Ethical Hacking How is Ethical Hacking (Certified Ethical Hackers) defined by U.S. law? Is there any law which protects an Ethical Hacker for helping to find out bugs and security loopholes in online/digital services being used by a corporation/government agency? What is the stand of other countries on this matter?
In regards to U.S. Law to be employed by the government. You would need to be certified to DoDD8570 specs. Here is a baseline to understand what certifications are required depending on the role you are looking to be gainfully employed. These mostly require being GIAC certified among some of the other certifications. In regards to becoming a "Certified Ethical Hacker", you would need to pass the CEH test by the ECCouncil. As for laws protecting "Ethical Hackers", there really isn't any. The law which applies is mostly for prosecuting criminal acts. Not really for the protection of the security consultant. This law is called Computer Fraud and Abuse Act in the U.S. and in the U.K. the Computer Misuse Act 1990.
This question is framed such that it could include myriad different scenarios that could lead to a search of one's personal computer. You seem to gear the bulk of your inquiry toward when the government can search, but then move to when a corporate entity has the right to do so, which is a very different thing. These are different issues with different concepts and rules that dictate when this can occur lawfully. You might want to narrow your question a bit. By way of generalization: the citizens of the U.S. have an implied right to privacy as construed through the Bill of Rights, even though there is no explicit right written into the constitution. The most common way to conduct a search in the U.S. is with probable cause through a search warrant. There are questions and answers both on here, as well as resources all over the internet, pertaining to constitutionally accepted forms of search and seizure such that you could get that information fairly easily. However, as with the U.K., and despite any rights (explicit or implicit), there are many ways your computer could be searched by the government - both known to the owner and unknown - and even remotely, that use means less common to the standard search warrant. As you've probably heard from the revelations of Edward Snowden (Wikileaks), the governments of the world have been shown to search metadata and other electronic records without a warrant under laws aimed toward protecting national security. In the U.S. the Patriot Act gave wide reaching powers to invade the privacy of individuals that required no oversight or basis for doing so. Corporations that deal with the transmission of data work with government entities to to accomplish this end. As one individual has already noted, you subject yourself to search (which includes your computer) upon entry to the country through customs. There are many ways that the government can and does engender to search computers, computer files, emails, metadata, etc. A corporation may search your personal computer under a contractual relationship you create with it (for instance if you work from home and elect to use your home computer, and to do so you elect to agree to allow the entity to inspect your computer for their intellectual property in certain circumstances). They can also do this pursuant to a civil lawsuit, which can allow for the inspection of your computer through the process of discovery. These are just some of the ways your information can become subject to inspection (search) by government or corporate entities. Again, your question would need to be limited more to address any one situation more fully.
You can't own a database; you might, however, own (have) the copyright to a database if you created it or the creator transferred that right to you. You can also possess a copy of a database: the question is whether it is legal. "Leaked" implies that it is taken without permission, so you might be in violation of copyright law by possessing a copy. The only databases that would escape copyright protection would be those US government works, things put in the public domain, and things publically licensed to allow copying. Plus, any database whose content fails to exhibit a modicum of creativity (Feist). A database might be inherently illegal (at least in your hands), so it would depend on what the content is. The first thing that comes to mind is a database from a child-porn website, which contains numerous illegal images: see section 110 of Title 18. "Leaked" information might involve violation of 18 USC 1030 (Computer Fraud and Abuse Act), which prohibits unauthorized hacking. It does not directly prohibit being in possession of a hacked database: but you might still be prosecuted as an accessory after the fact. (That is one of those ad libitum areas of the law where there's no way to know for sure what is and is not "okay"). If they do prosecute you, you might rely on Bartnicki v. Vopper, 532 U.S. 514, where because it was a matter of "public interest", propagation of illegally obtained material was held to be protected by the First Amendment. Also there is the case of the Pentagon Papers. At the federal level, there are no controls over storing credit card information so if you get a copy of the Target or Home Depot hacked database, there's no federal law against that (if we discount "accessory after the fact"), but there are circumstances in Minnesota where retaining such information could be illegal.
Yes. In the United Kingdom it is illegal under the Computer Misuse Act 1990. In other jurisdictions there may not be a law directly aimed at computer crime but if you sell it knowing that a crime is going to be committed with it that makes you an accomplice. Most computer crime is prosecuted under laws not directly aimed at computer misuse.
Like many US legal questions, there is a Congressional Research Service report about this. It is not generally a violation of US law to do things in another country where the only connection with the US is that the offender is a US citizen. However, there are a number of general situations where the US has jurisdiction over federal crimes if either the victim or offender is a US citizen: if a place isn't within the jurisdiction of any country (e.g. Antarctica); a place used by a US government entity (like an embassy or airbase); crimes by American soldiers and those employed by or accompanying the military; etc. These are considered to be within the special maritime and territorial jurisdiction of the US. Other laws apply if they say so. For instance, any US national committing war crimes inside or outside the US can be punished under US law; ditto for treason. The Foreign Corrupt Practices Act makes it illegal for a US national to bribe a foreign official anywhere outside the US for business reasons (if it's inside the US, there are more requirements). For instance, you aren't allowed to pay kickbacks to a foreign government's acquisition officer to buy your product. The CRS report has more (it doesn't include the FCPA, but that appears to be an oversight). Note that extraterritorial jurisdiction doesn't just apply if the person is a US national. US laws can also confer it if the victim is a US national, if the offense has a significant US component, if it's directed towards the US, if it's in violation of international law and the offender later turns up in the US, etc. For your scenarios: Dual citizenship doesn't matter. A US citizen is a US citizen, and is required to obey all laws that apply to US citizens, unless those laws explicitly exempt dual citizens. A dual citizen isn't treated differently by the government; as far as the US government is concerned, their US citizenship is all that matters (except for certain specific purposes like security clearances). In Kawakita v. United States, a US-Japanese dual citizen was convicted of treason against the US for aiding Japan in WWII. Depends. Plenty of these laws have no requirement that anything related to the crime actually happen in the US; for sex tourism, the subsection about traveling in foreign commerce for the purposes of engaging in illicit sexual conduct is followed by a subsection about engaging in illicit sexual conduct in foreign places. "Travel with the purposes of X" or "with intent to X" means you must have intended to do X at the time you traveled, but most extraterritorial laws don't control travel with intent to X (they cover X directly). Depends on the law. Some laws (like child sex tourism) apply to any permanent resident of the US as well as any citizen. Some apply to anyone, because they're based on a conspiracy started in the US. Others apply just to US nationals; a noncitizen isn't bound by them (for instance, no one but a US national can be charged with treason against the US, for obvious reasons). Still others apply to anyone who later turns up in the US, even if that is literally the only connection between the US and the offense (this is basically reserved for crimes against international law, like genocide).
This sounds a bit far-fetched. There are laws against circumventing copy protection measures (DRM) but not against aimbotting (to the best of my knowledge). Thus, you cannot reasonably believe that a click-assist functionality would be used to break laws. It could definitely be used to break private contracts such as an EULA, but you are not a party to that contract and are not bound by its terms. Of course, when you use such click-assist tech in an online game, you might be breaking your contract with the game vendor or server provider. But this doesn't imply that a click-assist would be forbidden outside of that context. Note that assistive technologies sometimes have exceptions from laws, e.g. a permission to circumvent DRM if necessary for accessibility. In the US, the Librarian of Congress adopts exceptions for a duration of three years. While none of the current exceptions match your specific scenario involving video-games, it can be permissible to break DRM on e-books or videos for certain accessibility enhancements.
You wrote: As far as I believe, it is permitted under GDPR to record and store non-anonymized web server access logs, as these can be useful for security reasons. True, Recital 49 GDPR: The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems. You asked: My question is whether this anonymization process counts as processing personally identifiable data under GDPR? IP addresses are personal data in some cases, so yes, you're processing personal data. Then, these anonymized logs will be fed into an analytics tool to provide stats on unique visitors, page hits, etc. These are purposes considered compatible with initial purposes according to Article 5.1.(b): Personal data shall be (...) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for (...) statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’); As a matter of fact, you might be required to anonymize the data for those purposes, see Article 89.1: Processing for (...) statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner. If I were to anonymize the logs and continue to use them exclusively for security reasons, would that change anything? No, you would be processing data in a manner compatible with initial purposes (ensuring network and information security). Or does it not matter what I do with them once they are anonymized? Yes, it does. If you're not using them for &quot;archiving purposes in the public interest, scientific or historical research purposes or statistical purposes&quot; then you're using them for purposes incompatible with initial purposes. You would need to find new legal basis for processing. does this extra anonymization process on top then take it over the line meaning that consent and a privacy notice would be required? It depends on what you want to do with anonymized data. In your case, for security purposes or security and statistical purposes, you don't need the consent and there is no requirement for the privacy notice (but sure, it would be nice to publish one). For other purposes it might be different.
Illegal to write? No. Notwithstanding the First Amendment which would almost certainly make a law prohibiting it illegal, writing such things is an essential part of an IT security professional’s toolkit. You can’t protect against worms if you don’t know how they work. Illegal to distribute on an unauthorised computer? Absolutely. This would be a clear breach of the Computer Fraud and Abuse Act.