Related to the laws and regulations imposed by governments, the enforcement of those laws, and legal and judicial process including investiagtion and trial.
112
votes
7answers
21k views
What are the implications of NSA surveillance on the average internet user?
It would appear as though the tinfoil hat-wearing were vindicated today, as news broke of the true scale of the U.S. government's surveillance of its citizens' online activities, conducted primarily ...
1
vote
1answer
58 views
Licensing/selling digital certificate to another company
I recently stopped distributing my software, so I no longer use the digital certificate (AKA digital signature) I created for it.
A couple of days ago, a large software company offered to buy the ...
26
votes
8answers
3k views
Is it legal to find bugs on a website and report them to the website's owner?
I'm from Canada, and I'd like to know one thing. I know a bug on one website. I'm not sure if it's legal here to search for bugs on a website and NOT use them; instead, tell its company about it.
-2
votes
0answers
54 views
Healthcare Ex-Employer accusing Employee - Can Attorney request Access to PC for Forensics? [closed]
I have a litigation case in which a Healthcare Provider (employer) is accusing a couple of (ex)employees on a couple of issues, e.g. lying about log-on/off times of their work PCs, modifications of ...
-2
votes
2answers
83 views
How to minimize your fingerprint, or become invisible on the web? [duplicate]
With all of these news stories about the government reading emails and snooping information from other sources, what are ways to minimize or eliminate an organization's ability to actually track and ...
4
votes
4answers
410 views
Can a VPN avoid the Prism Surveillance Programme?
This is causing me major concern and i can understand it is for a lot of users as well. I have nothing to hide but it's the moral aspect of snooping which has ticked me off.
Can a VPN avoid the ...
2
votes
1answer
77 views
Considerations for information exchange agreement between governmental agencies
Question: When drafting an information exchange agreement between governmental agencies what security related sections should be considered for inclusion? Example agreements?
What is the security ...
1
vote
0answers
44 views
What parts of Bouncy Castle are affected by patents? [migrated]
Given that Bouncy Castle is an Open Source project, it's entirely possible that the contents contains implementations protected by various patents.
Since it's possible for the patent holder to sue ...
64
votes
11answers
8k views
How can I punish a hacker?
I am a small business owner. My website was recently hacked, although no damage was done; non-sensitive data was stolen and some backdoor shells were uploaded. Since then, I have deleted the shells, ...
21
votes
3answers
1k views
What access does UK Police currently have to ISP logs, and what information can said logs provide?
I'm currently researching a novel that has a crime element that centres around Internet-exclusive relationships and I would appreciate any help you might be able to offer regarding how much access the ...
7
votes
7answers
2k views
Storing credit cards for automatic payments?
I have no experience with storing credit cards and I do not know anything about the legal end of this.
The company I work for / develop for wants to store credit cards to process auto payments for ...
1
vote
1answer
186 views
Can we protect domain name by law? [closed]
Some company have domain names worth a million dollar. But sometime they are lost to hackers. So I wonder how can we protect domains by law instead of technology?
9
votes
2answers
383 views
How does the Copyright Alert System work? Who has implemented it?
Some ISPs are participating in a Copyright Alert System that notifies content authors of violations of their copyright.
I'm concerned how this oversight relates to my private traffic, and what laws ...
7
votes
3answers
747 views
What does a court need to successfully prosecute a hacker? Please cite previous cases if possible
Once a business decides it is worthwhile to persue legal action against the attacker, what information and processes should be followed so that:
Integrity of the investigation is maintained
The ...
0
votes
2answers
420 views
Why can't the police/government shut down black market websites? [duplicate]
I've been told that black market websites that have pretty much every drug, guns and all sorts of illegal things for sale don't actually exist on the internet, and I was then told some lengthy ...
-4
votes
2answers
143 views
Is it illegal to test a website and report the security bugs to them? [closed]
I am doing testing on some websites and I have found some serious bugs in those sites.
I am not sure if this is legal or not.
Is it ever legal?
How can I find out if it's legal where I live?
What ...
6
votes
1answer
3k views
Why is it so hard to close onion domains (e.g. The Silkroad)?
A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor)
For those who do not know what Tor is and who do not want to waste their time ...
-1
votes
1answer
81 views
For a Broker/Dealer, what technology is appropriate to limit transaction to a given state? [closed]
The SEC allows for individuals to not register with them if they don't permit business with users outside of the state:
A broker-dealer that conducts all of its business in one state does
not ...
-3
votes
1answer
102 views
Does PGP key I created and uploaded have any legal value? [closed]
Suppose you done:
gpg2 --gen-key
...
gpg2 --keyserver pgp.mit.edu --send-keys ...
Does such key have any legal meaning, e.g. to assert that it was really me that signed some message?
What can be ...
2
votes
2answers
203 views
What certification would be considered equivalent to the U.S.-EU Safe Harbor Framework?
The Safe Harbor website says the following:
The European Commission’s Directive on Data Protection went into effect in October of 1998, and would prohibit the transfer of personal data to ...
7
votes
5answers
501 views
What security requirements are a defacto standard in the Financial Industry?
What technologies, processes, or laws that relate to InfoSec apply specifically to the Financial industry?
If you're familliar with the Financial Industry, can you share details? For example:
What ...
12
votes
5answers
30k views
Can someone steal money from my bank account if they know my IBAN and personal details?
To deposit money into your account, some websites require that you provide them with a lot of details about your bank account: name, complete address and IBAN which includes your account number and ...
16
votes
4answers
809 views
Can ECC be used without infringing on patents?
Can ECC (Elliptic Curve Cryptography) be safely used without infringing on Certicom's patents?
I would like to make use of ECC in an embedded system to establish a secure channel. But, I am concerned ...
2
votes
1answer
124 views
Legality and ethics of cryptanalysis on password hashes
I'm working on my dissertation concerning cryptanalysis on password hashes. I'd like to delve into the legal and ethical aspects of cryptanalysis, however, seeing as I'n not at all well versed in law ...
0
votes
3answers
259 views
Penetration testing against an ignorant target - Is it legal? [closed]
I know it's a big no-no in terms of etiquette, but is it illegal in Canada to perform penetration testing against a commercial company without authorization?
prompted by: ...
-4
votes
4answers
127 views
Law & Ethics - I'm not be breaking the law its the computer [closed]
So it would be illegal to run a metasploit attack against a computer you don't have permission to do so against, right? But what if I configure a web server to nmap scan, then metasploit attack ...
3
votes
2answers
774 views
How effectively can ISPs detect illegal file sharing?
Recently the USA passed a law requiring ISPs to spy on their customers' internet connections to check for illegal file sharing. I assume that they would do this by sniffing packets, but doesn't this ...
1
vote
3answers
140 views
Is there a law against one email containing both a login and a password?
I see most companies either supply a login or a password in an email, but never both in one email. Is this a "best practice" or is there an actual law that prevents legitimate companies from providing ...
0
votes
1answer
137 views
What defines a 'defense contractor' and what is required to be reported in new US law? [closed]
According to news articles (eg here) the 2013 National Defense Authorization Act, which was signed into US law 2-Jan-2012, apparently requires defense contractors to report intrusions. What defines a ...
6
votes
3answers
310 views
Can I develop SSH-based tools within United States?
It is well known that development of open-source cryptographic tools is very problematic within the United States: all open-source ssh-based software was specifically developed outside of the US of A ...
3
votes
6answers
325 views
Is hacking back a valid security technique for companies?
Recently it has come to light through the reverse engineering of hacking tools that there are vulnerabilities in them that could be exploited to take over an attackers computer during a remote hacking ...
23
votes
4answers
1k views
consequences of grey hat hacking
While I was working on a anomaly detection system (finding cheaters in a quite popular online game service) I accidentally found a way to get a password of a user in a reasonable amount of time. ...
0
votes
2answers
82 views
Security in the breaking cloud? Storage Wars?
If access to a cloud server instance that stores personal/important information is lost or removed by the provider, is my data protected? Can the provider access my data and copy it, distribute, or ...
3
votes
2answers
132 views
are there any services to test nmap
While playing with nmap, I have started to wonder: are there any ip addresses which were specifically made to learn how to use nmap.
(As far as I understood I can not just scan any ip address, ...
1
vote
1answer
113 views
How do the authorities know who's downloading protected software?
Out of curiosity do the web based file hosting services such as Oron and Rapidshare store information about who downloads what? I ask because I'm wondering, when someone is "caught" downloading ...
6
votes
3answers
213 views
Sourcing hardware that is least likely to contain backdoors
I understand that CPU silicon (for example) is scrutinized for backdoors but there are other aspects of a computer system that may "leak data" to the outside world unbeknownst to the owner regardless ...
11
votes
6answers
3k views
At what point does “hacking” become illegal?
Hypothetical situation:
before I hire a web development company I want to test their ability to design secure web apps by viewing their previous client's websites.
Issue:
this situation raises a big ...
1
vote
2answers
288 views
Is it legal to store/send user's device's IMEI/MEID? [closed]
I'm working on an Android application with a "ban-system". The customer suggested using devices' IMEI/MEID as identifier and asked me about legal issues about that.
Is it legal to store/send user's ...
41
votes
16answers
2k views
Can we still provide confidentiality when cryptography is outlawed?
In certain jurisdictions, use of cryptography by the private sector is limited: e.g. there are reports that in the UAE and other countries not all of the encryption capabilities of the BlackBerry are ...
11
votes
3answers
444 views
If I find or create a 0day exploit, can I be held liable for releasing out to the public?
If I found or created a 0day and decided to immediately release it into the wild (Giving a P.o.c w/ source). But not using it to actually exploit anything. Can I be held liable for it?
1
vote
3answers
262 views
Are tracking cookies illegal?
I have a merchant website. When a user visits the website, a cookie is set. Then when the same user visits the site again, we provide him with suggestions, content that he may enjoy based on what ...
0
votes
0answers
87 views
Exhaustive list of abuse notifications that organizations get [closed]
What are the different types of abuse notifications that organizations get? Here are some I could get off the web, but would be good to identify if someone already has a list of "types of abuse" ...
6
votes
3answers
542 views
attack/abuse notification email template
I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock.
Are there examples of templates used for this ...
18
votes
4answers
1k views
Are anti-virus companies companies regularly committing software piracy?
As Mikko Hypponen highlighted in a recent tweet, anti-Virus companies collect and store both samples of malicious software and samples of legitimate software:
This got me to thinking, what ...
3
votes
1answer
186 views
HITECH : New United States Federal Act on Data Security
Has anyone heard of the new HITECH Federal Act? I understand that it is an underscore of the HIPAA Federal Act but am unclear of the requirements that they are requesting.
It targets companies that ...
-1
votes
2answers
442 views
Port scanning legal or not? [closed]
Is port scanning legal ?
In which countries ?
my option :
I think port scanning is like a short-walk( or a long-walk) in the neighbourhood, just curious about neighbours are up to.
I think that ...
10
votes
7answers
494 views
Is the law the only thing stopping many sites from being hacked/cracked?
There are so many common vulnerabilities out there, so how is it that every Wordpress blog, for example, isn't hacked into often?
It seems like the security community is overly paranoid, unless the ...
9
votes
1answer
344 views
Best way to report a foreigner attacker's ip to authorities?
I have been under attack last week and I was able to trace down the attacker and get his IP address. The attacker was located in Germany but I live out of Europe?
From your experience what is the ...
5
votes
3answers
514 views
If PCI DSS isn't a law, how can I be prosecuted for not being compliant?
PCI DSS isn't a law. Why can I be prosecuted for not being compliant?
16
votes
2answers
4k views
Minimum requrements for storing last 4 digits of credit card number?
We have a merchant website that uses Autorize.net's CIM and AIM. Our users may have multiple credit cards so we'd want to give them opportunity to distinguish between credit cards that they use on ...
