submit vulnerabilities due to the fear of prosecution. This fear has been caused by out-of-date legislation, media, and organizations misdirected policies. In return, this has led to vulnerabilities and weaknesses remaining exposed and leading to exploitation and breaches by cybercriminals aka criminal hackers, and ethical hackers being mistreated, outcasted, and sometimes even prosecuted.

We believe it is time for us to come together to show support for ethical hackers and push for positive changes.

We ask for organizations to implement policies that clearly define scope, what kind, if any, rewards, contact information, communicate updates on the submission, and the extension of bi-lateral trust to include non-retribution.*

We ask for politicians to get to know ethical hackers instead of seeing them as cybercriminals, and support them by pushing forward new legislation and protective additions to current legislations that won’t penalize them.

We ask for the media to stop portraying ethical hackers as malicious actors and change the imagery.  When reporting a malicious act of hacking, please refer to them as cybercriminals, not hackers.** 

We ask the hacker community to stay within scope and not exploit. When trust is broken with one of us, it breaks the trust with all of us.

*Further details, please visit disclose.io for suggestions on how to create or improve your vulnerability disclosure program/responsible disclosure program. 

**Hackers do not always wear a black hoodie; they certainly don’t wear a cut out ski mask when hacking.