I know it's a big no-no in terms of etiquette, but is it illegal in Canada to perform penetration testing against a commercial company without authorization?

prompted by: http://news.nationalpost.com/2013/01/20/youth-expelled-from-montreal-college-after-finding-sloppy-coding-that-compromised-security-of-250000-students-personal-data/

P.S. My understanding is that he could probably be charged under a number of articles (most of which aren't specific to the IT realm).

  • 2
    Welcome to IT Security! This is really more of a legal interpretation question, which since we are not as a rule lawyers we try to avoid. Please have a look at our FAQ to get a better idea for what we do focus on. – Scott Pack Jan 22 '13 at 16:36
  • 5
    Legal or not, I would claim that penetration testing without target consent is discourteous and thus unworthy of civilized individuals. – Thomas Pornin Jan 22 '13 at 16:38
  • @ThomasPornin: Uncontested. – Scott Pack Jan 22 '13 at 16:44
  • I would say that insecurely storing private data for thousands of students is discourteous and unworthy of a professional. =p – Don Simon Jan 22 '13 at 16:46
  • While I'm not giving legal advise, it's very clear that the people involved in the story were trying to save face after it was found the software they were selling to many schools had flaws. – Hamman Samuel Mar 7 '17 at 8:16

Since we are not, and do not aim to provide, legal advice (since we're not lawyers) this is a really hard one to talk about. That being said, it is generally considered a good idea to obtain written permission from the organization, signed by someone within the organization who is authorized to sign such things, permitting you to perform any kind of scan or penetration test. Without that authorization there is a very fine line between "I was checking to see if the fix had been made without malicious intent" and "I was checking to see if the fix had been made with malicious intent".

Within Canada the most likely relevant portions are going to be Section 184 and Section 342 of the Criminal Code of Canada. I won't attempt to interpret the contents, since quite frankly I'm scared of the potential of accidentally giving legal advice.

The short of the matter is that whether or not the kid was criminally liable for what he did he was, in my opinion, a fool for not obtaining permission before conducting a vulnerability assessment/penetration test.

| improve this answer | |

It would take a lawyer (or several) to give a true answer to your question, and I am not entitled to give legal advice in any way. However, in most countries, penetration testing without target consent tends to attract legal trouble, in the same way that going down the street and trying the clutch of all house doors to see which ones open is risky. Even in countries where trying the clutch would not be illegal (but only entering the house would be), you would have a hard time explaining to the cops and judges that your suspicious activity was not done with immediate malicious intent.

To use an even more graphic (and approximate) analogy: if you rush towards another person (let's call him Bob) while brandishing a big knife, but a cop grabs you before the deed is accomplished, you might try to say to the judge: "But it is not proven that I was trying to kill Bob; I just wanted to see if it was possible to stab him, but I would of course have stopped right before piercing Bob's skin. The cop intervention was unnecessary.". My bet is that the judge won't be convinced.

To sum up, law matters are intricate, but it does not take a lawyer to predict that penetration testing without target consent can end with you being prosecuted, with no surefire legal escape way. Whether this is good is another debate (extreme libertarians would claim that any open server is fair game for any kind of penetration testing, and even downright intrusion and data plunder).

| improve this answer | |

You always require a written agreement from the target. In the UK penetration testing companies have lawyers and pre-determined agreements which are including the names, the IPs, the time (hours) of the target and some of them also include the types of tools that will be used.

So, I'd state that even if I'm not a lawyer, you are likely to loose the case if you get caught and if the target didn't know what you where doing. There are many cases of people testing security and ending up in front of court, so I wouldn't recommend doing it anyway.

One new example Student Expelled for Hacking After Investigating Security Hole

However, some companies such as Facebook and Google have bounties to find bugs, so in this case it is legal to test the security and to look out for flaws such as XSS and SQLi.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.