We are putting together a service for use both internally and for our clients using GoPhish to test users' awareness of phishing. Basically, the users will receive a phishing email and we will measure how many users open the email, click links, and disclose information.

I have two concerns from a legal perspective (we are based in the UK and only have UK based clients).

1) If I put together an email that looks like it comes from Amazon, could they sue me for using their brand without permission?

2) In order to conduct the campaign we will need to store users' names, email addresses and other information. Once GDPR comes into effect we would need consent to store these details (AFAIK), but if we ask the user first that defeats the objective. Is there any way around this restriction?

closed as off-topic by Lucas Kauffman, Steffen Ullrich, Serge Ballesta, Tobi Nary, AJ Henderson Aug 22 '17 at 12:21

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Lucas Kauffman, Steffen Ullrich, Serge Ballesta, Tobi Nary, AJ Henderson
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Since these are purely legal question they are off-topic. Please try at law.stackexchange.com instead. – Steffen Ullrich Aug 22 '17 at 9:05

As the author of SelfPhish, I can weigh in on some things that might help without offering legal advice.

  1. Using a company's logo without permission is always a problem. But why use another company's logo and site? Why not use a site for which you can get permission? Like your own site or the site of your clients?

  2. What's your objective? Will you not announce to the users that you will be phishing them? If you are planning to not do this, you are in trouble from an education standpoint anyway. Do not use phishing as a predatory activity; it should be an education and awareness activity, and that means telling them what you are going to do. Surprises will only result in problems and complaints.

In general, I don't think you have thought through this service and what you hope to achieve. If you want to show users how stupid they are, then you are on the right track, but the value of this activity is dubious. You need to treat this as an education activity, and education requires participation, not entrapment.

  • 1
    + 1000. The human interaction in such cases (letting them know that tests will occur in a near future) is very, very important. If you plan to do an awareness session on that topic, try to make it so your users will not avoid or consider suspicious EVERY email - could backfire – niilzon Aug 22 '17 at 9:21

I am not a law expert. But I suggest you check your local cyber security rules and law on "research", which might waive the liabilities, not on abuse of brand, but the phishing simulation.

  1. Make Spear phishing your primary phishing criteria. Because it is an explicit target social engineering attack.

  2. Make well known brand phishing (e.g. DHL, Amazon) as secondary criteria and be creative. You don't need a 100% looks alike phishing page.

Not the answer you're looking for? Browse other questions tagged or ask your own question.