At what point does "hacking" become illegal? (US)

Question

Hypothetical situation: before I hire a web development company I want to test their ability to design secure web apps by viewing their previous client's websites.

Issue: this situation raises a big red flag: with regards to viewing a website, what is and is not within the breadth of the law? Or in other words: at what point does poking around a website become illegal?

• View Source with Firebug? Naturally that would be legal.
• But what if I change HTML (like a hidden form value before submission)?
• Perhaps I then edit or remove JavaScript, like a client side validation script. Would that be legal?
• What if I put %3Cscript%3Ealert(1)%3C/script%3E at the end of the URL.
• Or perhaps I type the URL: example.com/scripts/ and I'm able to view their directory due to faulty permission settings?
• What if I manipulate data passed in HTTP headers, for instance a negative product qty/price to see if they do server side validation (naturally, I wont complete the checkout).

To me, all of this seems perfectly harmless because:

1. I'm not causing undue stress to their server by spamming, mirroring the site with wget, or injecting potentially dangerous SQL.
2. I'm not causing any potential loss or monetary damages, because I wont ever exploit the vulnerabilities, only test for their existence (proof of concept).
3. None of my actions will have any implication for user data privacy. In no way would any of my actions potentially reveal confidential or private information about anyone.
4. If I did find anything I would immediately notify the webmaster of the potential exploit so they could patch it.

But even though I am logically able to justify my reasons for testing the site, that does not necessarily make my actions legal. In fact, cyber laws are notoriously backwards in the United States, and even the most laughably trivial actions can be considered hacking.

Questions: Is there a defined line in the sand that separates illegal hacking from "testing without permission"? Or is this whole scenario a grey area that I should avoid (likely the case). Are there any linkable online resources that could expand my knowledge in this wholly grey area? What are the specific acts or laws that handle this?

Please keep in mind that the number one most logical choice would be to simply: ask for permissions. However, due to heavy time constraints, by the time I would get permission it would all be for naught.

Answer 1

Don't do it! Don't do it! If you are in the US, the law is very broad. You don't want to even tiptoe up to the line.

The relevant law is the Computer Fraud and Abuse Act (18 U.S.C. 1030). In a nutshell (and simplifying slightly), under the CFAA, it is a federal crime to "intentionally access a computer without authorization or exceed authorized access". This language is very broad, and I imagine an ambitious prosecutor could try to use it to go after everything on your list except #1 (view source).

Orin Kerr, one of the leading legal scholars in this area, calls the statue "vague" and "extraordinarily broad", and has said that "no one actually knows what it prohibits".

And, as @Robert David Graham explains, there have been cases where folks were prosecuted, threatened with prosecution, or sued for doing as little as typing a single-quote into a textbox, adding a ../ to a URL, or signing up to Facebook under a pseudonym. It's pretty wild that this alone constitutes a federal offense, even if there is no malicious intent. But that's the legal environment we live in.

I'd say, don't take chances. Get written authorization from the company whose websites you want to test.

Answer 2

The law is unclear. Anything you do, no matter how innocent, could be considered a crime. All the website owner has to do is say "I didn't want that to happen", and you could be convicted of a crime.

Before donating to a tsunami relief website, Daniel Cuthbert typed in ../../../ in the URL. He was convicted of "intent to hack" (in the UK).

Lori Drew was convicted of hacking MySpace, because she violated MySpace's terms-of-service by creating a fake account, that was later used by her 14 year old daughter to harass another girl, who later committed suicide. The convictions were overturned later, and the government decided not to appeal - but it's still an experience to avoid.

Andrew "weev" Auernheimer was found guilty of identity theft, because AT&T provided customer account info for early iPad owners on their website, and he wrote a script that just enumerated the URLs and download them.

Brian K. West was threatened with prosecution because he clicked on a button labelled "Edit" on a newspaper website -- and was surprised to discover that this allowed him to edit the actual web page. After reporting the problem to the newspaper, the FBI investigated him (including searching West's workplace and seizing some materials) and a prosecutor apparently threatened him with a felony prosecution.

In a recent case, it's been found that when you cause an inbox to fill up with spam, thus DoSing it, you are guilty of "hacking" it as defined by the Computer Fraud and Abuse act.

I do all the things you describe. There are lines I won't cross: I'll test for SQL injection, but I won't access the database. But I do this because I can afford high-priced lawyers to defend me. Also, I won't do things that are stupid. For example, Daniel Cuthbert was convicted of "intent to hack" because he kept changing his story when asked why he did it, so the court didn't believe any story.

Answer 3

The one constant across many jurisdictions seems to be that the only safe action on your list is number 1.

In some areas you would be okay with modifying data, but really you shouldn't risk it.

I would go so far as to say you are approaching this in entirely the wrong way.

Better approach:

Inform the web development company that if they want your business they must provide proof that the application has been tested to a particular standard. In the UK you could do this by requiring a test by a CREST or CHECK approved individual or team. Or you may gain assurance by using one of the Big-4 audit firms. If they have had a test, you could request visibility of the methodology and results.

Best approach:

Ask them to demonstrate the security and governance controls in their development lifecycle. An organisation that is mature in security will use a full SDLC which will reduce the likelihood of vulnerabilities, and even remove whole classes of vulnerabilities. Penetration testing is almost just a confirmation at the end of the process.

Answer 4

Caveat: I am not a lawyer, just a geek suggesting caution.

Is there a defined line in the sand that separates illegal hacking from "testing without permission"? Or is this whole scenario a grey area that I should avoid (likely the case). Are there any linkable online resources that could expand my knowledge in this wholly grey area? What are the specific acts or laws that handle this?

No. There isn't even agreement on which jurisdictions apply much less which laws within those jurisdictions apply. Even ignoring criminal penalties you should avoid doing this just because of civil penalties.

If you do half of the things on that list you are likely violating terms of service, and any non-good-faith use of computer resources can put you in danger of civil suits. Your arguments that you are not using undue resources are based on speculation about how reasonable engineers would design/deploy systems. You may very well be right but you have not and cannot verify those assertions before-hand or insure against them. If a meltdown in their server room merely coincides with your probing, you don't want to be in the position of proving that you did not cause it.

Seemingly innocuous payloads can become a problem when multiplied by many visitors. For example, your injected alert(1) payload may seem innocuous but if you find a persistant XSS vuln and it manifests on the home page where it is seen by x potential customer for d days. For some values of x and d it is not innocuous and you do not have the power to mitigate those variables.

Even contract pen-testers should have liability insurance when they're working with permission according to "Penetration Testing: The Third Party Hacker"

All penetration testing service providers should have liability insurance sufficient to cover the costs associated with the risk of losing a client’s proprietary information and any potential loss in revenue that might result from unexpected downtime caused by their activities. If the service provider does not have a liability insurance, pay attention how they specify the liability in their ‘Terms and Conditions’. Management must also assure that it can recover from a loss of data during testing by having in place adequate incident response and disaster recovery plans that have been developed and verified before testing begins.

If you were contracted by the company, you could be liable for loss of data/business when your probing takes down production systems. If you act without either contract or prior relationship, and for your own benefit, you're even more at risk of suit if their systems (which they didn't know to backup before you started your probing) have flaws that you tickle.

Let's say that you go ahead, and it does result in a civil lawsuit. If they want to pressure you to settle they might raise the spectre of criminal penalties or try to get punitive damages by likening your actions to ones for which there are criminal penalties. Judges and juries might be susceptible to the following argument based loosely on "Cyber Vandalism and Internet 'Hacktivism'":

"Imagine a locksmith wants to decide which lock to buy, so he asks a lock-maker for a list of customers. The locksmith goes to a convenience store that uses his locks and finds the store closed for the night. He fiddles with the lock, and damages it. The store owner arrives the next morning to find the lock broken so he can't open it and so sells no coffee that morning. Most jurisdictions have laws against vandals and they could be used against the locksmith. Punitive damages should apply to the locksmith because society has an interest in punishing vandals."

Regardless of whether you find the locksmith who wants to buy a lock a good analogy for you, judges and juries might, and there is a meme among the non-tech-savvy that "hackers" (loosely defined) are vandals as described in the link above.

TLDR: Do not set yourself up for an expensive lawsuit by going cowboy.

Answer 5

This doesn't answer your particular question, but for your hypothetical situation if you have permission to test their application's security then all of the above are 100% legal. Even better would be to ask the candidate to setup a test system (not their real website), and then try attacking that test system. This way if your tests accidentally bring down a live system (or someone notices the threat and brings the system down), you are not liable for damages.

For systems you are not affiliated with that aren't requesting penetration testing; I wouldn't go around testing security flaws. Yes, you won't be able to really know that company XYZ's website is protected against SQL injection attacks without testing, but unless they have agreed that you should test it -- its not your job to test it, and if you get caught doing so that can and should prosecute you.

Its like asking, is it ok to try check and see if my neighbor's house is locked? Or see if I could easily pick the lock (without ever opening the door and going inside)? Or testing to see if you could open a window that you could squeeze through? If your neighbor or the police notices you doing any of those things and feels compelled to press charges, you're screwed unless you have a legitimate reason (I heard screaming for help inside; I was dropping something off at their house and didn't want to leave it outside in the rain; so tried to see if I could open the door).

Answer 6

Assuming that you are hiring the web development firm on behalf of your company, I would ask your company's legal department for advice. If you are investigating security on behalf of your company and someone wanted to sue, they would almost certainly sue the deeper pockets of your company rather than you personally. You definitely want your legal department to stand behind you if that were to happen.

Your company's legal department is also in a much better position to know what your national and state laws allow. If there is any sort of criminal investigation, the fact that you had consulted with your legal council wouldn't indemnify you but it would definitely be a point in your favor.