If a company employs a security company to 'hack' into their systems and agrees to allow this security company to send fake phishing emails to employees...

...is that company (or the security company) legally liable if - in the process of falling for one of the phishing emails - an employee enters personal social network credentials which are then used (perhaps via logging into non-company systems) to gain entry to the company's (client's) systems?

  • 1
    If they use credentials for a third party service (e.g. Facebook), then probably yes. Pentesting requires an agreement between the pentesting party and the "attacked" party. There was no agreement with the third party. – S.L. Barth - Reinstate Monica Dec 7 '17 at 13:12
  • 5
    This is more of a legal question than an IT security question. – baldPrussian Dec 7 '17 at 14:21
  • @baldprussian Where would be a better SO place to ask? – Matt W Dec 7 '17 at 15:41
  • 1
    It might be appropriate for Law, but it needs some work before it fits there. First, that site does not give legal advice - they are mainly about clarification of the law. So if this is about a real incident, you need to see a legal expert and be prepared to pay - Stack Exchange can't help you there. The "What is on-topic" for Law Stack Exchange is here. They'll probably want you to specify a jurisdiction. Also, be sure to show any prior research you've done. Good luck! – S.L. Barth - Reinstate Monica Dec 7 '17 at 15:56
  • 1
    It all depends on why you need the answer for this question. If you're thinking of engaging Penetration Testers or have encountered this issue with Penetration Testers, then this is a question for your (in the US) corporate counsel. If it happened to you, then I'd suggest visiting an attorney; many offer free initial consultations. – baldPrussian Dec 7 '17 at 16:25

This falls under the Testing Scope and all parties in a penetration test should anticipate the discovery of protected data and private credentials in the course of the test.

YOUR defined expectation as the client should be the explicit and reasonable assurance that any garnered data and social media credentials will be used within the confines of the scope and remain private and in the custody of the penetration testers for the duration and a stated period of time after the test completion and solely for the purpose of documenting the results.

If YOUR particular environment allows an employees access to corporate materials via their personal social media credentials, THEN YES you should include that within the scope of the engagement. The pentesters shouldn't do anything illegal against the social media provider themselves and hopefully they already know that !

An explicit clause of effective destruction of your garnered data, private credentials and all any "trophies" and any other of your internal materials you advance them or they capture will be destroyed no later than an agreed upon date and with a well known and industry accepted data wiping method of your approval.

There is no contractual agreement that insulates your pen tester from illegal activity, if they behave foolishly, illegally with those captured social media credentials, they'll be subject to applicable legal consequences both civil and criminal. The client (YOU) will have no say in their prosecution.... if something like that ever occurred.

| improve this answer | |
  • 1
    Outside of foolish or illegal behaviour by the pentester, would the employee who fell for the phishing attack have a legal case against either the pentesting company or their employer simply on the basis that their social media credentials - and possible actual login - were used without their consent? – Matt W Dec 7 '17 at 15:44
  • if the login/account is company related, it's company owned and the employee doesn't really have grounds. If it's a personal account, maybe? it would certainly be unethical for the pentesters to actually use non-company accounts (i.e. actually log into them rather than just collect data). Whether it was illegal would probably depend on jurisdiction and employee contracts. – K.B. Dec 7 '17 at 15:50
  • For the sake of example, imagine an email asking for a twitter login and the pentester using that login (which the user/company employee happens to use on their company account/s as well) to login to an otherwise secured resource to gain access. If the pentester actually logs into the twitter (or some other personal, non-company) account in order to gain extra information used to test-access company resources, is the pentester liable (because they accessed non-company assets/resources/accounts) for action by the individual? – Matt W Dec 8 '17 at 10:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.