lx Mozilla, “Safe Harbor for Security Bug Bounty Participants”; Microsoft, “Microsoft Bounty Legal Safe Harbor” lxi Singapore GovTech (2019) “Third Government Bug Bounty Programme offers bonus payouts for mobile applications”; Government of the Netherlands, “Responsible disclosure” lxii Human Cost Report, pp. 9 and 33-34. lxiii https://www.asd.gov.au/publications/Responsible-Release-Principles-for-Cyber-Security-Vulnerabilities lxiv https://cyberstability.org/norms/#toggle-id-5 lxv https://www.cyber.gov.au/tags/security-vulnerability lxvi https://english.ncsc.nl/publications/publications/2019/juni/01/coordinated-vulnerability-disclosure-the-guideline lxvii https://hackerone.com/ncsc_uk lxviii https://www.csa.gov.sg/news/press-releases/second-government-bug-bounty-programme-expanded-to-cover-more-systems-and-digital-services lxix https://support.kaspersky.com/general/vulnerability lxx https://www.ceps.eu/ceps-publications/software-vulnerability-disclosure-europe-technology-policies-and-legal-challenges/ lxxi https://www.kaspersky.com/blog/kaspersky-joins-disclose-io/27588/ lxxii https://www.gchq.gov.uk/information/equities-process lxxiii https://www.whitehouse.gov/sites/whitehouse.gov/files/images/External%20-%20Unclassified%20VEP%20Charter%20FINAL.PDF lxxiv https://cybertechaccord.org/vulnerability-disclosure-policies/ lxxv https://www.intgovforum.org/multilingual/content/igf-2017-day-3-room-xi-ws38-international-cooperation-between-certs-ws38-technicaldiplomacy lxxvi Association of Progressive Communications and Global Partners Digital, Unpacking the GGE’s framework on responsible state behaviour: Cyber norms lxxvii FIRST, 2019, “Position paper by the Forum of Incident Response and Security Teams on cybersecurity developments within the UN context” @DFAT DFAT.GOV.AU