Related to the laws and regulations imposed by governments, the enforcement of those laws, and legal and judicial process including investiagtion and trial.

learn more… | top users | synonyms (1)

24
votes
8answers
3k views

What makes it illegal to use the information learned by exploiting a bug?

According to news reports, arrests have already been made in relation to the Heartbleed bug. It sounds like this person managed to gain access to the website's database by capturing the credentials ...
0
votes
0answers
7 views

Does analyst API Flurry break Australian Privacy Act or any other Legal, Regulations, Compliance?

I want introduce Flurry API in my iOS app. But I heard since 2014 Australia start an act to against web page and mobile app to collect user information. My question is simple: Does using of API ...
0
votes
1answer
36 views

Legality of adding malice to an open source software? [closed]

With the heartbleed bug in the news recently and after reading Bruce Schneier's commentary on the issue I started wondering if there would be any legal implications for intentionally adding malice to ...
-2
votes
1answer
30 views

Privacy vs monitoring cyber crime [closed]

So , how does the police find/monitor criminals' actions (eavesdropping) that do cyber crime(pornography , drug trafficking etc..) without breaking their privacy, and succesfully catch em and provide ...
1
vote
2answers
103 views

How could police identify digital contraband and charge someone if it's encrypted with keys?

For example, say I am transferring heavily-encrypted DVD/Blu-ray movies/game copies over the internet. However, I am using double or (+) encryption with keys required to decrypt the file using an ...
-1
votes
1answer
47 views

How can an ISP throttle encrypted connections? [closed]

I have had experience with an ISP that slows down all encrypted connections (down to an average 20-35 KBps) I was wondering if a) this is legal b)how can they do it and c) is there a way to bypass it. ...
132
votes
7answers
24k views

What are the implications of NSA surveillance on the average internet user?

It would appear as though the tinfoil hat-wearing were vindicated today, as news broke of the true scale of the U.S. government's surveillance of its citizens' online activities, conducted primarily ...
3
votes
1answer
287 views

Are voluntary / manual DDoS illegal?

Since DDoS is simply a group of subjects coming together to send requests to a particular server, is it true to say that a voluntary DDoS is perfectly valid and legal in US? By that, I mean that a ...
4
votes
2answers
533 views

NaCl: US Export Regulations

I'm in charge of a product security in our US based startup and I plan to use NaCl for encryption (well, Sodium, actually). I'm trying to navigate the labyrinth of US export regualtions - something I ...
2
votes
1answer
96 views

Legality of downloading leaked hashes / attempt cracking [closed]

Note: I realize there is no legally binding talk hereinafter. There are lots of leaked password hashes on the internet. Twitter searches for "hash dump" pull back tons of links, generally from "deep ...
2
votes
2answers
112 views

Where is the Line? [closed]

A comment posted on one of my questions the other day raised a question in my head. I know that many site admins appreciate users reporting bugs and security holes, and as a user I appreciate people ...
44
votes
17answers
3k views

Can we still provide confidentiality when cryptography is outlawed?

In certain jurisdictions, use of cryptography by the private sector is limited: e.g. there are reports that in the UAE and other countries not all of the encryption capabilities of the BlackBerry are ...
0
votes
2answers
40 views

Contents retrieved from a not protected url from content owner's server. Legal? [closed]

Is legal to use contents retrieved from a not protected url (no authentication involved, just a public accessible URL) from the content owner's server? Is legal to distribute urls pointing to that ...
4
votes
3answers
333 views

Protect our payroll data from a legal and moral obligation

We have our payroll software to be installed on our file server. This contains all the details of current and past employees. The data contained in the payroll software includes tax, bank, National ...
2
votes
2answers
103 views

Is it possible to make a “proof of anteriority” for sites content?

Given a site that publishes unique content online and given that there are lots of site scrapers and persons stealing content and reposting it as their own, inevitably you will have the same content ...
4
votes
2answers
212 views

What are the consequences for deceptive practices against stated privacy policy

Disclaimer: I'm aware my question is a bit far from IT security practices but here is the most appropriate place I can think of to post my question within the whole stackexchange. Let's say, many ...
1
vote
3answers
157 views

Tell and sell a (web app) vulnerability legally

If someone discover an unknown vulnerability for a given online service or website, is there a decent way to sell it directly to the concerned entity.
4
votes
3answers
174 views

Is there any reason in particular encryption keys aren't arbitrarily large?

It's my understanding that the more bits an encryption key has, the longer it takes to break the encryption. What is the down side of having a larger encryption key or why don't we see keys of size ...
4
votes
4answers
7k views

What are the laws regarding ISP recording IP addresses? How would they know who had which?

Since most internet users have ISPs using dynamic IP addresses (e.g. someone gets a new external IP address every few days) are there any laws requiring the ISPs to keep logs associating an IP address ...
2
votes
2answers
73 views

Should digital forensics examiners avoid the term “evidence” outside legal proceedings? [closed]

This is what the authors of the book "Digital Forensics with Open Source Tools" say about the term evidence: The examiner reveals the truth of an event by discovering and exposing the remnants of ...
1
vote
1answer
103 views

Is it legal to publish viticim's password and email?

With so many identities stolen last ten years, we know a bunch of emails and a bunch of passwords. Are the two following databases legal under the US federal laws? Publish a database which victim's ...
3
votes
1answer
504 views

What are the implications of running a TOR non-exit relay node?

Intuitively, running a non-exit TOR node should bring the benefit of plausible deniability that a packet originated from your device. Unlike exit nodes however, you would not have to worry about ...
9
votes
1answer
765 views

Best way to report a foreigner attacker's ip to authorities?

I have been under attack last week and I was able to trace down the attacker and get his IP address. The attacker was located in Germany but I live out of Europe? From your experience what is the ...
18
votes
5answers
2k views

Can ECC be used without infringing on patents?

Can ECC (Elliptic Curve Cryptography) be safely used without infringing on Certicom's patents? I would like to make use of ECC in an embedded system to establish a secure channel. But, I am concerned ...
1
vote
0answers
127 views

Encrypted chat using any smartphone. Is it legal? [closed]

Here's my case. We have written app for Android smartphones which allows users to exchange secured cipher messages. For key-exchange we're using elliptic curve 112 bits, for messaging we're using DES ...
1
vote
3answers
189 views

Is there a law against one email containing both a login and a password?

I see most companies either supply a login or a password in an email, but never both in one email. Is this a "best practice" or is there an actual law that prevents legitimate companies from providing ...
0
votes
1answer
31 views

Export Restriction of wrapper for existing crypto library

I am creating a packaged C++ library for creating http/https clients/servers. As part of that, I am planning on using either the botan (http://botan.randombit.net/) or openssl tls wrappers. My ...
16
votes
2answers
2k views

In the SilkRoad takedown, what does it mean “An IP address was leaking” in Tor?

According to the official complaint, on Page 28 they mention: on May 24, 2013, a Silk Road user sent him a private message warning him that "some sort of external IP address" was "leaking" from ...
0
votes
2answers
288 views

Is it illegal to use Fake User-agents? [closed]

Is it illegal to impersonate user-agents when you are crawling a website? If so, what and how a legal action can be taken against the faking requester? Is this law applies only for crawlers or a user ...
4
votes
1answer
410 views

Avoid being implicated in criminal activity when using Tor

What steps does a Tor user need to take to ensure that he or she doesn't become implicated in other Tor users' criminal activity? For example, I recently came across a Tech Republic article by ...
22
votes
6answers
8k views

Sharing wifi at a business - Bad Policy?

Is it safe for a small business to let customers use their wifi while waiting? My friend is starting up a small dentistry practice (1 dentist), and I'm setting up his computers/wifi as a favor. ...
1
vote
1answer
145 views

Which cloud providers can be used for the simulation of DDoS attacks? [closed]

Cloud providers have a great infrastructure to perform DDoS simulations. You can get thousands of virtual machines with different IP addresses, fully customizable with the tools you need for testing. ...
0
votes
2answers
96 views

Germany: Privacy Protection Regulations and Response [closed]

Do privacy protection laws within Germany/EU protect students from gross invasions of privacy? I have reason to believe that through some either permitted or unsanctioned channel my teacher was able ...
1
vote
1answer
162 views

Incentives to Support Adoption of the Cybersecurity Framework

The US White House has just release the subject blog post link here which suggests adoption of this proposed new cyber insurance might be rewarded by liability limitations including "reduced tort ...
-1
votes
1answer
123 views

In which country can you host a service which honors privacy?

Recent events like the Lavabit case have shown that it is no loger possible to host a server in the United States and guarantee your users that you will keep their data confidential, because the US ...
1
vote
2answers
207 views

What are some examples of legal action taken as the result of a security breach? [closed]

As of late, there's been lots of reports of companies losing data due to "hackers". More often than not, this just boils down to lax security. I am looking for concrete examples of a breech where ...
95
votes
7answers
5k views

Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in production unintentionally during a pentest?

Today I experienced a situation where a person responsible for the security of a company required a pentesting company to withdraw a clause in the contract that says that: "during the pentest there ...
15
votes
3answers
356 views

What expectation of privacy is there with US-based vendors with the LavaBit and SilentCircle shutdown?

Lavabit hosts a secure messaging service that was recently shut down. Likewise SilentCircle has preemptively done the same thing with their email-based service. It seems that the justification for ...
-3
votes
1answer
404 views

Track IP address of criminals [closed]

Quite recently someone had maliciously stolen my pictures and created a fake Facebook and Instagram in my name, with abusive captions under my pictures. However, with the advice from the police, I had ...
1
vote
0answers
31 views

Should we protect web application source code from being stolen by web hosts through obfuscation? [duplicate]

Is it worth to obfuscate a java web app source code so that the web host cannot make wrong use of the code & probably even steal your business. If, so how to deal with this or how to obfuscate ? ...
7
votes
4answers
2k views

Can a VPN avoid the Prism Surveillance Programme?

This is causing me major concern and i can understand it is for a lot of users as well. I have nothing to hide but it's the moral aspect of snooping which has ticked me off. Can a VPN avoid the ...
3
votes
1answer
388 views

To get security clearance, do I need to be national of the country?

For example, if I want to apply to a job based in UK which requires security clearance, can I only do so if I'm a British national? What if I'm from another country belonging to the EU?
75
votes
12answers
11k views

How can I punish a hacker?

I am a small business owner. My website was recently hacked, although no damage was done; non-sensitive data was stolen and some backdoor shells were uploaded. Since then, I have deleted the shells, ...
-2
votes
1answer
113 views

US Export Laws (Encryption Cloud Service) [closed]

Okay - so I have been extensively looking into US export/import laws relating to encryption software (5D992), however I have a few questions about the laws and their applicability. So, the laws ...
-4
votes
1answer
185 views

Can I develop an SSH client for iPad in Sweden and sell it in Apple App Store? [closed]

I wonder, if I am allowed to develop an SSH client for distribution through Apple App Store without breaking any export regulations? I don't really know much about the encryption algorithm. Below is a ...
-7
votes
3answers
185 views

Is it legal to hack a website that distribute my copyrighted materials? [closed]

I sell some .pdf files online. But soon they are all over the web because after someone buys the .pdf and puts it on various websites. Is it legal to hack those websites? Are there other ways to ...
2
votes
2answers
213 views

What may a Hungarian employer do with the employee monitoring logs?

Employers often monitor employee network access, even install keyloggers on their computers, etc. But the articles I found on the internet, is about the monitoring but not what they may do with the ...
2
votes
3answers
687 views

Have the police placed a bug on my line [closed]

As a pretty dedicated anarchist, rule-breaker and malcontent, I often find myself at odds with the British police. I have been the subject of 3 searches (that I know of) over the last 8 months ...
1
vote
1answer
115 views

Licensing/selling digital certificate to another company

I recently stopped distributing my software, so I no longer use the digital certificate (AKA digital signature) I created for it. A couple of days ago, a large software company offered to buy the ...
28
votes
8answers
3k views

Is it legal to find bugs on a website and report them to the website's owner?

I'm from Canada, and I'd like to know one thing. I know a bug on one website. I'm not sure if it's legal here to search for bugs on a website and NOT use them; instead, tell its company about it.