Related to the laws and regulations imposed by governments, the enforcement of those laws, and legal and judicial process including investiagtion and trial.

learn more… | top users | synonyms (1)

0
votes
1answer
47 views

Why doesn't Google uninstall or report, installed pirated apps? [closed]

Why doesn’t Google do anything about pirated apps? It seems really easy to catch the users. You could go to a website and download an apk for an app which you normally pay for in the play store. ...
-2
votes
3answers
136 views

Would accessing an unprotected IP camera be considered illegal in most countries? [closed]

Context: You might have heard about Shodan, the website that acts as a web search for devices accessible from the Internet: home cameras, nuclear plants, crematorium, you name it. On it you can find ...
0
votes
0answers
28 views

Need computer forensic case citation (urgent) [migrated]

My mother is about to attend court over a car which was written off by a lorry. The CCTV video recording of the accident was mishandled, such as the storage SD card not being imaged, it was also ...
0
votes
3answers
62 views

Is anyone held responsible if a VPN/proxy that doesn't log is used for illegal purposes?

How do the anonymous VPN services work? It’s my understanding that if an internet connection is misused for something (such as downloading copyright material or hacking a network etc) then the person ...
-2
votes
1answer
67 views

Can government query company, such as Google, to get list of accounts associated with some information, such as IP address or phone number? [closed]

UPD: My naive thought was that government requests should explicitly point account for which they requesting information. And that a broad requests like getting list of accounts logged during some ...
52
votes
9answers
4k views

How should I tell school that they are vulnerable when I wasn't given permission to check? [duplicate]

I would like to report security weaknesses to my school in UK. I had managed to find security weaknesses without any exploits or other software or hardware. I had look at similar question however ...
9
votes
4answers
1k views

How to determine if a VPN provider respects data confidentiality?

I've read about why I really should use a VPN and I've been looking into different providers, but there's one thing I'm worried about. Can't a VPN provider just look at my traffic all they want and ...
1
vote
1answer
41 views

Is it possible to give legal value to signed web services?

The context is using digitally signed webservices (with XML-DSIG for example) for e-government interoperability between databases. The idea is to give endorsement to both the data publisher and the ...
12
votes
1answer
1k views

Should I sign someone else's code?

I'm working on a product that includes 3rd party drivers for some of the product's hardware. Some of the drivers are not signed, others are only signed with sha1 certificates. Given that getting new, ...
34
votes
1answer
3k views

How did FBI/DoJ retrieve the data stored on the encrypted iPhone?

Quote from The New York Times: The Justice Department said Monday that it had found a way to unlock an iPhone without help from Apple, allowing the agency to withdraw its legal effort to ...
8
votes
2answers
795 views

Implications of the proposed Burr-Feinstein senate bill? [closed]

It has been rumoured (I guess it is more than a rumour) that senators Burr and Feinstein will be introducing legislation requiring companies to provide the government (with warrants) access to encrypt ...
-2
votes
1answer
89 views

How to legally jailbreak an iPhone? [closed]

I'm looking to jailbreak my work phone to pen test iOS applications. From a compliance point of view I've got the green light as long as I don't go on our companies intranet with it or put company ...
5
votes
3answers
335 views

Are documents truly “signed” by DocuSign?

I've never been happy with the explanation DocuSign gives for themselves in their own marketing material (e.g. https://www.docusign.com/how-it-works/electronic-signature/digital-signature/digital-...
3
votes
2answers
194 views

“fake” phishing mails from CST

I work in the computer security team of my company and my team leader ask me to send "fake" phishing mails to my colleagues. The mails intended to lure them into clicking on the embedded links (the ...
-3
votes
1answer
555 views

What is suspected to be on the famous encrypted iPhone? [closed]

Quite a big deal is being made about Apple's refusal to decrypt an iPhone used in a terrorist attack. What is suspected to be on the device? If the crime has already been committed and the dead buried,...
1
vote
0answers
62 views

Where can I find example or template security testing contracts? [closed]

I'm a lawyer interested in information security, and am collecting templates and examples of security testing agreements to compare. What are some publicly available examples, or nuggets of wisdom ...
3
votes
2answers
122 views

When is it worthwhile to pursue a hacker?

With respect to "interactive" attacks by individuals, wherein an attacker gains access to a remote system and an IP address is necessarily exposed to the target system, is it at reasonable to pursue ...
0
votes
0answers
38 views

What are good templates for an Image Upload policy?

I'm building a collaborative directory for events, where users and events will have their public profiles, each one with at least a main picture. For users, that picture may come from their social ...
0
votes
0answers
29 views

Under UK data protection act, who is reponsible for ensuring the data is transmitted to the data processor securely

Preamble: I'm being reference-checked by a company. This company has asked me to send them my personal details (like NI numbers) via email (unsecured; unencrypted: big no-no). (To avoid side-tracking ...
2
votes
1answer
120 views

How do VPN services in the US choose to comply with foreign law enforcement requests? [closed]

Imagine a user from Russia uses a VPN-service which obeys US jurisdiction. This user did violate Russian legislation and the violation is being investigated by Russian law enforcement. Let's assume ...
3
votes
1answer
65 views

I'm concerned a website I use is vulnerable - getting vulnerabilities fixed (UK) [duplicate]

I'm a paying customer of a service. I can't change provider without damaging my own business. I believe the website is vulnerable to very basic vulnerabilities (url tampering (IDOR)) that would ...
-5
votes
2answers
195 views

How much can the police find about me with only my IP?

So yesterday I had a conversation with a friend. Apparently he had an argument with an other user in a forum, and while both exchanged bad words the other guy told him. I have your IP and mail and ...
6
votes
1answer
178 views

How far a VPN service is legal? Does it makes my data vunerable for hackers?

Today, in Brazil, the government suspended by judicial requirement the WhatsApp application for 48 hours. It is a messaging app that works only via Internet connection (3G, 4G, WiFi...) and not by ...
4
votes
1answer
131 views

Legal insurance for penetration testers

I am currently finishing university and I am looking for work as a penetration tester. How important is it to have legal insurance for me in Germany and do I need to organise this privately. Of ...
2
votes
1answer
98 views

Strategy for electronic document (PDF) signatures

I'm treading into the murky waters of electronic document signatures, and I'm having trouble figuring out the right approach to deal with my requirements. I think this should be pretty straightforward,...
2
votes
1answer
98 views

In the context of advanced electronic signatures, what does “sole control” mean?

To satisfy the conditions for an advanced or qualified electronic signature, the power to sign must remain under the "sole control" of the signatory. Can anyone provide concrete examples of what this ...
7
votes
2answers
116 views

Have there been successful class action lawsuits due to infosec breaches?

Whenever there is a major security breach affecting consumers, often large costs are quoted (e.g. 35 million for TalkTalk). One reason given for these large costs is the potential for affected people ...
1
vote
0answers
11 views

EU Data Retention Directive and the Draft Investigatory Powers Bill 2015 [closed]

Was the EU Data Retention Directive ever transcribed into English law? If so, the Draft Investigatory Powers Bill 2015 would appear to be somewhat moot?
4
votes
0answers
101 views

Is there any way a website can show it hasn't been “hijacked” by the authorities? [closed]

I heard about warrant canaries and thought the idea was interesting. My understanding of what they are is a website or online service publishes a statement periodically that they have not been served ...
1
vote
1answer
134 views

What browsing history exactly would police have under proposed UK law change? Plain english

It's very unclear what '12 months' browsing history being kept by network provider' actually means to an uninformed person. Thunderbird? VPN? Startpage searches? Bit-torrent downloads? Epic browser (...
2
votes
3answers
55 views

Is accessing carelessly not protected data of any service unlawfull? [closed]

The following scenario: I just visited the webpage of an phisshing company of an german service which is here in germany acting at least not unlawfull, but just trying to get money for not even giving ...
0
votes
2answers
322 views

Am I legally required to give passwords or keys for encypted data during an criminal investigation? [closed]

During an investigation where one is a suspect or one may have information about a suspect, is one required to relinquish passwords or keys to personal encrypted data to the authorities? For ...
1
vote
1answer
106 views

Legal: ISP Compromised DNS [closed]

Background: A rural wireless ISP configures all their customers equipment to point to their own nameservers. For the past 2 months or so their primary name server has intermittently been serving ...
0
votes
4answers
172 views

Is 100% anonymity possible with Tor under certain circumstances? [duplicate]

Tor has guidelines that define a set of rules/techniques to assure anonymity. Some examples are browsing in small window mode so your screen resolution can't be detected, using HTTPS everywhere, and ...
1
vote
0answers
253 views

USA PATRIOT Act and Office 365

I have a local Exchange server, which has several spam and email reception issues (Due to an expired subscription to a spam filtering system). I was looking at the Office 365 Exchange Online ...
29
votes
5answers
8k views

Can FBI or government agencies get hold of my Google Docs files just by confiscating my laptop? [closed]

Assume the following: I am doing all my work, including the one with sensitive information on Google Docs. No documents are stored on local hard drive. I am not using the Google Drive App, just ...
2
votes
0answers
70 views

What is the cost of CALEA in the US? (Lawful intercept) [closed]

The Computer Assistance for Law Enforcement Act (CALEA) is a law in the US that provides for lawful intercept of communications by law enforcement (namely, the FBI). Specifically, as I understand it: ...
1
vote
1answer
127 views

In the United States, when can someone legally search my personal laptop? (Government or private security) [closed]

Unlike the United Kingdom, U.S. citizens don't have an explicit right to privacy in the Constitution. Although there are implied privacy rights within "penumbras" of the Bill of Rights this has ...
1
vote
2answers
253 views

Is HTTPS required when there's no sensitive data in the site

I'm currently building a B2B e-commerce site for a client using WordPress. We sell industrial machinery ranging in the upper $100k-$400k price range. My client would like to have their financing form ...
1
vote
2answers
120 views

Could I ever be legally required to decrpyt user information? [closed]

Suppose I host some web app which stores information about its users. In the interest of confidentiality, that information is stored in an encrypted format. Under what circumstances could a legal ...
2
votes
1answer
54 views

Are there any examples of when personal email data can be brought into a lawsuit involving a corporation?

If users bring their own device (BYOD) and they have corporate Exchange (or Goodlink email) on that device, could the other email accounts on that device be open to a legal search? Would the SMS ...
6
votes
1answer
148 views

What are the compliance requirements or standards for a non-US firm hosting personal data in the US?

I work for a head hunting company with offices in Canada and Asia. We migrated our custom built CRM system from our own servers hosted in Japan to an Amazon hosting service meaning that all our data ...
1
vote
3answers
171 views

A neighbor is using a WEP encrypted router, should I inform them of the security risk? [closed]

Someone in my neighborhood is using a WEP encrypted wifi router. I am not sure who they are yet, but if I find out, should I inform them of the security risks which that poses or are there any legal ...
4
votes
3answers
472 views

What countries have strong data protection laws?

Many answers on this site and other security-related websites state that one should host sensitive data in a country with strong data protection laws. What countries are these, and how is this ...
-6
votes
3answers
154 views

Is using netcat illegal? [closed]

Is using netcat to connect with a server that one does not own, illegal? For example, using netcat to connect with a web server and querying GET / HTTP/1.1 etc. I am asking this question because ...
0
votes
2answers
660 views

Encryption Laws in India

Is cryptography legal in India? If yes, then what type of encryption is not allowed?
3
votes
0answers
136 views

Is there a way my organization can collect clients' sensitive documents without being liable for them? [closed]

I am the head of IT for a microlending organization. We make small loans to new businesses, and as such we have to collect these clients' tax returns and other financial data as part of the ...
3
votes
1answer
148 views

Are Keystroke and Click Loggers Legal? [closed]

I worked with the firewall "Nobero" which is paid and bit expensive. It is a complete Network Firewall including groups policy, banning URLs and social sites. But It has a feature of tracking users' ...
2
votes
1answer
290 views

Are internal patient identifiers considered PHI under HIPAA?

We use GUIDs to internally to identify patients in our system. I'm having a debate with our regulatory people on whether these identifiers can be used in query strings to REST calls. They are ...
-3
votes
1answer
116 views

Data security is not perfectly possible, laws exist but no one uses them. What is missing on international level? [closed]

In my country (Austria) I was a member of the team that made laws for protecting the personal data of every person. In the meantime I realise that we have the laws but nobody claims them in ...