Is offering non-disclosure of a vulnerability in exchange for payment legal?
<p>If a person discovers a vulnerability similar in scope to the recently disclosed Spectre/Meltdown (CPU design flaws that affect nearly all existing server infrastructure), could they legally explain this vulnerability to the vendor and offer non-disclosure for a fee, in the realm of $100,000 per month of delayed publication?</p>

<p>Failure to pay only results in immediate publication of the vulnerability, which is in itself a legal activity.</p>

<p>Would this be construed as extortion?  The design flaw itself exists already, and information regarding it isn't withheld from the vender, they are paying solely for delayed disclosure to the public.</p>

<p>This is extortion, and thus generally illegal. Below is the California Penal code on the matter (as you did not specify a particular state). To paraphrase: "Extortion is the obtaining of property (i.e. money) from another...induced by a wrongful use of...fear, (which)...may be induced by a threat...[t]o expose any secret affecting him or them".</p>

<p>However, payment to disclose your solution to the vulnerability is legal.</p>

<p>CA PENAL CODE<br>
SECTION 518-527<br>
518.  Extortion is the obtaining of property from another, with his
consent, or the obtaining of an official act of a public officer,
induced by a wrongful use of force or fear, or under color of
official right.<br>
519.  Fear, such as will constitute extortion, may be induced by a
threat, either:<br>
   1. To do an unlawful injury to the person or property of the
individual threatened or of a third person; or,<br>
   2. To accuse the individual threatened, or any relative of his, or
member of his family, of any crime; or,<br>
   3. To expose, or to impute to him or them any deformity, disgrace
or crime; or,<br>
   4. To expose any secret affecting him or them.    </p>

<p>It largely depends on whether disclosure of the vulnerability would be legal, which will differ case by case and could be challenged in court either way.</p>

<p>The key word in the California Penal code bit quoted by @sharur is "<em>wrongful use</em>". The thing is, the use of fear to do what you are legally allowed cannot be considered "wrongful". A good analogy here would be a skilled/important employee "threatening" his employer to resign if they do not raise his pay. Therefore, if disclosing the vulnerability in public can be proved legal, then the offer in question is legal as well.</p>

united-states software