This study's objective is to determine the contribution which law can make to information security in the internet. At this, this work focuses on how law should define as well the legally required and the permitted behaviour in the context of disclosures of security vulnerabilities and breaches in the internet. In fact, the underlying assumption of this work is that the level of security may be increased by disclosing security vulnerabilities and breaches in the internet. It is examined in a legal approach to which extent the right to inform and the duty to inform can be constituted and by what they can be influenced and confined. At first, the author comments on whether the right and the duty to inform are appropriate governing tools in the context of the internet, i.e. whether law can contribute at all to the compensation of information asymmetries in the internet. To answer the question how such a contribution can be made, it is necessary to analyse the actors of the internet, since they decisively determine the practice of how information about security vulnerabilities and breaches in the internet is handled. This work shows in a general approach the scope and range of the right to inform and the duty to inform. However, the scope of the right to inform and the duty to inform need to be determined on a case-by-case basis. Finally, in an outlook, these characteristics are highlights which may constitute the most promising approaches on how to meet the challenges of cyberlaw in the future are identified.