|
I know it's a big no-no in terms of etiquette, but is it illegal in Canada to perform penetration testing against a commercial company without authorization? P.S. My understanding is that he could probably be charged under a number of articles (most of which aren't specific to the IT realm). |
|||||||||||||
|
Questions on IT Security Stack Exchange are expected to relate to IT security within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.
|
Since we are not, and do not aim to provide, legal advice (since we're not lawyers) this is a really hard one to talk about. That being said, it is generally considered a good idea to obtain written permission from the organization, signed by someone within the organization who is authorized to sign such things, permitting you to perform any kind of scan or penetration test. Without that authorization there is a very fine line between "I was checking to see if the fix had been made without malicious intent" and "I was checking to see if the fix had been made with malicious intent". Within Canada the most likely relevant portions are going to be Section 184 and Section 342 of the Criminal Code of Canada. I won't attempt to interpret the contents, since quite frankly I'm scared of the potential of accidentally giving legal advice. The short of the matter is that whether or not the kid was criminally liable for what he did he was, in my opinion, a fool for not obtaining permission before conducting a vulnerability assessment/penetration test. |
|||
|
|
|
It would take a lawyer (or several) to give a true answer to your question, and I am not entitled to give legal advice in any way. However, in most countries, penetration testing without target consent tends to attract legal trouble, in the same way that going down the street and trying the clutch of all house doors to see which ones open is risky. Even in countries where trying the clutch would not be illegal (but only entering the house would be), you would have a hard time explaining to the cops and judges that your suspicious activity was not done with immediate malicious intent. To use an even more graphic (and approximate) analogy: if you rush towards another person (let's call him Bob) while brandishing a big knife, but a cop grabs you before the deed is accomplished, you might try to say to the judge: "But it is not proven that I was trying to kill Bob; I just wanted to see if it was possible to stab him, but I would of course have stopped right before piercing Bob's skin. The cop intervention was unnecessary.". My bet is that the judge won't be convinced. To sum up, law matters are intricate, but it does not take a lawyer to predict that penetration testing without target consent can end with you being prosecuted, with no surefire legal escape way. Whether this is good is another debate (extreme libertarians would claim that any open server is fair game for any kind of penetration testing, and even downright intrusion and data plunder). |
|||
|
|
|
You always require a written agreement from the target. In the UK penetration testing companies have lawyers and pre-determined agreements which are including the names, the IPs, the time (hours) of the target and some of them also include the types of tools that will be used. So, I'd state that even if I'm not a lawyer, you are likely to loose the case if you get caught and if the target didn't know what you where doing. There are many cases of people testing security and ending up in front of court, so I wouldn't recommend doing it anyway. One new example Student Expelled for Hacking After Investigating Security Hole However, some companies such as Facebook and Google have bounties to find bugs, so in this case it is legal to test the security and to look out for flaws such as XSS and SQLi. |
||||
|
|
