Ran Bar-Zik reports what sounds like a situation where a cybersecurity student who engaged in responsible disclosure after finding a leak at the scholarship application website of the American joint Distribution Committee (“the Joint”) felt pressured and anxious by the joint trying to catch him to signalise a statement afterwards. And so far, he hasn’t signed it, it seems. Representatives of the joint emphasise that they had told him he could blue-pencil or amend the statement to pee it comfortable for him to sign: With regard to Shmuel Lenchner, he was contacted by phone and asked to delete the material and not to make employ of it. in addition, he was sent a draft of a statement that he would roleplay accordingly. he was explicitly informed and in writing that he could amend the text to the extent that he found it proper so that he would experience comfortable with the statement, but since then, his answer has not been received. Okay, but having been in that situation myself numerous times, i would point out that he is under no obligation to supply any signed statement for them at all, is there?� Is there some legal obligation in Israel? An ethical one? What?� Did the joint provide a drawing statement that explicitly waived any action against him? Without any assurance, why would he subscribe anything? DataBreaches has signed statements in some cases, and i know Jelle Ursem has also been asked to provide statements in some leaks we get reported together. I also know that i have not signed statements in some cases. This is where the approaching of the entity or their advocate really matters. Providing a argument helps an entity covering themselves for insurance or litigation purposes. But taking a threatening or heavy-handed approach to getting a statement, may not be� successful (the articulation says they told him he could edit it, but maybe even that wasn’t non-threatening enough?). Based on my experiences, which may not live valid for others, one of the more effective approaches was when counsel for i firm contacted me, didn’t come across as threatening any legal activity at all, and said they would be happy to provide me with a subscription to software that would ply military-grade destruction of any files of theirs that might be on my system.� i took them up on that offer after editing their potation argument a bit. as a result of how they handled it, they got a signed statement, their files were destroyed securely, and they got the story showing the secure destruction of files. And I wound up with a one-year subscription to a service to securely ruin files. And it was all very non-threatening. You can show the sequence and details of this Israelis incident at Haaretz. Maybe the joint could stress again. The student obviously didn’t engage in responsible revelation for a reward, but he sure as heck didn’t want to feel that he mightiness get into disoblige for doing the compensate thing on that.