Legal Issues Inwards Penetration Testing

---

Nov 26, 2013

By Mark Rasch
When I was a little growing upwards inwards the Bronx, a high schoolhouse buddy got a project equally a “security tester” at the Alexander’s subdivision store on Fordham Road. His project was to shoplift. This was to run across whether the safety personnel were doing their job, or were asleep at the switch. On his firstly twenty-four hours at work, he successfully shoplifted for several hours, until at the halt of the day, he was caught. When detained, he showed the safety guards his (temporary paper) ID card, as well as he was promptly beaten up. He wasn’t sure as shooting whether he was beaten because the guards didn’t believe that he was working for administration at the time, or because he was.
The even out illustrates or so of the dangers associated alongside penetration testing.  While at that topographic point are many practical issues, at that topographic point are many legal issues that  pen testers must address,  preferably earlier they commence an engagement.  What follows is a brief primer on things to consider.

1. Legal Authority

Let’s confront it, when you lot are engaged inwards pen testing, you lot are inwards a feel “breaking in” to a reckoner or reckoner network.  Of course, ethical hackers would only travail to penetrate a organization at the behest of the possessor or operator of the system, or otherwise assay systems alongside the actual or implied consent of someone alongside authority.
There are many dissimilar types of pen tests.  Influenza A virus subtype H5N1 software code review for vulnerabilities tin give notice live on percentage of a pen test.  Influenza A virus subtype H5N1 ping sweep tin give notice live on percentage of a pen test.  Influenza A virus subtype H5N1 probe or exploit.  Influenza A virus subtype H5N1 configuration review.
Computer criminal offence laws, similar xviii USC 1030 acquire inwards a criminal offence to access or travail to access a reckoner or reckoner network without authorization or inwards excess of authorization.  What constitutes “authorization” as well as who tin give notice authorize such access tin give notice rapidly acquire muddy.
Thus, safety professional person Scott Moulten conducted a pen assay on a Georgia city’s safety when they wanted to link their network to the network of the County for which Moulten was working to furnish e911 services.  Moulten performed a port scan as well as throughput assay on that city's network to run across if the computers were vulnerable to exploit.  When Moulten’s port scan revealed important vulnerabilities, he reported them to his employer as well as its customer, the County.  Embarrassed past times the findings, the metropolis called the Georgia Bureau of Investigation, which searched as well as seized his computer, as well as arrested him for violating the Georgia reckoner criminal offence laws. The statute inwards query makes it a felony to occupation a reckoner alongside the intention of "obstructing, interrupting, or inwards whatsoever agency interfering alongside the occupation of a reckoner programme or data... regardless of how long the alteration, damage, or malfunction persists." Since the port scan infinitesimally slowed the computer, the regime supposed, Moulten violated the statute.
Similarly, Stefan Puffer, a Houston reckoner safety consultant conducted a “war driving" exercise, alongside the caput of the Harris County's Central Technology Department as well as a reporter for the Houston Chronicle. Puffer demonstrated that the Harris County clerk's office's 802.11b network was misconfigured to allow anyone to receive got access to the network.  Puffer claims that he stopped the exercise when he saw the misconfiguration.  Harris County discovered pornography on i of the computers, as well as after  all the County employees denied whatsoever involvement, they arrested Puffer for hacking.  Tens of thousands of dollars of legal bills later, a jury acquitted Puffer inwards all of xv minutes.
When Bret McDanel discovered that his one-time employer was continuing to advertise equally “secure” an electronic mail service that had a important vulnerability, as well as a service that the one-time employer refused to fix, he decided to accept action. He emailed users telling them virtually the vulnerability as well as directed them to his ain website for information virtually the vulnerability.  McDanel was non only prosecuted, but convicted as well as served sixteen months inwards jail, after which the Department of Justice conceded that the conviction was wrongful.
So the lesson learned hither is that penetration testing, fifty-fifty when authorized, tin give notice number inwards a host of legal trouble.  Pen Testers must brand sure as shooting that they receive got written, signed as well as clearly enunciated authorization to demeanour their tests.
Get Out of Jail Free
Before commencement a pen test, the parties should motion into into a contract indicating precisely what the pen testers volition do (and volition non do) as well as the hit of IP addresses, subnets, computers, networks or devices that volition live on the bailiwick of the pen test. If the assay includes a software review or decompiling, brand sure as shooting that the copyright to the software permits (or does non prohibit) the contrary technology scientific discipline or code review. The pen tester should acquire a “get out of jail free” carte from the customer, specifically indicating non only that the pen testing is authorized, but too indicating that the client has the legal ascendance to authorize the pen test.  If a cloud client authorizes a pen tester to assay their network inwards the cloud, this does non hateful that the cloud provider has authorized the test. The cloud provider could become after the pen tester for unauthorized access.
Another practical job for pen testers is getting the orbit of the pen assay wrong.  If a client provides an wrong (or incorrectly transcribed) hit of IP addresses to live on tested, as well as the pen tester tests against these IP addresses, the pen tester may detect himself or herself on the wrong halt of an FBI investigation, or a hack-back.  The province of affairs is fifty-fifty worse if the client provides a right IP address range, as well as the pen tester attacks the wrong IP addresses.  Ooops.

2. Damage Control

Another legal number that  comes upwards inwards pen testing, specially when pen testing is conducted on a production or alive system, is the potential impact a pen assay may receive got on the users of the system. So when conducting a pen test, it is of import to notify the client inwards writing virtually the potential harm, harm or disruption that may hap fifty-fifty when a pen assay is performed  perfectly.  This “harm” or “damage” may include harms or damages resulting from the  responses of users to the pen assay itself (including their attempts to remedy problems.) The client needs to sympathise that a pen assay tin give notice disrupt a brittle system, as well as that they assume the liability associated alongside conducting the test. This includes non only “ordinary” damages, but too “consequential” as well as “incidental” damages equally well.

3. Indemnification

Okay, so you lot receive got a contract that specifically authorizes the pen test, as well as you lot receive got agreed that you lot volition non live on liable for damages you lot cause.  But so at that topographic point are those pesky 3rd parties.  Your pen assay destroys the medical records of or so patient, as well as voila!  They sue you.  In improver to specifying responsibleness for damages, you lot desire the client to indemnify as well as grip you lot harmless for damages resulting from you lot doing what you lot say you lot are going to do.
You demand to consider the orbit of this indemnification.  What if the client provides you lot alongside the wrong IP address range, as well as you lot “hack” the wrong person?  The indemnification tin give notice include the damages from the other organization having to respond and/or secure themselves.  But what  if the FBI kicks inwards the door of i of your pen testers as well as injures (or worse) the pen tester, a colleague or a job solid unit of measurement fellow member because someone reported the pen tester equally a “hacker?”  Who is liable for the damages then?  Again, these are all points of negotiation, but you lot volition non know if you lot do non ask.

4. Hack-back

Sometimes a client volition desire you lot to hack dorsum against an attacker.  Sometimes the client volition process you lot equally the attacker, as well as hack dorsum at you.  The police line treats hacking dorsum the same equally it treats hacking (for the most part.)  It is unlawful.
The same is truthful for pen testing systems that are non inwards the command of the customer.  Be careful here. It is non clear what gives a client the right to authorize a pen test.  Ownership?  Intellectual belongings rights?  Leasing of an IP range?  Licensing of software?  It is i thing to “own” a house, or so other to rent it.  In addition, when doing a pen test, what are you lot testing?  Physical security?  Logical security?  Software security?  Software configuration?  Hardware configuration? Settings?  Does the fact that a companionship leases hardware, licenses software, as well as rents infinite bear upon their mightiness to give consent?  Another number for the lawyers.

5. Scope of Work

Also, a pen assay understanding should specify precisely what volition  and volition non live on done, as well as the assumptions that underlie the agreement.  For example, if the pen assay is merely an “external” vulnerability assessment, nosotros demand to define the perimeter (what is “external”) as well as the orbit of the test.  The same is truthful for an internal pen assay ,what is beingness tested, how as well as for what purpose.  Avoid price similar “state of the art” that receive got no existent meaning, as well as merely elevate expectations.  Nobody as well as I repeat nobody ever uses “state of the art” anything.  By the fourth dimension the understanding is signed, the nation of the fine art has moved on. 
Similarly, you lot demand to define the assumptions that underlie the pen test.  The pen tester volition rely on the client to define which systems demand to live on tested, as well as to a greater extent than importantly, which ones do not.  When Cable as well as Wireless was hacked several years ago, it was equally a number of a certification past times a pen tester that they met a exceptional touchstone for security.  They did not.  The confusion arose when Cable as well as Wireless manifestly told the pen tester that exceptional systems were non hooked to the Internet (or that they were going to live on removed from outward facing domains) as well as thence that they didn’t demand to live on tested.  What nosotros receive got hither is a failure to communicate.
You too receive got to define things such equally  when the pen assay volition live on conducted (what does “off peak” mean?) the nature of the access required to do the pen test, the nature of the cooperation necessary to brand the assay meaningful as well as the orbit (and manner) of notice to live on provided prior to initiating the test.  You do non desire surprises.

6. Professionalism

Another number to live on resolved is the “standard of care” or “professionalism” question.  What sort of pen assay are you lot conducting?  Are you lot just doing a port scan?  Turning on NESSUS as well as leaving?  And what do you lot warrant as well as correspond that you lot volition find?  Influenza A virus subtype H5N1 typical pen assay should warrant that the pen tester volition occupation the type of professionalism as well as skills usually constitute inwards the industry, but non brand promises that the assay volition detect all, or fifty-fifty substantially all vulnerabilities or misconfigurations.  Remember, it is equally of import to document the lack of findings equally it is to document the findings themselves.

7. Licensing as well as Certification

GIAC offers certification inwards penetration testing (GPEN.)  Similarly, IACRB offers certification inwards pen testing proficiency (CEPT.)  The EC Council offers licensing of penetration testers  (LPT.)  But inwards or so states a pen tester may live on required to live on a licensed individual investigator.  Think that is stupid?  It is.  But it may live on the police line depending on why you lot are conducting the pen test.  If you lot are “collecting as well as evaluating electronic records for the purpose of presenting findings inwards court” you lot may live on required to receive got a PI license.  In i extreme Texas case, the companionship that monitors ruby low-cal as well as speeding cameras was constitute to receive got violated the Texas PI licensing statute for precisely that reason. About a dozen states receive got laws that require people engaging inwards sure as shooting types of “investigations” to live on licensed equally a PI inwards that state.  The number typically arises inwards connector alongside reckoner forensics as well as incident response investigations or inwards connector alongside practiced witness testimony.  However, if the purpose of the pen assay is to determine the agency inwards which belongings has been damaged or destroyed (e.g., because of a hack or attempted hack,) so these broadly defined statutes may impact the mightiness to demeanour the test.  Since many of these statutes send civil as well as criminal penalties, it pays to do your homework.

8. Venue as well as Jurisdiction

Another fundamental number inwards pen assay contracts is to determine where the pen assay is beingness conducted.  If a California Company hires a Maryland companionship to demeanour a pen assay on its computers inwards Nebraska, as well as the pen tester launches the assay from Pennsylvania, whose laws apply to the demeanour of the test?  The response typically (but non universally) is whatever laws the parties receive got agreed to.  But if the pen assay goes bad as well as injures a user or client inwards New York, you lot tin give notice bet that they volition desire to apply New York police line if that police line is favorable to them.

9. Privacy Issues

A successful pen assay tin give notice number inwards the pen tester getting into a reckoner or reckoner network that they should non receive got had the mightiness to access.  Also, it may include accessing information or databases which comprise sensitive personal information, credit carte information, personally identifiable information (PII) or Private Health Information (PHI).  The pen assay may expose the tester to sensitive information virtually citizens of the European Union, such equally  sexual orientation or political affiliation, information whose privacy is protected past times law.   Is the access to that information past times the pen tester a “breach” of the database which must live on reported?  Must the pen tester sign a “Business Associate Agreement” agreeing to protect the information they just accessed?  The pen tester must sympathise the orbit as well as extent of their duty to protect all information they access.

10. Data Ownership

One number that rears its caput during pen tests is, who owns the information that results from the test?  Clearly, the pen tester owns the methodology as well as the written report template.  Clearly, the client “owns” the findings as well as recommendations.  But what if the pen tester develops novel methodologies for conducting pen tests or solving configuration problems on the customer’s dime?  Who owns these “works for hire?”  Another affair for the lawyers to resolve.

11. Duty To Warn

Saying that the client owns the written report of the pen assay creates or so other problem.  Networks rarely stand upwards alone.  They are interconnected.   What should a pen tester do if they uncovering major unplugged vulnerabilities that volition impact customers, 3rd parties, or the population equally a whole?  Is their duty only to enjoin the client as well as continue quiet?  What if they uncovering a zero-day vulnerability that may receive got organization broad or manufacture broad impact?  What should they do then?  Even if the client “owns” the data, does this hateful that the client tin give notice command the occupation of the noesis the pen tester obtains?  It’s all a affair of what the contract says, as well as what the Courts volition enforce.
Conclusion
A pen assay understanding seems similar a uncomplicated document.  I volition test, you lot volition pay.  But similar whatsoever agreement, the devil is inwards the details. Competent as well as experienced counsel volition live on necessary to avoid pitfalls. And similar everything else inwards life, let’s live on careful out there.