What is the ethics and legality of developing and using a tool to grab data on employees in the client's company in social networks such as facebook, twitter and linkedin. The data should then be used in a pentest in social engineering attacks.

Data could be grabbed via the API, or maybe web scraping.

  • 6
    You covered this in your contract and get out of jail free card, right? If it's not in scope ... better not to do it without renegotiating the engagement.
    – adric
    May 11, 2012 at 20:18

2 Answers 2


Legality depends on local laws that will change and are subject to interpretation. Best to consult a local lawyer who specializes in these matters. For example, data privacy law in the EU is quite strict about notifying people before aggregating data about them.

Ethically, its best to have been given explicit permission by the individuals to aggregate their information before doing so. In your scenario, its probably best for say your client to give you permission to aggregate the specific data about their employees for your pen test purposes. For your client to ethically give you permission, they should have previously explicitly obtained permission from their employees that included letting third parties (such as yourself) aggregate the data for these sorts of purposes.

  • Thanks, what about the legality of the act of grabbing the data from the social network? Would the social networks allow it?
    – h00j
    May 11, 2012 at 18:17
  • 3
    @HenryHoggard The legality of grabbing data from social networks is addressed in the first paragraph of this answer. In short, consult a lawyer and/or look up your current, local laws on the matter.
    – Iszi
    May 11, 2012 at 18:46
  • 1
    @Henry - If the data is publicly available and you have the users explicit permission to download it, I don't see any ethical reasons against aggregating it (though a social network may have policy forbidding robots trawling their site). However if the data is private, social networks like facebook have fought against employers demanding access to it as an invasion of privacy.
    – dr jimbob
    May 11, 2012 at 19:46
  • So linkedin public and twitter is okay, but maybe not facebook?
    – h00j
    May 11, 2012 at 21:10
  • @HenryHoggard - Why would it be allowed for twitter but not Facebook. Both my twitter and facebook are non-public profiles. Unless you have permission of the user you are scrapping data from you could have a problem, even if your "client" gave you permission, your client cannot give you permission to scrap their employee's profiles.
    – Ramhound
    May 14, 2012 at 16:27

As a contracted penetration tester you have a moral obligation to provide the best service you can provide within the bounds of local law and your pre-engagement agreement (in that order).

That said, do your fact checking and get legal advice from legal professionals and make sure to discuss the matter with your employer. They may not be comfortable with you pursuing their employees in this manner. Companies are not always comfortable with social engineering.

Even if you decide not to for whatever reason (legal/moral compass), still discuss the matter with your employer, make sure they know you are limiting the scope of the test to exclude social engineer or these intelligence gathering tactics. It's important they stay informed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .