An analysis of Network Wars highlighted theabsence of specific protections for ethical hackers in Italy. The debate highlights a specific problem: encouraging the reporting of vulnerabilities does not resolve the issue of responsibility for the activities with which they are identified, with different positions on the weight to be attributed to good faith and the authorization of the system owner.
The limit is also reflected in the ACN annual reportavailable on the Senate website. The document specifies that the national coordinated vulnerability disclosure policy, developed within the framework of existing rules, does not regulate the protection of whistleblowers from civil and criminal liability. It also recalls the need for the research not to constitute a crime, citing the abusive access to IT systems provided for by article 615-ter of the Criminal Code.
The same report clarifies a delicate aspect of theanonymity. The reporter can request it, but the Agency can still process potentially identifying information, such as the IP address. The obligations to communicate to the competent authorities remain unaffected, for example in the event of a crime, albeit with measures to protect confidentiality. The possibility of not making one’s name public is therefore not equivalent to an exemption from liability.
The widespread fear is that this uncertainty could discourage reportingleaving unresolved vulnerabilities that could be fixed. In the comparison, there are those who insist on the need for the owner’s consent and distinguish authorized checks from access carried out independently, underlining the complexity in balancing the security of the systems and the protection of those who detect the flaws.
Coordinate a report and protect the researcher
The European framework considers both aspects. There NIS2 directive describes coordinated disclosure as a process that connects those who discover the problem with the affected manufacturer or supplier, agreeing on the timing of correction and publication. The operational objective is to allow the management of vulnerability through organized dialogue.
The directive also addresses researchers’ exposure to criminal and civil liability. Encourages Member States to adopt guidance on non-prosecution and exemption from civil liability for these activities, in compliance with national law. The European text therefore recognizes that organizing the passage of information does not exhaust the problem of protecting those who provide it.
For coordination, the directive provides a CSIRT intermediary between reporters and interested parties. The tasks described include contacting the parties, assisting the person reporting the flaw, and negotiating disclosure times. These are functions that concern the management of the technical problem and the relationships between the actors involved.
The request that emerged in the Italian discussion instead concerns one conditional legal protectionoften referred to as a “safe harbor”. Guarantees associated with requirements such as reporting to the competent body, absence of data theft and compliance with defined deadlines are proposed. It is a proposal expressed in the debate, which asks for the consequences of research carried out in good faith to be made predictable.
