Tesla Inc have added some new guidelines to the bug bounty programs that will help researchers to discover security bugs in the Tesla’s software. The company are now actually allowing researchers to hack a non-running Tesla car without the fear of voiding the warranty or incurring any legal liabilities.
What are the rules the Security Researcher has to follow?
Although there are some additional rules, for example the security expert and the vehicle must be registered and approved for carrying out such security tests as the part of the company’s vulnerability reporting program and their effort must be in a good faith. Tesla are even offering the over the air assistance to the Researchers who need their car updated.
The company has explicitly said that its goodwill should not be taken advantage of, researchers should not expect the company to cover any out-of-pocket expenses such as towing the vehicle to the nearest service centre.
Who are safe from the Legal Issues?
All researchers and cars that have been approved in the vulnerability report program are safe from any charges under the Computer Fraud and Abuse Act (CFAA), as for the Digital Millenium Copyright Act (DMCA) the company will not bring any copyright charges against the pre-approved researchers that play with the car’s security mechanisms.