On the first episode of In Flux, we are joined by CIS veteran Karan Saini who talks us through his work as a security researcher. We then discuss the policy avenues for the government to engage more closely with security researchers to create a robust framework for disclosure and exploitation of vulnerabilities. How is a hacker different from a security researcher? What is the nature of offensive operations being undertaken by the government? How did Jeff Bezos’s phone get hacked, and should we be scared? Reading list: (1) https://cis-india.org/internet-governance/blog/improving-the-processes-for-disclosing-security-vulnerabilities-to-government-entities-in-india (2) https://www.thehindu.com/sci-tech/technology/should-the-jeff-bezos-phone-hack-be-cause-for-alarm/article30654906.ece