Related to the laws and regulations imposed by governments, the enforcement of those laws, and legal and judicial process including investiagtion and trial.

learn more… | top users | synonyms (1)

6
votes
1answer
160 views

What are the compliance requirements or standards for a non-US firm hosting personal data in the US?

I work for a head hunting company with offices in Canada and Asia. We migrated our custom built CRM system from our own servers hosted in Japan to an Amazon hosting service meaning that all our data ...
2
votes
2answers
67 views

Why is it so easy to pirate apps for Android, considering most have an internet connection and access to phone details? [duplicate]

It seems so easy to pirate apps for Android it's as if no one even cares. It's as easy as google searching for the apk and then installing it. Isn't this surprising as some apps cost money? Wouldn't ...
1
vote
1answer
66 views

Is threat intelligence an illegal practise? [closed]

When thinking about cyber security I like to be up to date with all the latest threats out there. So of course you would like to get the information first hand to see where the threats are coming from ...
0
votes
2answers
357 views

Are files hosted on cloud servers/websites/databases manually checked by people?

I was wondering ... when I upload a file to, say, Dropbox, does anybody personally check it to see what it is? Say I upload a copy of my Blu-ray movie to cloud storage ... will anyone check, and ...
-1
votes
2answers
794 views

How to minimize your fingerprint, or become invisible on the web? [duplicate]

With all of these news stories about the government reading emails and snooping information from other sources, what are ways to minimize or eliminate an organization's ability to actually track and ...
0
votes
1answer
54 views

Why doesn't Google uninstall or report, installed pirated apps? [closed]

Why doesn’t Google do anything about pirated apps? It seems really easy to catch the users. You could go to a website and download an apk for an app which you normally pay for in the play store. ...
-2
votes
3answers
152 views

Would accessing an unprotected IP camera be considered illegal in most countries? [closed]

Context: You might have heard about Shodan, the website that acts as a web search for devices accessible from the Internet: home cameras, nuclear plants, crematorium, you name it. On it you can find ...
0
votes
3answers
70 views

Is anyone held responsible if a VPN/proxy that doesn't log is used for illegal purposes?

How do the anonymous VPN services work? It’s my understanding that if an internet connection is misused for something (such as downloading copyright material or hacking a network etc) then the person ...
22
votes
6answers
12k views

Is Facebook allowed to sell/give your information away to anyone willing to buy it?

Is Facebook allowed to sell information about their users to other companies? For example selling name, address and IP information on a specific geographic location could be very valuable ...
-2
votes
1answer
68 views

Can government query company, such as Google, to get list of accounts associated with some information, such as IP address or phone number? [closed]

UPD: My naive thought was that government requests should explicitly point account for which they requesting information. And that a broad requests like getting list of accounts logged during some ...
11
votes
2answers
8k views

Why is it so hard to close onion domains (e.g. The Silkroad)?

A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor) For those who do not know what Tor is and who do not want to waste their time ...
9
votes
4answers
1k views

How to determine if a VPN provider respects data confidentiality?

I've read about why I really should use a VPN and I've been looking into different providers, but there's one thing I'm worried about. Can't a VPN provider just look at my traffic all they want and ...
34
votes
1answer
3k views

How did FBI/DoJ retrieve the data stored on the encrypted iPhone?

Quote from The New York Times: The Justice Department said Monday that it had found a way to unlock an iPhone without help from Apple, allowing the agency to withdraw its legal effort to ...
52
votes
9answers
4k views

How should I tell school that they are vulnerable when I wasn't given permission to check? [duplicate]

I would like to report security weaknesses to my school in UK. I had managed to find security weaknesses without any exploits or other software or hardware. I had look at similar question however ...
1
vote
1answer
45 views

Is it possible to give legal value to signed web services?

The context is using digitally signed webservices (with XML-DSIG for example) for e-government interoperability between databases. The idea is to give endorsement to both the data publisher and the ...
12
votes
1answer
1k views

Should I sign someone else's code?

I'm working on a product that includes 3rd party drivers for some of the product's hardware. Some of the drivers are not signed, others are only signed with sha1 certificates. Given that getting new, ...
4
votes
0answers
101 views

Is there any way a website can show it hasn't been “hijacked” by the authorities? [closed]

I heard about warrant canaries and thought the idea was interesting. My understanding of what they are is a website or online service publishes a statement periodically that they have not been served ...
8
votes
2answers
796 views

Implications of the proposed Burr-Feinstein senate bill? [closed]

It has been rumoured (I guess it is more than a rumour) that senators Burr and Feinstein will be introducing legislation requiring companies to provide the government (with warrants) access to encrypt ...
-2
votes
1answer
92 views

How to legally jailbreak an iPhone? [closed]

I'm looking to jailbreak my work phone to pen test iOS applications. From a compliance point of view I've got the green light as long as I don't go on our companies intranet with it or put company ...
5
votes
3answers
454 views

Are documents truly “signed” by DocuSign?

I've never been happy with the explanation DocuSign gives for themselves in their own marketing material (e.g. https://www.docusign.com/how-it-works/electronic-signature/digital-signature/digital-...
3
votes
2answers
196 views

“fake” phishing mails from CST

I work in the computer security team of my company and my team leader ask me to send "fake" phishing mails to my colleagues. The mails intended to lure them into clicking on the embedded links (the ...
11
votes
2answers
5k views

Best way to report a foreigner attacker's ip to authorities?

I have been under attack last week and I was able to trace down the attacker and get his IP address. The attacker was located in Germany but I live out of Europe? From your experience what is the ...
-2
votes
1answer
570 views

What is suspected to be on the famous encrypted iPhone? [closed]

Quite a big deal is being made about Apple's refusal to decrypt an iPhone used in a terrorist attack. What is suspected to be on the device? If the crime has already been committed and the dead buried,...
1
vote
0answers
68 views

Where can I find example or template security testing contracts? [closed]

I'm a lawyer interested in information security, and am collecting templates and examples of security testing agreements to compare. What are some publicly available examples, or nuggets of wisdom ...
3
votes
2answers
122 views

When is it worthwhile to pursue a hacker?

With respect to "interactive" attacks by individuals, wherein an attacker gains access to a remote system and an IP address is necessarily exposed to the target system, is it at reasonable to pursue ...
105
votes
12answers
29k views

How can I punish a hacker?

I am a small business owner. My website was recently hacked, although no damage was done; non-sensitive data was stolen and some backdoor shells were uploaded. Since then, I have deleted the shells, ...
29
votes
6answers
36k views

At what point does “hacking” become illegal? (US)

Hypothetical situation: before I hire a web development company I want to test their ability to design secure web apps by viewing their previous client's websites. Issue: this situation raises a big ...
1
vote
1answer
538 views

What regulations *require* multi-factor authentication?

What industries require multi-factor authentication? Please include the following information: Country Industry Regulation name Additional information as you see relevant. Some additional ...
1
vote
1answer
137 views

What browsing history exactly would police have under proposed UK law change? Plain english

It's very unclear what '12 months' browsing history being kept by network provider' actually means to an uninformed person. Thunderbird? VPN? Startpage searches? Bit-torrent downloads? Epic browser (...
0
votes
0answers
44 views

What are good templates for an Image Upload policy?

I'm building a collaborative directory for events, where users and events will have their public profiles, each one with at least a main picture. For users, that picture may come from their social ...
0
votes
0answers
31 views

Under UK data protection act, who is reponsible for ensuring the data is transmitted to the data processor securely

Preamble: I'm being reference-checked by a company. This company has asked me to send them my personal details (like NI numbers) via email (unsecured; unencrypted: big no-no). (To avoid side-tracking ...
2
votes
1answer
139 views

How do VPN services in the US choose to comply with foreign law enforcement requests? [closed]

Imagine a user from Russia uses a VPN-service which obeys US jurisdiction. This user did violate Russian legislation and the violation is being investigated by Russian law enforcement. Let's assume ...
3
votes
1answer
65 views

I'm concerned a website I use is vulnerable - getting vulnerabilities fixed (UK) [duplicate]

I'm a paying customer of a service. I can't change provider without damaging my own business. I believe the website is vulnerable to very basic vulnerabilities (url tampering (IDOR)) that would ...
-5
votes
2answers
211 views

How much can the police find about me with only my IP?

So yesterday I had a conversation with a friend. Apparently he had an argument with an other user in a forum, and while both exchanged bad words the other guy told him. I have your IP and mail and ...
6
votes
1answer
183 views

How far a VPN service is legal? Does it makes my data vunerable for hackers?

Today, in Brazil, the government suspended by judicial requirement the WhatsApp application for 48 hours. It is a messaging app that works only via Internet connection (3G, 4G, WiFi...) and not by ...
4
votes
1answer
132 views

Legal insurance for penetration testers

I am currently finishing university and I am looking for work as a penetration tester. How important is it to have legal insurance for me in Germany and do I need to organise this privately. Of ...
27
votes
4answers
2k views

Are anti-virus companies companies regularly committing software piracy?

As Mikko Hypponen highlighted in a recent tweet, anti-Virus companies collect and store both samples of malicious software and samples of legitimate software: This got me to thinking, what ...
2
votes
1answer
102 views

Strategy for electronic document (PDF) signatures

I'm treading into the murky waters of electronic document signatures, and I'm having trouble figuring out the right approach to deal with my requirements. I think this should be pretty straightforward,...
33
votes
7answers
5k views

Is it illegal to read an e-mail that was accidentally sent to you?

I'm not sure if this is the right website to ask this but I'm giving it a shot. I got the following message in an email today: (it's translated so sorry for the typo's/mistakes) This e-mail and it'...
7
votes
2answers
116 views

Have there been successful class action lawsuits due to infosec breaches?

Whenever there is a major security breach affecting consumers, often large costs are quoted (e.g. 35 million for TalkTalk). One reason given for these large costs is the potential for affected people ...
2
votes
1answer
103 views

In the context of advanced electronic signatures, what does “sole control” mean?

To satisfy the conditions for an advanced or qualified electronic signature, the power to sign must remain under the "sole control" of the signatory. Can anyone provide concrete examples of what this ...
1
vote
0answers
11 views

EU Data Retention Directive and the Draft Investigatory Powers Bill 2015 [closed]

Was the EU Data Retention Directive ever transcribed into English law? If so, the Draft Investigatory Powers Bill 2015 would appear to be somewhat moot?
2
votes
3answers
58 views

Is accessing carelessly not protected data of any service unlawfull? [closed]

The following scenario: I just visited the webpage of an phisshing company of an german service which is here in germany acting at least not unlawfull, but just trying to get money for not even giving ...
4
votes
2answers
351 views

Has a plaintext password ever been used in a court of law as evidence to a crime?

Regardless of how the password was obtained (decryption, bad hashing, confession): Are there any prior known cases where the contents of the password was used to prove motive or guilt? Or, looking ...
0
votes
2answers
330 views

Am I legally required to give passwords or keys for encypted data during an criminal investigation? [closed]

During an investigation where one is a suspect or one may have information about a suspect, is one required to relinquish passwords or keys to personal encrypted data to the authorities? For ...
13
votes
2answers
763 views

How does the Copyright Alert System work? Who has implemented it?

Some ISPs are participating in a Copyright Alert System that notifies content authors of violations of their copyright. I'm concerned how this oversight relates to my private traffic, and what laws ...
2
votes
1answer
222 views

What is the current U.S. law regarding the building of and deployment of honeypots? [closed]

I have lots of links to information on the topic that I've gathered published since the mid-2000s and this SANS document has always been my goto: http://www.sans.org/reading-room/whitepapers/legal/...
4
votes
2answers
630 views

Google Account Compromised - Possible Investigation?

This morning, I've not been able to login to my Google Account. Google says, my account has been compromised and I had to walk through account credentials recovery and verify (SMS to verify phone ...
1
vote
1answer
106 views

Legal: ISP Compromised DNS [closed]

Background: A rural wireless ISP configures all their customers equipment to point to their own nameservers. For the past 2 months or so their primary name server has intermittently been serving ...
0
votes
4answers
173 views

Is 100% anonymity possible with Tor under certain circumstances? [duplicate]

Tor has guidelines that define a set of rules/techniques to assure anonymity. Some examples are browsing in small window mode so your screen resolution can't be detected, using HTTPS everywhere, and ...