{{+bindTo:partials.standard_nacl_article}}
NOTE:
Deprecation of the technologies described here has been announced
for platforms other than ChromeOS.
Please visit our
migration guide
for details.
NO PURCHASE NECESSARY TO ENTER OR WIN. VOID WHERE PROHIBITED. CONTEST IS OPEN TO RESIDENTS OF THE 50 UNITED STATES, THE DISTRICT OF COLUMBIA AND WORLDWIDE, EXCEPT FOR ITALY, BRAZIL, QUEBEC, CUBA, IRAN, SYRIA, NORTH KOREA, SUDAN AND MYANMAR.
ENTRY IN THIS CONTEST CONSTITUTES YOUR ACCEPTANCE OF THESE TERMS AND CONDITIONS.
Binding Agreement
In order to enter the Native Client Security Contest (“Contest”), you must agree to these Terms and Conditions (“Terms”). Therefore, please read these Terms prior to entry to ensure you understand and agree. You agree that submission of an entry in the Contest constitutes your agreement to these Terms. After reading the Terms and in order to participate, each Participant (as defined below) must complete the registration form, clicking the “I understand and agree” box (or the equivalent), on the Contest entry webpage. Once the Participant clicks the “I understand and agree” box (or the equivalent), the Terms form a binding legal agreement between each Participant and Google with respect to the Contest.
Participants may not submit an Exploit, Issue or Summary to the Contest and are not eligible to receive the prizes described in these Terms unless they agree to these Terms. If a Participant is part of a team, each member of the team must read and agree to these Terms and click on the “I understand and agree” box (or the equivalent) described herein. Failure of any member of a team to agree to these Terms and click on the “I understand and agree” box (or the equivalent) described herein will disqualify the entire team.
By entering, Participant warrants that Participant has not violated any employment agreement or other restriction imposed by their employer by participating in this Contest.
Description
The Contest is organized by Google and is designed to motivate the developer community to identify and report security Exploits (as defined below) on Google’s Native Client software and reward those developers who identify one or more security Exploits that are evaluated as a winning exploit by the Judges.
Once a Participant has registered for the Contest, the Participant will be asked to identify security Exploits in Google’s Native Client Software and enter those Exploits on Google’s Native Client Issue Tracker website using the “Security Contest Template.” At this point, the Exploit will become an Issue and will no longer be able to be identified by another Participant. Google will then verify that the Issue is reproducible. If so, that Issue will become a Verified Issue. Finally, the Participant will submit a Summary of up to their top ten best Issues that were submitted on the Native Client Issue Tracker. Since it is possible that an Issue may not be verified until after the Contest End Date, if a Participant includes such an Issue in their Summary and such Issue is not ultimately verified, then that Issue will not be considered to be part of the Summary.
Prizes will be awarded to those Participants who submit the best Summaries as determined in the sole discretion of the Judges when considering the Judging Criteria described herein.
Sponsor
The Contest is sponsored by Google Inc. (“Google” or “Sponsor”), a Delaware corporation with its principal place of business at 1600 Amphitheater Parkway, Mountain View, CA, 94043, USA.
Term
The Contest begins at 9:00:00 A.M. Pacific Time (PT) Zone in the United States on Februrary 25th, 2009 (“Contest Start Date”) and ends at 11:59:59 P.M. PT on May 5th, 2009 (“Contest End Date”). Participants must register by May 5th, 2009 at 11:59:59 Pacific Time to be eligible to participate. ENTRANTS ARE RESPONSIBLE FOR DETERMINING THE CORRESPONDING TIME ZONE IN THEIR RESPECTIVE JURISDICTIONS.
Definitions
Throughout these Terms, Google will use the following defined terms and words. Please review them carefully to ensure you understand.
Eligibility
The Contest is open to Participants who (1) have agreed to these Terms; (2) who are of or above the legal age of majority, at the time of entry, to form valid contracts in their respective country, province or state of legal residence (and at least the age of 20 in Taiwan); (3) are not residents of Italy, Brazil, Quebec, Cuba, Iran, Syria, North Korea, Sudan, or Myanmar; and (4) who have software development experience. Sponsor reserves the right to verify eligibility and to adjudicate on any dispute at any time. The Contest is void in, and not open to residents of, Italy, Brazil, Quebec, Cuba, Iran, Syria, North Korea, Sudan, Myanmar, or to individuals and entities restricted by U.S. export controls and sanctions, and is void in any other nation, state, or province where prohibited or restricted by U.S. or local law.
Employees and contractors of Google, affiliates and subsidiaries of Google, the Judges and members of their immediate families (defined as parents, children, siblings and spouse, regardless of where they reside and/or those living in the same household of each) are not eligible to participate in the Contest. Judges may not help any Participant with their submissions and Judges must recuse themselves in cases where they have a conflict of interest that becomes known to the Judge.
Registration & Entry Process
All Participants must register at code.google.com/contests/nativeclient-security/ by May 5th, 2009 at 11:59:59 Pacific Time. All individuals participating in the Contest (either as an individual Participant or as a member of a team) must provide the following registration information:
Failure to fully, completely and accurately provide this information will disqualify the Entry.
Any potential prize recipient may be required to show proof of being the authorized account holder for an email address. The “Authorized Account Holder” is the natural person assigned to an email address by the relevant provider of email services.
Participants that are teams must provide the above registration information for every individual who is a member of the team. Every individual who is part of the team must agree to the Terms in order for the team to be eligible to participate by clicking the “I understand and agree” box (or the equivalent) on the Contest entry webpage. Members of a team will be able to edit the information relating to the team only until the last member of the team has accepted these Terms by clicking the “I understand and agree” box (or the equivalent) on the Contest entry webpage. Issues submitted by members of a team prior to the time that all individual members of the team have clicked the “I understand and agree” box (or the equivalent) will not be valid Issue submissions and will not be eligible entries in the Contest. Google will send an email to all members of the team when the final team member has accepted the terms, however Google will have no liability for failure to send such an email or for the failure of any team member to receive the email.
Issues submitted by Participants who are individuals prior to the time that the individual has clicked the “I understand and agree” box (or the equivalent) will not be valid Issue submissions and will not be eligible entries in the Contest. Google will send an email to the individual when the individual has accepted the terms, however Google will have no liability for failure to send such an email or for the failure of any team member to receive the email.
All entries become the property of Sponsor and will not be acknowledged or returned. Entries are void if they are in whole or part illegible, incomplete, damaged, altered, counterfeit, obtained through fraud, or late.
LIMIT ONE ENTRY PER PERSON. Individuals may only enter one time, whether as an individual Participant or as a team Participant. Google, in its sole discretion, may disqualify any Participant (including team Participants) that it believes has violated this provision.
Submission Process
Issues
Summary
Judging
After the Contest End Date and on or about May 15th, 2009, all submitted Summaries will be judged by one of at least three panels with a minimum of three experts in the field of online security (“Judges”) on each panel. Judges will evaluate each Summary in accordance with the Judging Criteria described below. Each panel will evaluate a number of the submitted Summaries using the Judging Criteria described below and will select the highest ranking Summaries to move to the next level of judging. During the first round of judging, each panel will select no more than ten Summaries to move forward to the second round of judging unless there is a tie between or among any Participants. During the second round of judging, those Summaries selected during the first round of judging will then be evaluated by all Judges using the below Judging Criteria and the top five Summaries will be selected as potential winners. All decisions of the Judges are final and binding.
Judging Criteria. The Judges will consider each Summary under following judging criteria (“Judging Criteria”):
Quality of Exploit. Quality will be decided by the Judges in their sole discretion and will be based on (in order of importance to the Judges) Severity, Scope, Reliability and Style.
Severity: the more disruptive the effects of the Exploit, the higher its quality. Here is a non-exhaustive ranking of the most common Exploits starting from ‘minor’ to ‘severe’:
Browser crash;
Denial of service or machine crash;
Compromise of the Outer Sandbox;
Information leak (such as of a cookie or password);
Compromise of both the Inner and Outer Sandbox; and/or
Prohibited side effect (such as reading or writing files to the client machine), escalation of privilege (such as executing other programs outside of Native Client).
Any Exploit that does not address the above elements will be evaluated on a case-by-case basis and the severity of such Exploits will be determined solely at the Judge’s discretion.
Scope: the more computers that an Exploit would potentially affect, the bigger its scope and therefore higher the quality of the Exploit. Consider the following:
Exploits that affect all platforms supported by Native Client (where platform is defined as a browser, operating system and hardware combination) have higher quality than an Exploit specific to a particular platform.
Exploits that require non-current or beta versions (historic or future) of hardware or software are lower quality.
Exploits that rely on concurrent usage of other installed software or web content must make a compelling case about the likelihood of the prerequisite software or content being present, or they will be considered of lower quality.
Reliability: The more frequent or probable the occurrence identified by the Exploit, the more “reliable” it may be. Consider the following:
Exploits that require uncommon software to be installed on the machine in order to function will be deemed to have lower quality.
Entries that include Exploits that cannot be reproduced 100% of the time, but which can be reproduced a significant percentage of the time, will be deemed to have a lower quality to account for a lowered probability that the attack will succeed.
Style: Submissions that demonstrate exceptional style will receive a higher ranking. Factors that contribute to style include:
Ingenuity in mechanism used to bypass security;
Uniqueness of the Exploit;
Ingenuity in methods used to discover vulnerabilities; and/or Minimal size of Exploit to achieve the effect.
the Quantity of Exploits: Participants that submit more Exploits in their Summary (but no more than 10) may receive a higher ranking, weighted by quality. However, it is still possible that a Participant who submits one Exploit could still outweigh a Participant that submits several Exploits.
Considering each of the factors described above, the Judges will give each Summary a “Score” from 1-10 that represents the Judges evaluation of the Summary. This “score” will determine which participants move from the first round of judging to the second round of judging, and which participants will be selected as a winner.
Winner Selection
Judges will review the Summaries as discussed in the “Judging” section, above. The Summaries with the five (5) highest scores will be selected as potentially winning Participants. In the event of a tie ranking for two or more Summaries, the Participant whose Summary had the highest ranking for “Severity” will receive the higher prize. In the event of a second tie, the Participant whose Summary had the highest ranking for “Scope” will receive the higher prize. Odds of winning depend on the number of eligible entries received and the skill of the Participants.
The Judges are under no obligation to provide feedback on their decisions or on their judgment on specific Exploits they consider.
Team Winners
A special note about the prize distribution process for Participants who are entering as part of a team:
A single member of each team shall be designated to receive the prize, if any, awarded to such team at the initial registration of the team, and Google shall have no responsibility for distribution of the prize among the team members.
Each individual that enters as part of a team, understands and agrees that if their team is selected to receive a prize, the team is responsible for ensuring the funds are appropriately distributed to each member of the team. In addition, once a team has registered, the team may not add, remove, or substitute any members or otherwise change the composition of the team for the duration of the Contest. If any member of a team does not comply with these Terms, is ineligible or is disqualified, the team as a whole may be disqualified in Google’s sole discretion.
Prizes
Information Required for Eligibility
Prize Amounts and Announcement
Provided that the Participant has complied with these Terms, eligible Participants that are ranked in the top 5 positions of the competition by Judges will receive the following awards in U.S. Dollars based on their rank: 1st prize: $8,192.00, 2nd prize: $4,096.00, 3rd prize: $2,048.00, 4th prize: $1,024.00, 5th prize: $1,024.00. Winning Entries will be announced on or about December 7th.
Distribution of a Prize
Google is not responsible for any division or distribution of the prizes among or between team members. Distribution or division of the prize among individual team members is the sole responsibility of the participating team. Google will award the prize only to the one (1) member of the team, who was identified by the Participant to receive the prize as part of the registration process. Google will attempt to reach only the designated recipient for purposes of distribution of the prize.
Prizes are awarded without warranty of any kind from Google, express or implied, without limitation, except where this would be contrary to federal, state, provincial, or local laws or regulations. All federal, state, provincial and local laws and regulations apply.
Taxes
Payments to potential prize winners are subject to the express requirement that they submit to Google all documentation requested by Google to permit it to comply with all applicable US, state, local and foreign (including provincial) tax reporting and withholding requirements. All prizes will be net of any taxes Google is required by law to withhold. All taxes imposed on the prize are the sole responsibility of the prize recipient.
In order to receive a prize, potential prize recipients must submit the tax documentation requested by Google or otherwise required by applicable law, to Google or the relevant tax authority, all as determined by applicable law, including, where relevant, the law of the potential prize recipient’s country of residence. The potential prize recipient is responsible for ensuring that they comply with all the applicable tax laws and filing requirements. If a potential prize recipient fails to provide such documentation or comply with such laws, the prize may be forfeited and Google may, in its sole discretion, select an alternative potential prize recipient.
General Conditions
Right to Disqualify. A Participant may be prohibited from participating in or be disqualified from this Contest if, in Google’s sole discretion, it reasonably believes that the Participant or any member of a Participant team has attempted to undermine the legitimate operation of the Contest by cheating, deception, or other unfair playing practices or annoys, abuses, threatens or harasses any other Participants, Google, or the Judges. Google further reserves the right to disqualify any Issue that it believes in its sole and unfettered discretion infringes upon or violates the rights of any third party, otherwise does not comply with these Terms, or violates U.S. or applicable local law in Participant’s country of residence.
Google further reserves the right to disqualify any Participant who tampers with the submission process or any other part of the Contest. Any attempt by a Participant to deliberately damage any website or undermine the legitimate operation of the Contest is a violation of criminal and civil laws and should such an attempt be made, Google reserves the right to seek damages from any such Participant to the fullest extent of the applicable law.
Internet Disclaimer. Google is not responsible for any malfunction of the entire Contest, the website displaying the Contest terms and entry information, or any late, lost, damaged, misdirected, incomplete, illegible, undeliverable, or destroyed Exploits, Issues or Summaries due to system errors, failed, incomplete or garbled computer or other telecommunication transmission malfunctions, hardware or software failures of any kind, lost or unavailable network connections, typographical or system/human errors and failures, technical malfunction(s) of any telephone network or lines, cable connections, satellite transmissions, servers or providers, or computer equipment, traffic congestion on the Internet or at the website displaying the Contest or any combination thereof, including other telecommunication, cable, digital or satellite malfunctions which may limit an entrant’s ability to participate. Google is not responsible for availability of the Native Client Issue Tracker from your preferred point of Internet access. In the event of a technical disruption, Google may, in its sole discretion, extend the Contest End Date for a reasonable period. Google will attempt to notify Participants of any such extension by email at the email address in the registration information, but shall have no liability for any failure of such notification.
Exploits Independently Discovered by Google. You acknowledge and understand that Google may discover Exploits independently that may be similar to or identical to your Issues in terms of function, vulnerability, or in other respects. You agree that you will not be entitled to any rights in, or compensation in connection with, any such similar or identical applications and/or ideas. You acknowledge that you have submitted your entry voluntarily and not in confidence or in trust.
No Contract for Employment. You acknowledge that no confidential, fiduciary, agency or other relationship or implied-in-fact contract now exists between you and Google and that no such relationship is established by your submission of an entry to Google in this Contest. Under no circumstances shall the submission of an entry in the Contest, the awarding of a prize, or anything in these Terms be construed as an offer or contract of employment with Google.
Intellectual Property Rights and License. Participants warrant that their Exploit and Summary are their own original work and, as such, they are the sole and exclusive owner and rights holder of the submitted Exploit and Summary and that they have the right to submit the Exploit and Summary in the Contest and grant all required licenses. Each Participant agrees not to submit any Exploit and Summary that (a) infringes any third party proprietary rights, intellectual property rights, industrial property rights, personal or moral rights or any other rights, including without limitation, copyright, trademark, patent, trade secret, privacy, publicity or confidentiality obligations; or (b) otherwise violates the applicable state, federal, provincial or local law.
As between Google and the Participant, the Participant retains ownership of all intellectual and industrial property rights in and to the Issues and Summary that Participant created. As a condition of entry, Participant grants Google a perpetual, irrevocable, worldwide, royalty-free, and non-exclusive license to use, reproduce, publicly perform, publicly display, distribute, sublicense and create a derivative work from, any Issue or Summary that Participant submits to this Contest for the purposes of allowing Google to test, evaluate and fix or remedy the Issue and Summary for purposes of the Contest and modifying or improving the Native Client software or any other current or future Google product or service.
Participant also grants Google the right to reproduce and distribute the Issue and the Summary. In addition, Participant specifically agrees that Google shall have the right to use, reproduce, publicly perform, and publicly display the Issue and Summary in connection with the advertising and promotion of the Native Client software or any other current or future Google product or service via communication to the public or other groups, including, but not limited to, the right to make screenshots, animations and video clips available for promotional purposes.
Privacy. Participants agree that personal data provided to Google during the Contest, including name, mailing address, phone number, and email address may be processed, stored, and otherwise used for the purposes and within the context of the Contest. This data will be maintained in accordance with the Google Privacy Policy found at http://www.google.com/privacypolicy.html. This data will also be transferred into the United States. By entering, Participants agree to the transmission, processing, and storage of this personal data in the United States.
Participants also understand this data may be used by Google in order to verify a Participant’s identity, postal address and telephone number in the event a Participant qualifies for a prize. Participants have the right to access, review, rectify or cancel any personal data held by Google in connection with the Contest by writing to Google at the address listed below in the section entitled “Winner’s List.”
For residents of the European Union:
Pursuant to EU law pertaining to data collection and processing, you are informed that:
The data controller is Google and the data recipients are Google and its agents;
Your data is collected for purposes of administration of the Native Client Security Contest;
You have a right of access to and withdrawal of your personal data. You also have a right of opposition to the data collection, under certain circumstances. To exercise such right, You may write to: Native Client Security Contest, Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA.
Your personal data will be transferred to the U.S.
Indemnity. To the maximum extent permitted by law, each Participant indemnifies and agrees to keep indemnified Google and Judges at all times from and against any liability, claims, demands, losses, damages, costs and expenses resulting from any act, default or omission of the Participant and/or a breach of any warranty set forth herein. To the maximum extent permitted by law, each Participant agrees to defend, indemnify and hold harmless Google, its affiliates and their respective directors, officers, employees and agents from and against any and all claims, actions, suits or proceedings, as well as any and all losses, liabilities, damages, costs and expenses (including reasonable attorneys fees) arising out of or accruing from:
To the extent permitted by law, Participant agrees to hold Google, its respective directors, officers, employees and assigns harmless for any injury or damage caused or claimed to be caused by participation in the Contest and/or use or acceptance of any prize, except to the extent that any death or personal injury is caused by the negligence of Google.
Elimination. Any false information provided within the context of the Contest by any Participant including information concerning identity, mailing address, telephone number, email address, or ownership of right, or non-compliance with these Terms or the like may result in the immediate elimination of the Participant from the Contest. In the event an individual who is a member of a team supplies information that is covered by this section, the entire team shall be disqualified.
Right to Cancel. If for any reason the Contest is not capable of running as planned, including infection by computer virus, bugs, tampering, unauthorized intervention, fraud, technical failures, or any other causes which corrupt or affect the administration, security, fairness, integrity, or proper conduct of the Contest, Google reserves the right at its sole discretion to cancel, terminate, modify or suspend the Contest.
Forum and Recourse to Judicial Procedures. These Terms shall be governed by, subject to, and construed in accordance with the laws of the State of California, United States of America, excluding all conflict of law rules. If any provision(s) of these Terms are held to be invalid or unenforceable, all remaining provisions hereof will remain in full force and effect. To the extent permitted by law, the rights to litigate, seek injunctive relief or make any other recourse to judicial or any other procedure in case of disputes or claims resulting from or in connection with this Contest are hereby excluded, and all Participants expressly waive any and all such rights.
Arbitration. By entering the Contest, you agree that exclusive jurisdiction for any dispute, claim, or demand related in any way to the Contest will be decided by binding arbitration. All disputes between you and Google, of whatsoever kind or nature arising out of these Terms, shall be submitted to Judicial Arbitration and Mediation Services, Inc. (“JAMS”) for binding arbitration under its rules then in effect in the San Jose, California, USA area, before one arbitrator to be mutually agreed upon by both parties. The parties agree to share equally in the arbitration costs incurred.
Winner List
You may request a list of winners after December 7th, 2009 by writing to:
(Residents of Vermont need not supply postage).