Criteria used in the Scottish Government’s vulnerability disclosure policy: FOI release

Information requested

What criteria is used to determine “good faith” security research, as outlined in the Scottish Government’s Vulnerability Disclosure Policy.

Response

The answer to your question is, in the context of the Vulnerability Disclosure Policy, ‘good faith’ is assessed by the ethics shown by the researcher in respect of actions carried out to probe vulnerabilities. Specifically the intent to disclose the vulnerability to the Scottish Government as soon as possible, and not to disclose it elsewhere or exploit it in any way.

About FOI
The Scottish Government is committed to publishing all information released in response to Freedom of Information requests. View all FOI responses at http://www.gov.scot/foi-responses.