Related to the laws and regulations imposed by governments, the enforcement of those laws, and legal and judicial process including investiagtion and trial.

learn more… | top users | synonyms (1)

34
votes
9answers
5k views
+100

What makes it illegal to use the information learned by exploiting a bug?

According to news reports, arrests have already been made in relation to the Heartbleed bug. It sounds like this person managed to gain access to the website's database by capturing the credentials ...
0
votes
0answers
7 views

Does analyst API Flurry break Australian Privacy Act or any other Legal, Regulations, Compliance?

I want introduce Flurry API in my iOS app. But I heard since 2014 Australia start an act to against web page and mobile app to collect user information. My question is simple: Does using of API ...
-2
votes
1answer
30 views

Privacy vs monitoring cyber crime [closed]

So , how does the police find/monitor criminals' actions (eavesdropping) that do cyber crime(pornography , drug trafficking etc..) without breaking their privacy, and succesfully catch em and provide ...
1
vote
2answers
104 views

How could police identify digital contraband and charge someone if it's encrypted with keys?

For example, say I am transferring heavily-encrypted DVD/Blu-ray movies/game copies over the internet. However, I am using double or (+) encryption with keys required to decrypt the file using an ...
-1
votes
1answer
48 views

How can an ISP throttle encrypted connections? [closed]

I have had experience with an ISP that slows down all encrypted connections (down to an average 20-35 KBps) I was wondering if a) this is legal b)how can they do it and c) is there a way to bypass it. ...
2
votes
1answer
97 views

Legality of downloading leaked hashes / attempt cracking [closed]

Note: I realize there is no legally binding talk hereinafter. There are lots of leaked password hashes on the internet. Twitter searches for "hash dump" pull back tons of links, generally from "deep ...
2
votes
2answers
112 views

Where is the Line? [closed]

A comment posted on one of my questions the other day raised a question in my head. I know that many site admins appreciate users reporting bugs and security holes, and as a user I appreciate people ...
0
votes
2answers
40 views

Contents retrieved from a not protected url from content owner's server. Legal? [closed]

Is legal to use contents retrieved from a not protected url (no authentication involved, just a public accessible URL) from the content owner's server? Is legal to distribute urls pointing to that ...
2
votes
2answers
103 views

Is it possible to make a “proof of anteriority” for sites content?

Given a site that publishes unique content online and given that there are lots of site scrapers and persons stealing content and reposting it as their own, inevitably you will have the same content ...
1
vote
3answers
157 views

Tell and sell a (web app) vulnerability legally

If someone discover an unknown vulnerability for a given online service or website, is there a decent way to sell it directly to the concerned entity.
4
votes
3answers
174 views

Is there any reason in particular encryption keys aren't arbitrarily large?

It's my understanding that the more bits an encryption key has, the longer it takes to break the encryption. What is the down side of having a larger encryption key or why don't we see keys of size ...
1
vote
1answer
103 views

Is it legal to publish viticim's password and email?

With so many identities stolen last ten years, we know a bunch of emails and a bunch of passwords. Are the two following databases legal under the US federal laws? Publish a database which victim's ...
2
votes
2answers
73 views

Should digital forensics examiners avoid the term “evidence” outside legal proceedings? [closed]

This is what the authors of the book "Digital Forensics with Open Source Tools" say about the term evidence: The examiner reveals the truth of an event by discovering and exposing the remnants of ...
3
votes
1answer
510 views

What are the implications of running a TOR non-exit relay node?

Intuitively, running a non-exit TOR node should bring the benefit of plausible deniability that a packet originated from your device. Unlike exit nodes however, you would not have to worry about ...
1
vote
0answers
128 views

Encrypted chat using any smartphone. Is it legal? [closed]

Here's my case. We have written app for Android smartphones which allows users to exchange secured cipher messages. For key-exchange we're using elliptic curve 112 bits, for messaging we're using DES ...
0
votes
1answer
31 views

Export Restriction of wrapper for existing crypto library

I am creating a packaged C++ library for creating http/https clients/servers. As part of that, I am planning on using either the botan (http://botan.randombit.net/) or openssl tls wrappers. My ...
16
votes
2answers
2k views

In the SilkRoad takedown, what does it mean “An IP address was leaking” in Tor?

According to the official complaint, on Page 28 they mention: on May 24, 2013, a Silk Road user sent him a private message warning him that "some sort of external IP address" was "leaking" from ...
0
votes
2answers
289 views

Is it illegal to use Fake User-agents? [closed]

Is it illegal to impersonate user-agents when you are crawling a website? If so, what and how a legal action can be taken against the faking requester? Is this law applies only for crawlers or a user ...
4
votes
1answer
410 views

Avoid being implicated in criminal activity when using Tor

What steps does a Tor user need to take to ensure that he or she doesn't become implicated in other Tor users' criminal activity? For example, I recently came across a Tech Republic article by ...
1
vote
1answer
145 views

Which cloud providers can be used for the simulation of DDoS attacks? [closed]

Cloud providers have a great infrastructure to perform DDoS simulations. You can get thousands of virtual machines with different IP addresses, fully customizable with the tools you need for testing. ...
0
votes
2answers
96 views

Germany: Privacy Protection Regulations and Response [closed]

Do privacy protection laws within Germany/EU protect students from gross invasions of privacy? I have reason to believe that through some either permitted or unsanctioned channel my teacher was able ...
-1
votes
1answer
123 views

In which country can you host a service which honors privacy?

Recent events like the Lavabit case have shown that it is no loger possible to host a server in the United States and guarantee your users that you will keep their data confidential, because the US ...
1
vote
2answers
208 views

What are some examples of legal action taken as the result of a security breach? [closed]

As of late, there's been lots of reports of companies losing data due to "hackers". More often than not, this just boils down to lax security. I am looking for concrete examples of a breech where ...
4
votes
2answers
533 views

NaCl: US Export Regulations

I'm in charge of a product security in our US based startup and I plan to use NaCl for encryption (well, Sodium, actually). I'm trying to navigate the labyrinth of US export regualtions - something I ...
3
votes
1answer
290 views

Are voluntary / manual DDoS illegal?

Since DDoS is simply a group of subjects coming together to send requests to a particular server, is it true to say that a voluntary DDoS is perfectly valid and legal in US? By that, I mean that a ...
-3
votes
1answer
405 views

Track IP address of criminals [closed]

Quite recently someone had maliciously stolen my pictures and created a fake Facebook and Instagram in my name, with abusive captions under my pictures. However, with the advice from the police, I had ...
15
votes
3answers
356 views

What expectation of privacy is there with US-based vendors with the LavaBit and SilentCircle shutdown?

Lavabit hosts a secure messaging service that was recently shut down. Likewise SilentCircle has preemptively done the same thing with their email-based service. It seems that the justification for ...
1
vote
1answer
162 views

Incentives to Support Adoption of the Cybersecurity Framework

The US White House has just release the subject blog post link here which suggests adoption of this proposed new cyber insurance might be rewarded by liability limitations including "reduced tort ...
1
vote
0answers
31 views

Should we protect web application source code from being stolen by web hosts through obfuscation? [duplicate]

Is it worth to obfuscate a java web app source code so that the web host cannot make wrong use of the code & probably even steal your business. If, so how to deal with this or how to obfuscate ? ...
95
votes
7answers
5k views

Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in production unintentionally during a pentest?

Today I experienced a situation where a person responsible for the security of a company required a pentesting company to withdraw a clause in the contract that says that: "during the pentest there ...
3
votes
1answer
390 views

To get security clearance, do I need to be national of the country?

For example, if I want to apply to a job based in UK which requires security clearance, can I only do so if I'm a British national? What if I'm from another country belonging to the EU?
-2
votes
1answer
113 views

US Export Laws (Encryption Cloud Service) [closed]

Okay - so I have been extensively looking into US export/import laws relating to encryption software (5D992), however I have a few questions about the laws and their applicability. So, the laws ...
-7
votes
3answers
186 views

Is it legal to hack a website that distribute my copyrighted materials? [closed]

I sell some .pdf files online. But soon they are all over the web because after someone buys the .pdf and puts it on various websites. Is it legal to hack those websites? Are there other ways to ...
-4
votes
1answer
186 views

Can I develop an SSH client for iPad in Sweden and sell it in Apple App Store? [closed]

I wonder, if I am allowed to develop an SSH client for distribution through Apple App Store without breaking any export regulations? I don't really know much about the encryption algorithm. Below is a ...
2
votes
3answers
694 views

Have the police placed a bug on my line [closed]

As a pretty dedicated anarchist, rule-breaker and malcontent, I often find myself at odds with the British police. I have been the subject of 3 searches (that I know of) over the last 8 months ...
1
vote
1answer
115 views

Licensing/selling digital certificate to another company

I recently stopped distributing my software, so I no longer use the digital certificate (AKA digital signature) I created for it. A couple of days ago, a large software company offered to buy the ...
28
votes
8answers
3k views

Is it legal to find bugs on a website and report them to the website's owner?

I'm from Canada, and I'd like to know one thing. I know a bug on one website. I'm not sure if it's legal here to search for bugs on a website and NOT use them; instead, tell its company about it.
-2
votes
2answers
373 views

How to minimize your fingerprint, or become invisible on the web? [duplicate]

With all of these news stories about the government reading emails and snooping information from other sources, what are ways to minimize or eliminate an organization's ability to actually track and ...
7
votes
4answers
2k views

Can a VPN avoid the Prism Surveillance Programme?

This is causing me major concern and i can understand it is for a lot of users as well. I have nothing to hide but it's the moral aspect of snooping which has ticked me off. Can a VPN avoid the ...
132
votes
7answers
24k views

What are the implications of NSA surveillance on the average internet user?

It would appear as though the tinfoil hat-wearing were vindicated today, as news broke of the true scale of the U.S. government's surveillance of its citizens' online activities, conducted primarily ...
2
votes
1answer
112 views

Considerations for information exchange agreement between governmental agencies

Question: When drafting an information exchange agreement between governmental agencies what security related sections should be considered for inclusion? Example agreements? What is the security ...
75
votes
12answers
11k views

How can I punish a hacker?

I am a small business owner. My website was recently hacked, although no damage was done; non-sensitive data was stolen and some backdoor shells were uploaded. Since then, I have deleted the shells, ...
20
votes
3answers
4k views

What access does UK Police currently have to ISP logs, and what information can said logs provide?

I'm currently researching a novel that has a crime element that centres around Internet-exclusive relationships and I would appreciate any help you might be able to offer regarding how much access the ...
0
votes
2answers
806 views

Why can't the police/government shut down black market websites? [duplicate]

I've been told that black market websites that have pretty much every drug, guns and all sorts of illegal things for sale don't actually exist on the internet, and I was then told some lengthy ...
-3
votes
2answers
348 views

Is it illegal to test a website and report the security bugs to them? [closed]

I am doing testing on some websites and I have found some serious bugs in those sites. I am not sure if this is legal or not. Is it ever legal? How can I find out if it's legal where I live? What ...
-1
votes
1answer
100 views

For a Broker/Dealer, what technology is appropriate to limit transaction to a given state? [closed]

The SEC allows for individuals to not register with them if they don't permit business with users outside of the state: A broker-dealer that conducts all of its business in one state does not ...
-3
votes
1answer
131 views

Does PGP key I created and uploaded have any legal value? [closed]

Suppose you done: gpg2 --gen-key ... gpg2 --keyserver pgp.mit.edu --send-keys ... Does such key have any legal meaning, e.g. to assert that it was really me that signed some message? What can be ...
2
votes
2answers
548 views

What certification would be considered equivalent to the U.S.-EU Safe Harbor Framework?

The Safe Harbor website says the following: The European Commission’s Directive on Data Protection went into effect in October of 1998, and would prohibit the transfer of personal data to ...
2
votes
1answer
185 views

Legality and ethics of cryptanalysis on password hashes

I'm working on my dissertation concerning cryptanalysis on password hashes. I'd like to delve into the legal and ethical aspects of cryptanalysis, however, seeing as I'n not at all well versed in law ...
0
votes
3answers
396 views

Penetration testing against an ignorant target - Is it legal? [closed]

I know it's a big no-no in terms of etiquette, but is it illegal in Canada to perform penetration testing against a commercial company without authorization? prompted by: ...