Related to the laws and regulations imposed by governments, the enforcement of those laws, and legal and judicial process including investiagtion and trial.

learn more… | top users | synonyms (1)

1
vote
3answers
91 views

A neighbor is using a WEP encrypted router, should I inform them of the security risk? [on hold]

Someone in my neighborhood is using a WEP encrypted wifi router. I am not sure who they are yet, but if I find out, should I inform them of the security risks which that poses or are there any legal ...
4
votes
3answers
110 views

What countries have strong data protection laws?

Many answers on this site and other security-related websites state that one should host sensitive data in a country with strong data protection laws. What countries are these, and how is this ...
-5
votes
3answers
96 views

Is using netcat illegal? [closed]

Is using netcat to connect with a server that one does not own, illegal? For example, using netcat to connect with a web server and querying GET / HTTP/1.1 etc. I am asking this question because ...
0
votes
2answers
120 views

Encryption Laws in India

Is cryptography legal in India? If yes, then what type of encryption is not allowed?
3
votes
0answers
94 views

Is there a way my organization can collect clients' sensitive documents without being liable for them? [closed]

I am the head of IT for a microlending organization. We make small loans to new businesses, and as such we have to collect these clients' tax returns and other financial data as part of the ...
3
votes
1answer
86 views

Are Keystroke and Click Loggers Legal? [closed]

I worked with the firewall "Nobero" which is paid and bit expensive. It is a complete Network Firewall including groups policy, banning URLs and social sites. But It has a feature of tracking users' ...
1
vote
1answer
36 views

Are internal patient identifiers considered PHI under HIPAA?

We use GUIDs to internally to identify patients in our system. I'm having a debate with our regulatory people on whether these identifiers can be used in query strings to REST calls. They are ...
-2
votes
1answer
97 views

Data security is not perfectly possible, laws exist but no one uses them. What is missing on international level? [closed]

In my country (Austria) I was a member of the team that made laws for protecting the personal data of every person. In the meantime I realise that we have the laws but nobody claims them in ...
-4
votes
1answer
72 views

what is today allowed, when I travel to USA? [closed]

Is there a list of prohibited devices, for travellers, when they travel as normal citizen into the USA, for a maximum of 3 months into USA ? Is it prohibited to carry the following in a bag: notebook, ...
22
votes
2answers
1k views

Section 37 of the United Kingdom's computer misuse act

Section 37 of the United Kingdom's computer misuse act states you are not allowed to produce, obtain or supply articles which can be used for computer misuse. How do UK information security bloggers ...
2
votes
1answer
73 views

What is the current U.S. law regarding the building of and deployment of honeypots? [closed]

I have lots of links to information on the topic that I've gathered published since the mid-2000s and this SANS document has always been my goto: ...
-3
votes
2answers
71 views

Is there any benefit to login to a website as anonymously as possible, if you've already been there from an identifiable IP address?

Here's a basic example of the situation I am in: 1.Friend downloads full-length, new release movie on shady internet site (felony). 2.Uploads it to a randomly created, cloud hosting service account ...
10
votes
1answer
869 views

Legality of writing exploits for educational purposes (USA, Canada) [closed]

Is it legal for me to write a small exploit (possibly to a closed issue) and put it up on the internet for everyone to see (as a tutorial)? I have been researching the legality of exploiting ...
0
votes
0answers
17 views

What jurisdiction do DNS root servers and corresponding TLDs have?

We are setting up DNSSec and want to document risks that relate to the core root servers, their binding keys, and the next level DNS TLD. Since there is history saying that the US Government owns ...
1
vote
1answer
98 views

Is CloudKit or iCloud suitable for storing PII?

iCloud is Apple's storage technology that copies data from one iPhone and shares it with every other device. CloudKit is a similar technology that allows (from what I can tell) the partial ...
34
votes
8answers
8k views

Is it legal to start a private website for you and your friends to hack? [closed]

My friends have expressed an interest in hacking, but we don't want to do anything illegal, and considered CTF365, but it was WAY to expensive. Is it possible/legal for one of us to create a private ...
0
votes
2answers
85 views

Can a school legally access an account that a student logged in to at school? [closed]

Is this scenario legal, A school has a few public computers that can be used. The only browsers that are installed are chrome and internet explorer, and the entire network is man-in-the-middled. ...
1
vote
2answers
72 views

Should a password ever be presented in plain text to a user (On a website)? Is this illegal under UK Data protections act? [closed]

There is a website I use at work, external to our own. They have just presented with every employee with their plain text password and username via our internal website which requires our own logins. ...
2
votes
0answers
72 views

Who is responsible for a compromised computer? [closed]

In light of the recent public hacks on public systems, is there any culpability for the owner of a compromised system? Two examples: The owner is a large public company that leaks sensitive ...
0
votes
2answers
68 views

Web/App vulnerability responsibility [closed]

While auditing a few web apps and websites I uncovered a few serious vulnerabilities which I've since flagged (responsibly, of course). One of the things I noticed was that several development ...
3
votes
0answers
216 views

How do I avoid drawing the ire of the Department of Homeland Security when prepping to run my RPG? [closed]

So I'm running a long-standing role-playing game wherein the players' characters in the game are unknowningly working for another character who wants access to the data of the United States ...
1
vote
0answers
123 views

Has 100+USD, accidentally [closed]

Yesterday, I just visit a shopping site which use serial payment method and I type in some serials randomly then my account have 100USD; I just want to 'test' that website (for the bug bounty), is my ...
4
votes
2answers
284 views

Has a plaintext password ever been used in a court of law as evidence to a crime?

Regardless of how the password was obtained (decryption, bad hashing, confession): Are there any prior known cases where the contents of the password was used to prove motive or guilt? Or, looking ...
7
votes
1answer
968 views

Why does every site makes me acknowledge cookie usage? [closed]

In the last year or so every other site on the net started showing different kinds of notification that they're using cookies and I should be aware of it. The sheer number of different sites doing ...
-1
votes
1answer
265 views

Is attempting mySQL injection illegal? [closed]

I was testing an SQL injector I made in Java and the site I tested it on said 'Detected security breach attempt' blah blah blah. Is what I did illegal or not? I have found different opinions and ...
2
votes
1answer
142 views

Is it legal to “use” security vulnerabilities [closed]

I understand that the answer to questions like this depend on country, but I'd like to get an idea what the usual approach to cases like this are. Heres the case: I found a security hole in one of ...
2
votes
2answers
663 views

Penetration testing's terms of agreement template

My company is going to start to provide penetration testing services pretty soon, in fact, we are just missing the legal aspects of it. I'm wondering if is there any template which states the most ...
1
vote
0answers
108 views

Traveling abroad with encryption software on my computer [closed]

I have software installed on my computer that has encryption capabilities. This is the case both for things like VPN/SSL, and also GPG. I don't really use GPG (there are not that many people I can use ...
0
votes
2answers
219 views

Are files hosted on cloud servers/websites/databases manually checked by people?

I was wondering ... when I upload a file to, say, Dropbox, does anybody personally check it to see what it is? Say I upload a copy of my Blu-ray movie to cloud storage ... will anyone check, and ...
0
votes
2answers
140 views

Content of a penetration testing authorization

Recently I conducted a penetration testing where I used the following text as authorization: Penetration testing authorization During a penetration testing is possible that: The ...
0
votes
2answers
201 views

Is it legal to create a remote administration tool? [closed]

I'm planning to make a simple remote administration tool with the basic features that are available on all other rats in the market. However, I'm really worrying about legal issues after marketing it. ...
2
votes
2answers
186 views

Does SMIME differ from TLS, PGP, DMARC signature, or a Portal Encrypted email message in terms of legal non-repudiation?

I'm interested in protecting email messages from NSA-style snooping, but don't want to incur additional legal risk in doing so. In other words, does SMIME encryption and/or signing cause a given ...
0
votes
3answers
3k views

Are VPNs/proxies legal? [closed]

Are VPNs/proxies (and VPN/proxy software such as Tunnelblick and Hola) legal in the U.S., assuming that you are doing legitimate activities on the Internet (i.e. nothing illegal)?
1
vote
2answers
370 views

Is it illegal to publish an exploit against a known vulnerability in US?

Is it illegal to publish an exploit against a known vulnerability in US? The exploit could be published in one's blog or places like exploit-DB. It seems that in countries like Germany and France such ...
1
vote
2answers
108 views

Can I save & store a user's data in a way that proves that the information has not been altered, and that the timestamp is accurate?

There are many situations where the validity of the timestamp attached to a certain post (submission of information) might be invaluable for the post owner's legal usage. I'm not looking for a service ...
1
vote
3answers
747 views

How does a GSM triangulation work? [closed]

A have always been told that to get a geolocation of mobile phones there is the need 'ping' it with at least three cells. So actually, a standard and basic triangulation would just get from three ...
2
votes
1answer
636 views

Are legal notices in a login banner legally significant in terms of computer misuse?

Is there any case-law where having or not having a legal notice (example here) in the login banner of a system of nay kind made a difference in prosecution? The question is in consideration both of ...
1
vote
1answer
128 views

What companies drive around recording license plates? What do they do this for and on what grounds are they able to do so, legally speaking?

A friend shared a "security service" he just read about. Apparently the product is in beta and can thus be tried by anyone right now. I found it very interesting and surprising. I'm curious to know ...
-3
votes
1answer
55 views

major US cybersecurity laws/policies since 2000? [closed]

I am reading Cybersecurity and Cyberwar by P.W. Singer, and trying to tie the subject in with a government class project. I am looking laws and policies regarding cyberspace or cyber security, passed ...
2
votes
1answer
720 views

Is there a maximum allowed key size in the USA?

I've heard that using encryption outside military use has been illegal for a long time in the USA. However, I've also heard that when the regulation was updated, limits were put on encryption strength ...
52
votes
13answers
7k views

What makes it illegal to use the information learned by exploiting a bug?

According to news reports, arrests have already been made in relation to the Heartbleed bug. It sounds like this person managed to gain access to the website's database by capturing the credentials ...
1
vote
0answers
35 views

Does analyst API Flurry break Australian Privacy Act or any other Legal, Regulations, Compliance?

I want introduce Flurry API in my iOS app. But I heard since 2014 Australia start an act to against web page and mobile app to collect user information. My question is simple: Does using of API ...
-2
votes
1answer
54 views

Privacy vs monitoring cyber crime [closed]

So , how does the police find/monitor criminals' actions (eavesdropping) that do cyber crime(pornography , drug trafficking etc..) without breaking their privacy, and succesfully catch em and provide ...
1
vote
2answers
190 views

How could police identify digital contraband and charge someone if it's encrypted with keys?

For example, say I am transferring heavily-encrypted DVD/Blu-ray movies/game copies over the internet. However, I am using double or (+) encryption with keys required to decrypt the file using an ...
-1
votes
1answer
452 views

How can an ISP throttle encrypted connections? [closed]

I have had experience with an ISP that slows down all encrypted connections (down to an average 20-35 KBps) I was wondering if a) this is legal b)how can they do it and c) is there a way to bypass it. ...
2
votes
1answer
438 views

Legality of downloading leaked hashes / attempt cracking [closed]

Note: I realize there is no legally binding talk hereinafter. There are lots of leaked password hashes on the internet. Twitter searches for "hash dump" pull back tons of links, generally from "deep ...
2
votes
2answers
130 views

Where is the Line? [closed]

A comment posted on one of my questions the other day raised a question in my head. I know that many site admins appreciate users reporting bugs and security holes, and as a user I appreciate people ...
0
votes
2answers
60 views

Contents retrieved from a not protected url from content owner's server. Legal? [closed]

Is legal to use contents retrieved from a not protected url (no authentication involved, just a public accessible URL) from the content owner's server? Is legal to distribute urls pointing to that ...
2
votes
2answers
138 views

Is it possible to make a “proof of anteriority” for sites content?

Given a site that publishes unique content online and given that there are lots of site scrapers and persons stealing content and reposting it as their own, inevitably you will have the same content ...
1
vote
3answers
301 views

Tell and sell a (web app) vulnerability legally

If someone discover an unknown vulnerability for a given online service or website, is there a decent way to sell it directly to the concerned entity.