Logbook

Unlawful government behaviour, corruption, data protection violations or security gaps in software - it is often individuals who draw attention to wrongdoing. Whistleblowers are therefore an essential part of modern whistleblowing. They can help authorities and the media to uncover unethical or illegal behaviour and highlight security gaps in companies. However, it is often the supposedly disruptive whistleblowers who are targeted rather than the wrongdoing. They are intimidated and harassed. At the same time, they find themselves in a legal field of tension, as their actions, although socially useful, can be prosecuted under certain circumstances. This harbours the risk of a considerable deterrent effect.

A central component of the technical system at DROPS is the incentive system for data submitters. This serves to provide data contributors with direct feedback as both feedback and reward. The decision was made not to follow the path of classic incentive systems (e.g. bug bounties for software or kickbacks for product recommendations), but to go our own way. In particular, because on the one hand there would be no means to pay data providers, such a payment could quickly create false incentives, and there is no way to verify leaked data. This last point is also the biggest difference to bug bounties for security vulnerabilities in software. With an appropriate description, these can be verified relatively easily by checking whether the described vulnerability actually exists and can be exploited. For leaked data, however, at most a superficial plausibility check is possible. Any further check would not only require the storage of clear data, but would also mean a great deal of personnel effort and, last but not least, increase the possibility of consequential damage, as clear data would not only have to be stored, but people would also have to access it to check it.

What is the issue?

The legal regulations governing the testing of technical systems for security vulnerabilities are of great importance for the work of security researchers, as these can potentially restrict their work or even result in severe personal consequences. This is specifically relevant for the DROPS project, as one objective is to protect whistleblowers and other potential data providers as well as possible, so that they are protected from prosecution by affected companies or law enforcement authorities.