The CSDD Security Research Case: What It Actually Says About Vulnerability Disclosure in Latvia

For several years, it was incorrect to describe the CSDD matter as a completed case.

That changed in September 2026.

On 3 September 2026, the Criminal Cases Department of the Senate declined to initiate cassation proceedings. The judgment of the Vidzeme Regional Court of 24 February 2026 therefore entered into force.34

According to the official prosecution service's public explanation, the court imposed a fine equal to six statutory minimum monthly salaries — EUR 4,680 — with the final amount reduced to EUR 4,290 after credit for time spent in detention.4

A separate event followed.

On 15 September, the President of Latvia's office announced that one convicted person considered in the clemency process had been fully released from serving the principal punishment and had the conviction removed.5 Latvian public-service media identified that person the following day as Raimonds Skuruls and reported the President's stated policy rationale: the lawfulness of the court judgment was not questioned, while the public interest in cybersecurity and the encouragement of good-faith vulnerability disclosure were taken into account.6

These are different legal acts.

The conviction became final. Clemency followed.

Clemency is not an acquittal and does not transform the criminal judgment into a finding that the conduct was lawful.

The case moved through several contradictory outcomes before becoming final.

The procedural history is itself a warning against extracting broad legal rules from one intermediate judgment.

At different times the defendant had been convicted, acquitted, remitted twice by the Senate and finally convicted again.

The 2025 Senate decision provides one of the most useful technical/legal distinctions in the entire case.

The Senate referred to the earlier appellate finding that the defendant had not created the CSDD vulnerability but had discovered it. The underlying responsibility for maintaining system security and remediating the flaw belonged to CSDD.2

That did not immunise every subsequent act by the discoverer.

A person who finds a vulnerability can still create independent harm by, for example:

• altering data;
• disrupting service;
• collecting unnecessary personal data;
• selling sensitive information;
• publishing before remediation;
• or committing another offence unrelated to the existence of the original bug.

The important analytical separation is:

The same applies to costs.

A system owner may already have a duty to maintain and repair its system. That does not mean researcher-caused losses can never be recovered. It means causation has to be demonstrated rather than assumed.

Security professionals are routinely paid for vulnerabilities.

The existence of money is not what distinguishes a bug bounty from criminal conduct.

In a mature bug-bounty programme, the commercial rules generally exist before the finding:

• the organisation publishes a programme;
• assets and methods are scoped;
• prohibited conduct is defined;
• reward rules are defined;
• the organisation invites reports under those conditions.

That is very different from discovering a vulnerability first and then making disclosure or non-publication conditional on a payment that the system owner never agreed to.

The final public explanation of the CSDD case focused on the combination of the EUR 1,000 demand and the threatened disclosure to the media if payment was not made.4

The case should not be converted into the rule:

asking for money for a vulnerability is extortion.

Latvian Criminal Law Section 183 has specific elements, including an unlawful demand for property or a property-related act combined with one of the forms of threat defined by the provision.7

The operational lesson for researchers is narrower:

If there is no pre-existing bounty, contract or other clear entitlement to payment, do not use continued secrecy about a vulnerability as leverage for payment.

Publication can be a legitimate part of vulnerability disclosure.

A normal coordinated process may lead to publication after:

• initial notification;
• technical validation;
• remediation;
• an agreed or reasonable disclosure window;
• CSIRT coordination;
• user-protection measures.

The role of disclosure is to improve security and inform affected parties.

That is different from:

Pay me or I will publish.

The CSDD case is therefore useful for separating two concepts that are sometimes blurred in informal security discussions:

a disclosure timeline and a publication threat used as economic leverage.

They are not the same operational act.

The final publicly identified offence was extortion under Section 183 of the Latvian Criminal Law.47

The case therefore does not, by itself, answer the broader questions that security researchers often want answered:

• When exactly does vulnerability validation become unauthorised access?
• How much testing is proportionate?
• What is the minimum sufficient proof of concept?
• What legal effect does a public VDP have?
• What protection exists for a good-faith independent researcher?

Those questions remain separate.

For the authorisation problem, see Good-Faith Security Research in Europe: Where Is the Authorization Boundary?.

For the distinction between CVD, bug bounty and contracted testing, see CVD, Bug Bounty and Penetration Testing Are Not the Same Thing.

The original events occurred in 2018.

Latvia's current vulnerability-disclosure framework is different.

Section 39 of the National Cybersecurity Law now establishes a coordinated vulnerability-disclosure process under which a person who identifies a vulnerability in the information system or electronic communications network of an entity within scope submits a vulnerability report to the competent cyber-incident prevention institution. The law specifies information to include and a subsequent coordination process.8

That is a much clearer reporting route than the one visible in the 2018 narrative.

It still should not be overread.

A reporting process does not automatically resolve every question about:

• authorisation for the initial testing;
• proportionality of methods;
• processing of personal data;
• payment rights;
• or liability for separate unlawful conduct.

CVD is not universal immunity.

The CSDD conviction is equally not a universal prohibition on vulnerability reporting.

There is no public dataset demonstrating that the CSDD prosecution caused a measurable decline in vulnerability reports in Latvia.

It would therefore be too strong to present chilling effect as an established empirical result.

It is better treated as a policy risk.

The case clearly entered that policy debate.

On 3 September 2026, the CSDD case was explicitly invoked during a Saeima debate concerning proposed criminal-law protection for certain good-faith vulnerability disclosure activity.9

The later clemency rationale reported by Latvian public-service media likewise referred to the public interest in cybersecurity and in encouraging good-faith vulnerability disclosure.6

Those are political and executive assessments, not holdings of the criminal courts.

They nevertheless show that the case acquired significance beyond one prosecution.

Use the clearest reporting route available

If an organisation has a VDP, bug bounty programme or national CVD route, use it.

Do not assume a general call centre or an arbitrary employee will know how to receive a security report.

Preserve the timeline

Record:

• when the issue was observed;
• what you actually tested;
• when testing stopped;
• who was notified;
• what evidence was sent;
• what was requested in return.

A clean chronology is useful for technical triage and later legal reconstruction.

Do not turn the vulnerability into payment leverage

If a programme promises a reward, follow its terms.

If no reward programme exists, a researcher may offer professional services or discuss further authorised work. That is different from making non-disclosure conditional on payment or threatening harm to obtain payment.

Treat publication as a coordination decision

If the owner does not respond, there may be legitimate escalation routes.

Those can include:

• the competent CSIRT;
• a programme escalation channel;
• the product vendor;
• the organisation's security function;
• a coordinated disclosure process.

“Owner did not answer” does not automatically imply “publish immediately”.

Prove the minimum

Technical ability to access more data is not a reason to access more data.

For the privacy boundary, see When Vulnerability Research Exposes Personal Data.

The CSDD case is not only a lesson for researchers.

If an organisation has no usable security-reporting intake, the reporting path can look like:

That is an avoidable security-control failure even if the reporter later acts improperly.

A system owner should define in advance:

• one discoverable security-reporting channel;
• acknowledgement expectations;
• an accountable technical owner;
• authority for further testing;
• evidence-handling rules;
• reward policy, if any;
• disclosure coordination;
• remediation and closure.

The goal is not to guarantee that every reporter behaves well.

It is to remove unnecessary ambiguity before a real vulnerability appears.

An organisation does not have to operate a bounty programme.

It should still make its position clear.

Either:

A. no financial reward is offered; or B. rewards may be paid under published conditions.

The worst state is unmanaged ambiguity:

• the researcher expects payment;
• the owner expects free disclosure;
• there are no agreed terms;
• negotiation begins only after sensitive information exists.

One advantage of bug-bounty programmes is not simply the reward.

They pre-negotiate the protocol of the relationship.

The CSDD case should not become a slogan for either side.

It does not establish:

“Latvia criminalises vulnerability reporting.”

It does not establish:

“Calling yourself a security researcher makes any payment demand legitimate.”

It does not establish:

“Presidential clemency means the court was wrong.”

It does not establish:

“The conviction proves independent security research is unlawful.”

The source record supports a narrower and more useful conclusion:

vulnerability discovery, vulnerability reporting, payment negotiation, publication and threatening conduct are separate acts and should be treated as such.

Security policy is stronger when those distinctions are designed into the process before a dispute occurs.

For the researcher:

For the system owner:

This is not a restatement of Latvian criminal law.

It is an operational design intended to keep a technical security problem from becoming an improvised dispute about authority, money and publication.

The CSDD case does not provide a simple answer to the question:

Is good-faith hacking legal in Latvia?

That is not what the final case decided.

The earlier Senate proceedings distinguished discovery of a pre-existing vulnerability from creation of that vulnerability and from the system owner's own security obligations.2

The final criminal outcome concerned extortion, with the public case explanation focusing on a property demand coupled with a threat to disclose the vulnerability to the media.4

The later presidential clemency did not reverse that legal judgment. It added a separate policy signal about the public interest in encouraging good-faith vulnerability disclosure.56

The most constructive legacy of the case would therefore be procedural:

Researchers should not have to improvise where to report.

System owners should not have to improvise how to receive the report.

Reward rules should not first appear after the vulnerability has become leverage.

And neither side should need to use the vulnerability itself as a bargaining hostage.

Legal status checked on 25 September 2026. Earlier working materials for this case correctly treated it as unfinished after SKK-64/2025; that status is now superseded by the final September 2026 outcome. This article distinguishes court findings, the prosecution service's public explanation, publicly reported objections by the convicted person and later political/executive assessments.

This article analyses case law, security-research process and vulnerability-disclosure policy. It is not individual legal advice.