Related to the laws and regulations imposed by governments, the enforcement of those laws, and legal and judicial process including investiagtion and trial.

learn more… | top users | synonyms (1)

0
votes
0answers
7 views

What are good templates for an Image Upload policy?

I'm building a collaborative directory for events, where users and events will have their public profiles, each one with at least a main picture. For users, that picture may come from their social ...
0
votes
0answers
24 views

Under UK data protection act, who is reponsible for ensuring the data is transmitted to the data processor securely

Preamble: I'm being reference-checked by a company. This company has asked me to send them my personal details (like NI numbers) via email (unsecured; unencrypted: big no-no). (To avoid side-tracking ...
2
votes
1answer
63 views

How do VPN services in the US choose to comply with foreign law enforcement requests? [closed]

Imagine a user from Russia uses a VPN-service which obeys US jurisdiction. This user did violate Russian legislation and the violation is being investigated by Russian law enforcement. Let's assume ...
0
votes
0answers
32 views

Client Side Attacks - XSS and CSRF [duplicate]

It is against the law injecting JavaScript scripts (simple pop out alert) or capturing and modifying with Burp/Fiddler HTTP request for identifying web application vulnerabilities (CSRF) without the ...
3
votes
1answer
63 views

I'm concerned a website I use is vulnerable - getting vulnerabilities fixed (UK) [duplicate]

I'm a paying customer of a service. I can't change provider without damaging my own business. I believe the website is vulnerable to very basic vulnerabilities (url tampering (IDOR)) that would ...
-5
votes
2answers
133 views

How much can the police find about me with only my IP?

So yesterday I had a conversation with a friend. Apparently he had an argument with an other user in a forum, and while both exchanged bad words the other guy told him. I have your IP and mail and ...
6
votes
1answer
160 views

How far a VPN service is legal? Does it makes my data vunerable for hackers?

Today, in Brazil, the government suspended by judicial requirement the WhatsApp application for 48 hours. It is a messaging app that works only via Internet connection (3G, 4G, WiFi...) and not by ...
4
votes
1answer
116 views

Legal insurance for penetration testers

I am currently finishing university and I am looking for work as a penetration tester. How important is it to have legal insurance for me in Germany and do I need to organise this privately. Of ...
2
votes
1answer
73 views

Strategy for electronic document (PDF) signatures

I'm treading into the murky waters of electronic document signatures, and I'm having trouble figuring out the right approach to deal with my requirements. I think this should be pretty ...
2
votes
1answer
69 views

In the context of advanced electronic signatures, what does “sole control” mean?

To satisfy the conditions for an advanced or qualified electronic signature, the power to sign must remain under the "sole control" of the signatory. Can anyone provide concrete examples of what this ...
7
votes
2answers
110 views

Have there been successful class action lawsuits due to infosec breaches?

Whenever there is a major security breach affecting consumers, often large costs are quoted (e.g. 35 million for TalkTalk). One reason given for these large costs is the potential for affected people ...
1
vote
0answers
11 views

EU Data Retention Directive and the Draft Investigatory Powers Bill 2015 [closed]

Was the EU Data Retention Directive ever transcribed into English law? If so, the Draft Investigatory Powers Bill 2015 would appear to be somewhat moot?
3
votes
0answers
79 views

Is there any way a website can show it hasn't been “hijacked” by the authorities? [closed]

I heard about warrant canaries and thought the idea was interesting. My understanding of what they are is a website or online service publishes a statement periodically that they have not been served ...
0
votes
1answer
98 views

What browsing history exactly would police have under proposed UK law change? Plain english

It's very unclear what '12 months' browsing history being kept by network provider' actually means to an uninformed person. Thunderbird? VPN? Startpage searches? Bit-torrent downloads? Epic browser ...
2
votes
3answers
54 views

Is accessing carelessly not protected data of any service unlawfull? [closed]

The following scenario: I just visited the webpage of an phisshing company of an german service which is here in germany acting at least not unlawfull, but just trying to get money for not even giving ...
0
votes
2answers
261 views

Am I legally required to give passwords or keys for encypted data during an criminal investigation? [closed]

During an investigation where one is a suspect or one may have information about a suspect, is one required to relinquish passwords or keys to personal encrypted data to the authorities? For ...
2
votes
1answer
102 views

Legal: ISP Compromised DNS [closed]

Background: A rural wireless ISP configures all their customers equipment to point to their own nameservers. For the past 2 months or so their primary name server has intermittently been serving ...
-1
votes
4answers
157 views

Is 100% anonymity possible with Tor under certain circumstances? [duplicate]

Tor has guidelines that define a set of rules/techniques to assure anonymity. Some examples are browsing in small window mode so your screen resolution can't be detected, using HTTPS everywhere, and ...
0
votes
0answers
179 views

USA PATRIOT Act and Office 365

I have a local Exchange server, which has several spam and email reception issues (Due to an expired subscription to a spam filtering system). I was looking at the Office 365 Exchange Online ...
29
votes
5answers
7k views

Can FBI or government agencies get hold of my Google Docs files just by confiscating my laptop? [closed]

Assume the following: I am doing all my work, including the one with sensitive information on Google Docs. No documents are stored on local hard drive. I am not using the Google Drive App, just ...
1
vote
0answers
53 views

What is the cost of CALEA in the US? (Lawful intercept) [closed]

The Computer Assistance for Law Enforcement Act (CALEA) is a law in the US that provides for lawful intercept of communications by law enforcement (namely, the FBI). Specifically, as I understand it: ...
1
vote
1answer
103 views

In the United States, when can someone legally search my personal laptop? (Government or private security) [closed]

Unlike the United Kingdom, U.S. citizens don't have an explicit right to privacy in the Constitution. Although there are implied privacy rights within "penumbras" of the Bill of Rights this has ...
0
votes
2answers
227 views

Is HTTPS required when there's no sensitive data in the site

I'm currently building a B2B e-commerce site for a client using WordPress. We sell industrial machinery ranging in the upper $100k-$400k price range. My client would like to have their financing form ...
1
vote
2answers
115 views

Could I ever be legally required to decrpyt user information? [closed]

Suppose I host some web app which stores information about its users. In the interest of confidentiality, that information is stored in an encrypted format. Under what circumstances could a legal ...
2
votes
1answer
52 views

Are there any examples of when personal email data can be brought into a lawsuit involving a corporation?

If users bring their own device (BYOD) and they have corporate Exchange (or Goodlink email) on that device, could the other email accounts on that device be open to a legal search? Would the SMS ...
4
votes
1answer
108 views

What are the compliance requirements or standards for a non-US firm hosting personal data in the US?

I work for a head hunting company with offices in Canada and Asia. We migrated our custom built CRM system from our own servers hosted in Japan to an Amazon hosting service meaning that all our data ...
1
vote
3answers
158 views

A neighbor is using a WEP encrypted router, should I inform them of the security risk? [closed]

Someone in my neighborhood is using a WEP encrypted wifi router. I am not sure who they are yet, but if I find out, should I inform them of the security risks which that poses or are there any legal ...
4
votes
3answers
239 views

What countries have strong data protection laws?

Many answers on this site and other security-related websites state that one should host sensitive data in a country with strong data protection laws. What countries are these, and how is this ...
-6
votes
3answers
140 views

Is using netcat illegal? [closed]

Is using netcat to connect with a server that one does not own, illegal? For example, using netcat to connect with a web server and querying GET / HTTP/1.1 etc. I am asking this question because ...
0
votes
2answers
399 views

Encryption Laws in India

Is cryptography legal in India? If yes, then what type of encryption is not allowed?
3
votes
0answers
130 views

Is there a way my organization can collect clients' sensitive documents without being liable for them? [closed]

I am the head of IT for a microlending organization. We make small loans to new businesses, and as such we have to collect these clients' tax returns and other financial data as part of the ...
3
votes
1answer
145 views

Are Keystroke and Click Loggers Legal? [closed]

I worked with the firewall "Nobero" which is paid and bit expensive. It is a complete Network Firewall including groups policy, banning URLs and social sites. But It has a feature of tracking users' ...
2
votes
1answer
185 views

Are internal patient identifiers considered PHI under HIPAA?

We use GUIDs to internally to identify patients in our system. I'm having a debate with our regulatory people on whether these identifiers can be used in query strings to REST calls. They are ...
-3
votes
1answer
109 views

Data security is not perfectly possible, laws exist but no one uses them. What is missing on international level? [closed]

In my country (Austria) I was a member of the team that made laws for protecting the personal data of every person. In the meantime I realise that we have the laws but nobody claims them in ...
-4
votes
1answer
79 views

what is today allowed, when I travel to USA? [closed]

Is there a list of prohibited devices, for travellers, when they travel as normal citizen into the USA, for a maximum of 3 months into USA ? Is it prohibited to carry the following in a bag: notebook, ...
22
votes
2answers
1k views

Section 37 of the United Kingdom's computer misuse act

Section 37 of the United Kingdom's computer misuse act states you are not allowed to produce, obtain or supply articles which can be used for computer misuse. How do UK information security bloggers ...
2
votes
1answer
147 views

What is the current U.S. law regarding the building of and deployment of honeypots? [closed]

I have lots of links to information on the topic that I've gathered published since the mid-2000s and this SANS document has always been my goto: ...
-4
votes
2answers
124 views

Is there any benefit to login to a website as anonymously as possible, if you've already been there from an identifiable IP address?

Here's a basic example of the situation I am in: 1.Friend downloads full-length, new release movie on shady internet site (felony). 2.Uploads it to a randomly created, cloud hosting service account ...
10
votes
1answer
900 views

Legality of writing exploits for educational purposes (USA, Canada) [closed]

Is it legal for me to write a small exploit (possibly to a closed issue) and put it up on the internet for everyone to see (as a tutorial)? I have been researching the legality of exploiting ...
1
vote
1answer
232 views

Is CloudKit or iCloud suitable for storing PII?

iCloud is Apple's storage technology that copies data from one iPhone and shares it with every other device. CloudKit is a similar technology that allows (from what I can tell) the partial ...
35
votes
8answers
9k views

Is it legal to start a private website for you and your friends to hack? [closed]

My friends have expressed an interest in hacking, but we don't want to do anything illegal, and considered CTF365, but it was WAY to expensive. Is it possible/legal for one of us to create a private ...
0
votes
2answers
96 views

Can a school legally access an account that a student logged in to at school? [closed]

Is this scenario legal, A school has a few public computers that can be used. The only browsers that are installed are chrome and internet explorer, and the entire network is man-in-the-middled. ...
1
vote
2answers
98 views

Should a password ever be presented in plain text to a user (On a website)? Is this illegal under UK Data protections act? [closed]

There is a website I use at work, external to our own. They have just presented with every employee with their plain text password and username via our internal website which requires our own logins. ...
3
votes
0answers
86 views

Who is responsible for a compromised computer? [closed]

In light of the recent public hacks on public systems, is there any culpability for the owner of a compromised system? Two examples: The owner is a large public company that leaks sensitive ...
0
votes
2answers
77 views

Web/App vulnerability responsibility [closed]

While auditing a few web apps and websites I uncovered a few serious vulnerabilities which I've since flagged (responsibly, of course). One of the things I noticed was that several development ...
4
votes
0answers
343 views

How do I avoid drawing the ire of the Department of Homeland Security when prepping to run my RPG? [closed]

So I'm running a long-standing role-playing game wherein the players' characters in the game are unknowningly working for another character who wants access to the data of the United States ...
1
vote
0answers
129 views

Has 100+USD, accidentally [closed]

Yesterday, I just visit a shopping site which use serial payment method and I type in some serials randomly then my account have 100USD; I just want to 'test' that website (for the bug bounty), is my ...
4
votes
2answers
342 views

Has a plaintext password ever been used in a court of law as evidence to a crime?

Regardless of how the password was obtained (decryption, bad hashing, confession): Are there any prior known cases where the contents of the password was used to prove motive or guilt? Or, looking ...
7
votes
1answer
2k views

Why does every site makes me acknowledge cookie usage? [closed]

In the last year or so every other site on the net started showing different kinds of notification that they're using cookies and I should be aware of it. The sheer number of different sites doing ...
-1
votes
1answer
716 views

Is attempting mySQL injection illegal? [closed]

I was testing an SQL injector I made in Java and the site I tested it on said 'Detected security breach attempt' blah blah blah. Is what I did illegal or not? I have found different opinions and ...