Code of Conduct

All CSIRT.global volunteers adhere to our Code of Conduct:

1. CSIRT.global is a global Computer Security Incident Response Team. We are led by volunteers, and work with volunteers who aim to make the digital world safer.
2. CSIRT.global aims to disclose vulnerabilities and report findings to those who can fix them.
3. CSIRT.global performs the last steps in an extensive process, performed by associated organisations, individual researchers and third parties. We are aware of the importance of these last steps and take the CSIRT process very seriously.
4. CSIRT.global uses information provided by third parties. We are aware this information is generated by activities such as:
   • Scanning the internet for vulnerabilities, mostly Common Vulnerabilities and Exposures (CVEs), and reporting our findings and possible solutions to the owners of these systems.
   • Analysing online systems for new vulnerabilities (zero-days), reporting our findings to the makers, and try to help them in fixing the vulnerabilities.
   • Analysing databases with leaked credentials and reporting to the organisations or people who are compromised to take appropriate measures.
5. As we work with sensitive data, gathered without informed consent, we established this Code of Conduct to provide an ethical base for the work we do.
6. While performing incident responses, we aim to work both with trusted partners to extend our reach, as well as notifying as many individual organisations and people as possible.
7. We are aware that we work with information acquired by operating at the edges of what is legally allowed, so we proceed by these three criteria commonly used in court cases on vulnerability disclosures:
   • Societal need: we do vulnerability disclosure to prevent online damage to as many internet users as possible and don’t serve any particular financial, political or individual interests.
   • Principle of Proportionality: we serve this need with appropriate means. Our research should increase and not decrease the integrity and availability of online systems.
   • Principle of Subsidiarity: if several means are available to meet the need, we opt for the one which has the least impact.
8. We trust third party findings when we can, but validate findings when needed. We aim to prevent reporting false positives or miss false negatives and sometimes need to verify if a vulnerability is actually present. We use custom-made scripts based on publicly available proof of concepts or non-weaponized exploit code and take good care that we don’t damage systems, download too much personal data, or create backdoors.
9. Our findings typically consist of lists with several to millions of IP addresses, the type of vulnerability found, contact information, and metadata (e.g. timestamps, scripts, researchers working on the data). This is sensitive data, so we take all precautions necessary to protect the confidentiality of this data.
10. We disclose zero-day vulnerabilities to the vendor first, then request CVE numbers and negotiate a reasonable time span for disclosing it to our Trusted Information Sharing Partners and the broader public. Ideally, the disclosure is preceded by a patch. If a vendor is obviously slow in providing the patch and it is likely others may discover and abuse the vulnerability, we may consider disclosure to warn potential victims and advise them on mitigation measures.
11. We report the CVEs we find to the owners of the systems, mostly by generating email addresses based on their domain name, such as info@, security@ or abuse@ and to the listed abuse addresses of IP owners. If owners can’t be found in automated ways, we may search for them by leveraging (open) sources.
12. We may also send them our findings through our Trusted Information Sharing Partners, who are, for example, Computer Emergency Response Teams, Computer Security Incident Response Teams, Internet Service Providers, governmental organisations or other research institutes.
13. While doing our work, we focus on our mission of making the internet and the connected world more secure. We don’t serve the needs of governments, law enforcement, enterprise organisations, individuals or anyone else.
14. Due diligence in our CSIRT process requires following our disclosures up. Therefore, we need to store data and log our activities. We may also need this data in case of a dispute. We minimize the amount of personal data we gather and store and are aware that an IP address can also be perceived as information relating to an identified or identifiable natural person. We believe that our processing of this data is proportional to our goals of making the internet and the connected world more secure.
15. Depending on the incident, we might inform the broader security community and/or the media about our findings. We only use aggregated statistics and/or trend information. We don’t use personal identifiable information (PII).
16. Any reporting we do, is available from our website https://csirt.global.
17. Our reports are available under the Creative Commons License.
18. We report vulnerable systems. While we might channel 3rd party remediation information on a best-effort base, remediation is solely the responsibility of the systems owner.
19. CSIRT.global is responsible for making members aware of these rules. It is the responsibility of each member to comply. If they don’t, the board will take appropriate measures, for instance by revoking their account.
20. We are aware of geographical differences, with regard to culture, law and customs. We provide escalation paths, if conflicts arise due to the differences in multiple geographical regions we operate in. Members are encouraged to use these.
21. On an interpersonal level, we are an open, welcoming, learning and teaching organisation. We believe in diversity.
22. We encourage members to challenge other members’ behaviour if they feel it’s not appropriate, whilst also providing escalation paths for those that choose not to address issues directly. We understand there might be very good reasons for not addressing issues directly.
23. Suggestions and feedback are welcome. Contact our Secretary Vincent Thiele.