Is it legal to forge a Permission to Attack during a physical penetration test engagement? When doing penetration testing (hired as a security consultant to examine and test a company's security by simulating an attacker), it's necessary to have a document called &quot;Permission to Attack&quot; (PtA) which outlines the scope of your actions and gives you explicit authorization to perform them. The same is true with physical pentesting where the pentester emulates physical attackers (even to the point of picking locks and forging access credentials, assuming it authorized in the scope). One must have the document with them in case they are &quot;caught&quot; by the organization's security. On the Information Security site, the answer to a question about this suggests that it could be better to first forge the document and, if it is accepted by security, you continue on your way and document security's failure to stop you (since a real criminal could have forged the document as well). If, on the other hand, they don't accept the forged document, then you provide the real document. The following is from the accepted answer (emphasis in original): If you don't have your Permission to Attack with you, it's like driving without a driver's license. That said, if you are caught during an engagement, I recommend the following: Present a forged Permission to Attack. This way, you can see if criminals could possibly trick a security guard to letting them do their thing with a fake Permission to Attack. Present the real Permission to Attack. If a guard has not bought your fake slip, then it's time to hand in the real slip. If the guard believes you, it's time to pick up and leave the perimeter. A real attacker would have been stopped at this point. If the guard did not believe you, ask them kindly to talk to their supervisor. If they insist on not believing you and calling the police, so be it. You're not a criminal, so don't worry about it. Are there any circumstances under which this would be illegal?
california It's legal, because the pentester doesn't have the intent to defraud. California Penal Code Section 470 governs forging documents, signatures, handwriting, etc. All of its provisions making actions illegal begin with &quot;Every person who, with the intent to defraud...&quot; Because the company itself is aware of and has authorized their actions, the pentester isn't attempting to defraud the company whose premises they are attempting to enter. They are providing forged documents to the guard (who isn't aware of the test), but a real attacker doing that would be attempting to defraud the company, not the guard. Of course, as with any otherwise-illegal action taken during a penetration test, this assumes that the agreement with the company granted the pentester permission to take that action (i.e., that it was in scope for the test).
If there's a reason to believe that your machine has data that would be relevant to a lawsuit, then yes, it is subject to inspection under Fed. R. Civ. P. 34: A party may serve on any other party a request ... to produce and permit the requesting party or its representative to inspect, copy, test, or sample the following items in the responding party's possession, custody, or control: ... any designated documents or electronically stored information—including writings, drawings, graphs, charts, photographs, sound recordings, images, and other data or data compilations—stored in any medium from which information can be obtained either directly or, if necessary, after translation by the responding party into a reasonably usable form. So if there's a lawsuit where there becomes a question about what you downloaded from the network, then it's quite plausible that your device could be demanded or subpoenaed. But that's not the same thing as &quot;forfeiting&quot; your device. The normal procedure in such a case would be that the agency's lawyers would notify you of the demand, and you would take your device to an ESI expert, who would make a digital image of the device's hard drive. The parties would then fight about what portions of that image they are allowed to access, but you would have your device again while that was going on.
Illegal weapons Weapons are defined and are made illegal by statute. In many states, it is illegal to possess brass knuckles. For example, California penal code 12020(a)(1) makes it illegal to possess "any metal knuckles", "writing pen knife", "any leaded cane", among other things. I don't know of any state where it is illegal to pick up a stick, or keys, etc. So, yes, there is a legal distinction between your four scenarios. The mechanic is committing a crime by merely possessing the brass knuckles. The others are not committing a crime by the mere possession of the things you mention (unless there are states where they've been made illegal). Effect on a self-defense analysis Courts would have the jury go through the same self-defense analysis in each of these cases, regardless of the legality of the weapon used. We've described that analysis here. A pure self-defense analysis does not factor in the legality of the weapon that is used. But, if the weapon has been made illegal because of its disproportionate ability to injure, etc. that might weigh against the reasonableness of the force that was used when choosing to use that weapon in self-defense. Possession of an illegal weapon might also weigh against the credibility of the owner of that illegal weapon.
Your confusion might be caused by the fact that even with a contract, only the data necessary for that contract is covered under the GDPR. So yes, while there might be an &quot;execution of contract&quot; under the T&amp;C, this would only cover necessary data. That means you can't ask arbitrary signup data under the guise of a contract. If you need to deliver a physical product, you can store a physical address. If it's an online service, you can store an email address or similar handle. But you can't mix the two. A physical address is unnecessary for the execution of a contract that's not physical in nature. Now, you mention &quot;consent&quot;. Under GDPR, this is a distinct justification besides &quot;execution of contract&quot;. You might have consent to store a physical address in addition to an online address, e.g. if you offer a customer to physically mail a password request form. This consent is additional to the contract. Also note that the bit above only covers the lawful reasons for the processing of personal data (article 6). You also have to obey the other GDPR rules, e.g. fully inform the user, make sure that consent is freely given, etc.
The issues here are fraud and false documents (forgery). While the mere possession of false documents is not necessarily a crime, the use of false documents in order to obtain a financial advantage is fraud, which is a crime defined by statute in all states. States may also have specific provisions relating to the possession of falsified documents, but generally it is not criminal unless the possessor is aware it is a false document, and that it will be used to secure some advantage. Fraud For example the Crimes Act 1900 (NSW) s192E states: (1) A person who, by any deception, dishonestly: (a) obtains property belonging to another, or (b) obtains any financial advantage or causes any financial disadvantage, is guilty of the offence of fraud. Forgery Additionally, s253 of the same Act states: A person who makes a false document with the intention that the person or another will use it: (a) to induce some person to accept it as genuine, and (b) because of its being accepted as genuine: (i) to obtain any property belonging to another, or (ii) to obtain any financial advantage or cause any financial disadvantage, or (iii) to influence the exercise of a public duty, is guilty of the offence of forgery. Maximum penalty: Imprisonment for 10 years. ... and s255 (also see s254, which contains very similar provisions for the actual use of false documents): A person who has in his or her possession a false document, knowing that it is false, with the intention that the person or another will use it: (a) to induce some person to accept it as genuine, and (b) because of its being accepted as genuine: (i) to obtain any property belonging to another, or (ii) to obtain any financial advantage or cause any financial disadvantage, or (iii) to influence the exercise of a public duty, is guilty of an offence. Maximum penalty: Imprisonment for 10 years. ... and s307C: (1) A person is guilty of an offence if: (a) the person produces a document to another person, and (b) the person does so knowing that the document is false or misleading, and (c) the document is produced in compliance or purported compliance with a law of the State. Maximum penalty: Imprisonment for 2 years, or a fine of 200 penalty units, or both. (2) Subsection (1) does not apply if the document is not false or misleading in a material particular. (3) Subsection (1) does not apply to a person who produces a document if the document is accompanied by a written statement signed by the person or, in the case of a body corporate, by a competent officer of the body corporate: (a) stating that the document is, to the knowledge of the first-mentioned person, false or misleading in a material particular, and (b) setting out, or referring to, the material particular in which the document is, to the knowledge of the first-mentioned person, false or misleading. (4) The burden of establishing a matter referred to in subsection (2) or (3) lies on the accused person.
They must comply with your restrictions, via the principle that consent can be withdrawn. One relevant Supreme Court case is Walter v. US 447 US 649, which declares that When an official search is properly authorized—whether by consent or by the issuance of a valid warrant—the scope of the search is limited by the terms of its authorization Likewise in Florida v. Jimeno, 500 U.S. 248, A suspect may, of course, delimit as he chooses the scope of the search to which he consents. In US v. Williams, No. 16-3547, 2018 U.S. App. LEXIS 21304 (3d Cir.), the court elaborated that a consensual search satisfies the mandates of the Constitution only if conducted within the boundaries of the consent given. This recognition establishes that it is the subject of a consensual search who decides the terms of the search. and furthermore, That a party may terminate a search by withdrawing his consent is a corollary of the recognition that the subject of a consensual search determines the parameters of that search. Bear in mind that you have to be crystal clear on any limits on the scope of a search. If this is more of a business call (the electrical inspector) and not a search, they don't have any special powers to enter your house. If the inspector enters your basement study without permission, that is trespassing, but you can't sue him because of that unless there was actual damage done. You can complain to his superior.
It might or it might not be fraud. The outcome will depend on how the facts and evidence are interpreted at trial. A more general version of this question is: If two parties discuss and orally agree to X; then sign a contract that states they agree to Y, what are the parties bound to? X? Y? Or something else? In your version, X is a fraudulent statement. And Y is an obfuscated writing. One party will argue fraud. The other will argue not fraud on the basis that all the facts were disclosed in writing. The party alleging fraud will carry the burden of proof. The standard of proof will be preponderance of evidence (more than 50%). Generally speaking, written evidence outweighs oral evidence if not accompanied by substantiating facts. Substantiating facts could be: emails or other written correspondence, a prior history or pattern of making false claims to others regarding this investment, the respective behavior of the parties after the agreement was made or anything else that corroborates the oral testimony presented at trial.
Since your consent is not required in Texas, revocation is irrelevant. Restrictions of use of recordings flow from the legal nature of the recording itself, so there is no provision saying, for example, that only one party needs to consent for just recording, but all parties must consent to make any use of the recording. Since these laws were devised to regulate the practice of wearing a wire and collecting evidence of crimes, requiring consent from all parties would be counterproductive to the purposes of the law. You could try drafting a contract where you pay people to not record you (anybody who doesn't sign, you shouldn't talk to them), but enforcement could be tricky, so I would not try a DIY contract: get a lawyer. You would have to show that you were harmed by them making an unconsented recording. It should be in the form of a contract where you give something of value in exchange for something of value, which is a thing typically enforced by the courts. Also bear in mind that even in an all-party state, if you know that you are being recorded, you cannot just say &quot;I do not consent&quot;, you have to stop talking. Continuing to talk when notified that there is or may be a recording constitutes implied consent, which is why on the phone companies often announce via recording that the conversation may be monitored, and they do not ask &quot;Do you consent&quot;. By not hanging up, you consented.