Related to the laws and regulations imposed by governments, the enforcement of those laws, and legal and judicial process including investiagtion and trial.

learn more… | top users | synonyms (1)

-5
votes
0answers
96 views

Would it be illegal if one downloaded the entire internet? [closed]

Say it was theoretically possible for someone with enough money/resources/etc. to download every HTML file, resource, video, image, markup data, scripts, code, whatever, etc. off of every server for ...
3
votes
1answer
382 views

Are voluntary / manual DDoS illegal?

Since DDoS is simply a group of subjects coming together to send requests to a particular server, is it true to say that a voluntary DDoS is perfectly valid and legal in US? By that, I mean that a ...
2
votes
2answers
76 views

Penetration testing's terms of agreement template

My company is going to start to provide penetration testing services pretty soon, in fact, we are just missing the legal aspects of it. I'm wondering if is there any template which states the most ...
2
votes
1answer
113 views

Is it legal to “use” security vulnerabilities [closed]

I understand that the answer to questions like this depend on country, but I'd like to get an idea what the usual approach to cases like this are. Heres the case: I found a security hole in one of ...
1
vote
0answers
73 views

Traveling abroad with encryption software on my computer [closed]

I have software installed on my computer that has encryption capabilities. This is the case both for things like VPN/SSL, and also GPG. I don't really use GPG (there are not that many people I can use ...
0
votes
2answers
65 views

Are files hosted on cloud servers/websites/databases manually checked by people?

I was wondering ... when I upload a file to, say, Dropbox, does anybody personally check it to see what it is? Say I upload a copy of my Blu-ray movie to cloud storage ... will anyone check, and ...
2
votes
2answers
106 views

Does SMIME differ from TLS, PGP, DMARC signature, or a Portal Encrypted email message in terms of legal non-repudiation?

I'm interested in protecting email messages from NSA-style snooping, but don't want to incur additional legal risk in doing so. In other words, does SMIME encryption and/or signing cause a given ...
0
votes
2answers
43 views

Content of a penetration testing authorization

Recently I conducted a penetration testing where I used the following text as authorization: Penetration testing authorization During a penetration testing is possible that: The ...
0
votes
2answers
108 views

Is it legal to create a remote administration tool? [closed]

I'm planning to make a simple remote administration tool with the basic features that are available on all other rats in the market. However, I'm really worrying about legal issues after marketing it. ...
9
votes
1answer
1k views

Best way to report a foreigner attacker's ip to authorities?

I have been under attack last week and I was able to trace down the attacker and get his IP address. The attacker was located in Germany but I live out of Europe? From your experience what is the ...
1
vote
2answers
156 views

Is it illegal to publish an exploit against a known vulnerability in US?

Is it illegal to publish an exploit against a known vulnerability in US? The exploit could be published in one's blog or places like exploit-DB. It seems that in countries like Germany and France such ...
0
votes
3answers
117 views

Are VPNs/proxies legal? [closed]

Are VPNs/proxies (and VPN/proxy software such as Tunnelblick and Hola) legal in the U.S., assuming that you are doing legitimate activities on the Internet (i.e. nothing illegal)?
1
vote
2answers
40 views

Can I save & store a user's data in a way that proves that the information has not been altered, and that the timestamp is accurate?

There are many situations where the validity of the timestamp attached to a certain post (submission of information) might be invaluable for the post owner's legal usage. I'm not looking for a service ...
1
vote
3answers
94 views

How does a GSM triangulation work? [closed]

A have always been told that to get a geolocation of mobile phones there is the need 'ping' it with at least three cells. So actually, a standard and basic triangulation would just get from three ...
2
votes
1answer
132 views

Are legal notices in a login banner legally significant in terms of computer misuse?

Is there any case-law where having or not having a legal notice (example here) in the login banner of a system of nay kind made a difference in prosecution? The question is in consideration both of ...
1
vote
1answer
103 views

What companies drive around recording license plates? What do they do this for and on what grounds are they able to do so, legally speaking?

A friend shared a "security service" he just read about. Apparently the product is in beta and can thus be tried by anyone right now. I found it very interesting and surprising. I'm curious to know ...
5
votes
5answers
2k views

Encryption laws in India — is it allowed to use ssh and VPN?

I have a very similar question to the one asked here (regarding Iran). However, I would like to use ssh and vpn while being in India. I found already this survey of cryptographic laws but I don't ...
47
votes
13answers
6k views

What makes it illegal to use the information learned by exploiting a bug?

According to news reports, arrests have already been made in relation to the Heartbleed bug. It sounds like this person managed to gain access to the website's database by capturing the credentials ...
0
votes
0answers
23 views

Does analyst API Flurry break Australian Privacy Act or any other Legal, Regulations, Compliance?

I want introduce Flurry API in my iOS app. But I heard since 2014 Australia start an act to against web page and mobile app to collect user information. My question is simple: Does using of API ...
-3
votes
1answer
50 views

major US cybersecurity laws/policies since 2000? [closed]

I am reading Cybersecurity and Cyberwar by P.W. Singer, and trying to tie the subject in with a government class project. I am looking laws and policies regarding cyberspace or cyber security, passed ...
2
votes
5answers
630 views

What happens with a subpoena and a system designed to protect itself from you?

After reading about the recent Dropbox issue I'm starting to wonder if they could legally keep their initial promise. Lets say that you're like Dropbox or Lastpass and you store users' information in ...
0
votes
1answer
94 views

Are there maximum allowed key size in USA?

I've heard using encryption outside military use had been illegal during a long time in USA. However I've also heard that when the regulation was updated, limits were puts on encryption strength such ...
-2
votes
1answer
42 views

Privacy vs monitoring cyber crime [closed]

So , how does the police find/monitor criminals' actions (eavesdropping) that do cyber crime(pornography , drug trafficking etc..) without breaking their privacy, and succesfully catch em and provide ...
1
vote
2answers
136 views

How could police identify digital contraband and charge someone if it's encrypted with keys?

For example, say I am transferring heavily-encrypted DVD/Blu-ray movies/game copies over the internet. However, I am using double or (+) encryption with keys required to decrypt the file using an ...
-1
votes
1answer
112 views

How can an ISP throttle encrypted connections? [closed]

I have had experience with an ISP that slows down all encrypted connections (down to an average 20-35 KBps) I was wondering if a) this is legal b)how can they do it and c) is there a way to bypass it. ...
137
votes
7answers
25k views

What are the implications of NSA surveillance on the average internet user?

It would appear as though the tinfoil hat-wearing were vindicated today, as news broke of the true scale of the U.S. government's surveillance of its citizens' online activities, conducted primarily ...
4
votes
2answers
597 views

NaCl: US Export Regulations

I'm in charge of a product security in our US based startup and I plan to use NaCl for encryption (well, Sodium, actually). I'm trying to navigate the labyrinth of US export regualtions - something I ...
2
votes
1answer
188 views

Legality of downloading leaked hashes / attempt cracking [closed]

Note: I realize there is no legally binding talk hereinafter. There are lots of leaked password hashes on the internet. Twitter searches for "hash dump" pull back tons of links, generally from "deep ...
2
votes
2answers
119 views

Where is the Line? [closed]

A comment posted on one of my questions the other day raised a question in my head. I know that many site admins appreciate users reporting bugs and security holes, and as a user I appreciate people ...
44
votes
17answers
3k views

Can we still provide confidentiality when cryptography is outlawed?

In certain jurisdictions, use of cryptography by the private sector is limited: e.g. there are reports that in the UAE and other countries not all of the encryption capabilities of the BlackBerry are ...
0
votes
2answers
48 views

Contents retrieved from a not protected url from content owner's server. Legal? [closed]

Is legal to use contents retrieved from a not protected url (no authentication involved, just a public accessible URL) from the content owner's server? Is legal to distribute urls pointing to that ...
4
votes
3answers
383 views

Protect our payroll data from a legal and moral obligation

We have our payroll software to be installed on our file server. This contains all the details of current and past employees. The data contained in the payroll software includes tax, bank, National ...
2
votes
2answers
114 views

Is it possible to make a “proof of anteriority” for sites content?

Given a site that publishes unique content online and given that there are lots of site scrapers and persons stealing content and reposting it as their own, inevitably you will have the same content ...
4
votes
2answers
220 views

What are the consequences for deceptive practices against stated privacy policy

Disclaimer: I'm aware my question is a bit far from IT security practices but here is the most appropriate place I can think of to post my question within the whole stackexchange. Let's say, many ...
1
vote
3answers
195 views

Tell and sell a (web app) vulnerability legally

If someone discover an unknown vulnerability for a given online service or website, is there a decent way to sell it directly to the concerned entity.
4
votes
3answers
200 views

Is there any reason in particular encryption keys aren't arbitrarily large?

It's my understanding that the more bits an encryption key has, the longer it takes to break the encryption. What is the down side of having a larger encryption key or why don't we see keys of size ...
4
votes
4answers
9k views

What are the laws regarding ISP recording IP addresses? How would they know who had which?

Since most internet users have ISPs using dynamic IP addresses (e.g. someone gets a new external IP address every few days) are there any laws requiring the ISPs to keep logs associating an IP address ...
2
votes
2answers
88 views

Should digital forensics examiners avoid the term “evidence” outside legal proceedings? [closed]

This is what the authors of the book "Digital Forensics with Open Source Tools" say about the term evidence: The examiner reveals the truth of an event by discovering and exposing the remnants of ...
1
vote
1answer
115 views

Is it legal to publish viticim's password and email?

With so many identities stolen last ten years, we know a bunch of emails and a bunch of passwords. Are the two following databases legal under the US federal laws? Publish a database which victim's ...
3
votes
1answer
1k views

What are the implications of running a TOR non-exit relay node?

Intuitively, running a non-exit TOR node should bring the benefit of plausible deniability that a packet originated from your device. Unlike exit nodes however, you would not have to worry about ...
20
votes
5answers
2k views

Can ECC be used without infringing on patents?

Can ECC (Elliptic Curve Cryptography) be safely used without infringing on Certicom's patents? I would like to make use of ECC in an embedded system to establish a secure channel. But, I am concerned ...
1
vote
0answers
156 views

Encrypted chat using any smartphone. Is it legal? [closed]

Here's my case. We have written app for Android smartphones which allows users to exchange secured cipher messages. For key-exchange we're using elliptic curve 112 bits, for messaging we're using DES ...
1
vote
3answers
197 views

Is there a law against one email containing both a login and a password?

I see most companies either supply a login or a password in an email, but never both in one email. Is this a "best practice" or is there an actual law that prevents legitimate companies from providing ...
0
votes
1answer
35 views

Export Restriction of wrapper for existing crypto library

I am creating a packaged C++ library for creating http/https clients/servers. As part of that, I am planning on using either the botan (http://botan.randombit.net/) or openssl tls wrappers. My ...
16
votes
2answers
2k views

In the SilkRoad takedown, what does it mean “An IP address was leaking” in Tor?

According to the official complaint, on Page 28 they mention: on May 24, 2013, a Silk Road user sent him a private message warning him that "some sort of external IP address" was "leaking" from ...
0
votes
2answers
338 views

Is it illegal to use Fake User-agents? [closed]

Is it illegal to impersonate user-agents when you are crawling a website? If so, what and how a legal action can be taken against the faking requester? Is this law applies only for crawlers or a user ...
4
votes
1answer
469 views

Avoid being implicated in criminal activity when using Tor

What steps does a Tor user need to take to ensure that he or she doesn't become implicated in other Tor users' criminal activity? For example, I recently came across a Tech Republic article by ...
23
votes
6answers
9k views

Sharing wifi at a business - Bad Policy?

Is it safe for a small business to let customers use their wifi while waiting? My friend is starting up a small dentistry practice (1 dentist), and I'm setting up his computers/wifi as a favor. ...
1
vote
1answer
175 views

Which cloud providers can be used for the simulation of DDoS attacks? [closed]

Cloud providers have a great infrastructure to perform DDoS simulations. You can get thousands of virtual machines with different IP addresses, fully customizable with the tools you need for testing. ...
0
votes
2answers
110 views

Germany: Privacy Protection Regulations and Response [closed]

Do privacy protection laws within Germany/EU protect students from gross invasions of privacy? I have reason to believe that through some either permitted or unsanctioned channel my teacher was able ...