How to go about learning cyber security if possessing such software (hacking software) is highly and explicitly illegal in my and most countries? A question for &quot;ethical hackers&quot; or cyber security professionals. I am very interested in the world of cyber security and all aspects of it. I am genuinely interested in the security aspect of it and from a highly ethical and moral perspective. I have purchased &quot;self-teaching&quot; online courses for learning cyber security, this is also dubbed loosely &quot;ethical hacking&quot;. At this point we should not debate my intentions with such activities and I wish you to take them as genuinely ethical. I do understand that many high level organizations such as the NSA, Intelligence Agencies in many countries etcetera do monitor these activities heavily. Therefore I'm sure any such research would be monitored one way or another--- enough said on that. My question here is, how is it possible to learn in this direction if my country and many others forbid even the possession of software for &quot;hacking&quot; despite intentions? This seems one of the main tools used to learn vulnerabilities and how to defend against them. For ones own security purposes as well as better security for others also and my own software development securities. While I understand the intentions behind such laws being directed at nefarious intentions, what about progress in this direction, what about people who want to enter the field or simply learn for ethical reasons? According to the criminal code of Canada there is no grey area, see first link below. An FYI of how I intended to go about learning &quot;hacking&quot; ethically. By using my computer to break into my old brick laptop and learning from there. I wouldn't use such software to hack anyone else unethically, just not interested. References: https://www.itworldcanada.com/blog/understanding-canadian-cybersecurity-laws-interpersonal-privacy-and-cybercrime-criminal-code-of-canada-article-4/440337 https://devcount.com/is-ethical-hacking-legal/ Criminal Code of Canada
...many [countries] forbid even the possession of software for &quot;hacking&quot; despite intentions That is not the case in the united-kingdom where accessing a computer, and possessing the tools to do it, are only offences if the activity is unauthorised. In fact, private entities and government departments are encouraged to carry out authorised penetration tests to identify vulnerabilities in their systems. [by] using my computer to break into my old brick laptop... This is perfectly legal as you have authorised access to the brick. The relevant offences are at s.1 to s.3A of the Computer Misuse Act 1990, in particular: s.1 - Unauthorised access to computer material. (1) A person is guilty of an offence if— (a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer, or to enable any such access to be secured; (b) the access he intends to secure, or to enable to be secured, is unauthorised; and (c) he knows at the time when he causes the computer to perform the function that that is the case [...] Sections 2, 3 and 3ZA (not reproduced here to save space) follow similar wording for unauthorised access relating to such things as commiting other offences, impairing a computer's functionality, or creating serious damage to health, infrastructure etc. s.3A - Making, supplying or obtaining articles for use in offence under section 1, 3 or 3ZA [...] (3) A person is guilty of an offence if he obtains any article— (a) intending to use it to commit, or to assist in the commission of, an offence under section 1, 3 or 3ZA, or [...] (4) In this section &quot;article&quot; includes any program or data held in electronic form. [...] So, hacking is not always unlawful - all it needs is the right permission from someone who is authorised to give it. Edited To Add This is also the case in canada (the subject of the OP's first linked article) where s.342.2 of the Criminal Code makes an exception for having a lawful excuse to possess &quot;hacking tools&quot;: (1) Every person who, without lawful excuse, makes, possesses, sells, offers for sale, imports, obtains for use, distributes or makes available a device that is designed or adapted primarily to commit an offence under section 342.1 or 430, knowing that the device has been used or is intended to be used to commit such an offence, is (a) guilty of an indictable offence... (b) guilty of an offence punishable on summary conviction. [...] (4) In this section, device includes (a) a component of a device; and (b) a computer program within the meaning of subsection 342.1(2).
It's illegal. 18 USC 1030, the Computer Fraud and Abuse Act, makes it illegal to, for instance, &quot;intentionally access a protected computer without authorization, and as a result of such conduct, cause damage and loss.&quot; A &quot;protected computer&quot; is defined to include any computer &quot;which is used in or affecting interstate or foreign commerce or communication&quot;. This effectively includes every computer in the world that's connected to the Internet (see US v. Trotter, 478 F.3d 918 (8th Cir. 2007). To the best of my knowledge, Congress has not added any exceptions for Russia or any other specific country. It's also likely to be forbidden by the laws of your state. You did not specify a state, but taking Colorado as an example, the following are crimes under C.R.S. 18-5.5-102: (a) Accesses a computer, computer network, or computer system or any part thereof without authorization; exceeds authorized access to a computer, computer network, or computer system or any part thereof; or uses a computer, computer network, or computer system or any part thereof without authorization or in excess of authorized access; or [...] (e) Without authorization or in excess of authorized access alters, damages, interrupts, or causes the interruption or impairment of the proper functioning of, or causes any damage to, any computer, computer network, computer system, computer software, program, application, documentation, or data contained in such computer, computer network, or computer system or any part thereof; or (f) Causes the transmission of a computer program, software, information, code, data, or command by means of a computer, computer network, or computer system or any part thereof with the intent to cause damage to or to cause the interruption or impairment of the proper functioning of or that actually causes damage to or the interruption or impairment of the proper functioning of any computer, computer network, computer system, or part thereof [...] Note that this applies to any target computer, and the prosecution would not have to prove that the computer was used in, or affected, interstate or foreign commerce or communication. Other states most likely have similar laws.
It is probably illegal under Indonesian law for you to launch a cyber-attack on a website that you believe violates Indonesian law, just as it is illegal for you to shoot a person for fraud. The Indonesian government reserves the right to judge guilt or innocence, and to mete out punishment, within Indonesia. It is definitely illegal under US law, also UK law and so on, to launch a cyber-attack on a website for some reason, so you can be prosecuted under the laws of that nation. You should then be concerned with the Law on Extradition (1979), noting that there might be a treaty but also Indonesian law allows extradition on the basis of the interest of Indonesia (as judged by government officials). Indonesian nationals do not enjoy immunity from extradition (as is the case in some countries). There is no extradition treaty between Indonesia and the US; there was one between the UK and Indonesia but I cannot determine whether it is still in force.
There are three main aspects to this: Its their website, and their terms of service. They can enforce those terms, or change them (in some appropriate manner). You have no recourse if they remove you, block you, or delete your account, for example. That's the measure that you would probably have, virtually every time. To claim damages, or litigate beyond just website access control, requires a legal claim. But there's a catch there. To claim damages, they need to show actual damage, which they wish to be compensated for. If you misused their website but no actual harm can be shown, the total damage claimable is zero, whether or not you followed their rules. Merely entering dishonest information isn't by itself harm. So they would have to show they suffered damage/harm because of that, which is directly attributable to your behaviour, was foreseeably harmful etc, or similar. They also need to consider legal costs, and ability to enforce, especially if you are in a different country. If for some reason the computer use was also illegal, then a criminal act could be committed and they could notify law enforcement. For example suppose you did this in the little known country of Honestania, where the law says that to prevent trolling and online abuse, anything posted on social media under any but your own legal name is a crime. Or suppose you'd been banned from the system and ignoring/evading such a ban was criminal computer use or criminal trespass due to the forbidden/unauthorised access (which can happen in several places). But this is purely for completeness; I guess you'd know if you were taking it further, into criminal computer use.
The first sub-question here is whether (public) schools can compel (parents of) students to acquire internet service, a computer, and a webcam. The MA Dept. of Education maintains that public schools must purchase at public expense textbooks and other instructional materials and supplies intended for use and re-use over a period of years, and computers fall in the category of materials intended for schools to purchase and use and re-use. There is no legislative authority to compel parents to purchase equipment or sign up for internet services. If there is a choice between in-person and online instruction, the legal requirement to attend school can be satisfied by in-person instruction. The second sub-question is whether, if a child does have the technical ability to be connected to class via the internet, can they legally require the camera to be turned on? Every district has rules, so if there is a rule requiring parental consent in this situation, then parental consent is required. If it is legal at that level, there is still a legal risk to the school. Schools can generally do those things that are reasonably necessary for educating students as long as it doesn't infringe on fundamental constitutional rights, and the camera-on requirement is educationally reasonable. The risk to the school is violating the federal law FERPA, specifically a potential violation of the privacy requirements. Schools must protect personal information, which includes anything streaming from the camera (pictures, for example, are personally identifiable information). If you assume that they have an absolutely secure connection, then there is no risk of privacy violation. However, if you believe, even reasonably so, that a school practice creates a risk of breach of privacy, that still does not create a special right to avoid school.
It is entirely possible to reach a reasonable level of compliance in a DIY approach, provided that you familiarize yourself with the relevant legal framework. The UK ICO has produced in-depth guidance to help here, which is significantly more digestible than the laws themselves: ICO Guide to the UK General Data Protection Regulation (UK GDPR) For a first reading, it is probably appropriate to focus on the summaries and checklists at the top of each section. You will however notice that GDPR is a lot about principles, and requirements like selecting appropriate compliance measures yourself. On one hand, this means that you have some flexibility in your compliance approach, but it also means also that you can never be sure whether you're actually compliant. But this is also precisely why professional help can be valuable, since compliance professionals probably have a better overview of best practices, state of the art measures, and also potential pitfalls. In some other answers, I have written basic overviews/checklists to get started with a GDPR compliance effort. On to your concrete questions: What is the best strategy to get started with GDPR compliance? This is ultimately a business decision that you have to make. You have to consider how much compliance is worth to you, both in terms of time and money. Maybe you can DIY it, maybe you'll want to get professional help, maybe you'll just hope that no one ever sues you or lodges a complaint. There is no objective optimum, and only you know your particular situation. What are the consequences for unintentional infringement? Not being aware of the rules is not a valid defense (ignorantia juris non excusat). How are fines calculated? The GDPR has two separate enforcement mechanisms: data subjects can sue you for compliance and damages, and the ICO can fine you. Damages are typically small compared to the cost of a lawsuit. When issuing fines, the ICO must consider a variety of factor per Article 83, for example whether the infringement was willful or negligent. The ICO is not required to impose damages, and anecdotally many small problems can be resolved informally before it comes to a full investigation. In particular, the ICO's Regulatory Action Policy 2018 explains that “we will reserve our powers [to issue fines] for the most serious cases, representing the most severe breaches of information rights obligations. These will typically involve wilful, deliberate or negligent acts, or repeated breaches of information rights obligations, causing harm or damage to individuals.” The policy also provides a 5-step process for arriving at fines: removing financial gain, accounting for scale and severity of the breach, considering aggravating factors, ensuring a deterrent for others, and considering mitigating factors. This suggests that a good-faith effort to ensure compliance already goes a long way. When to get professional help? Under some circumstances, the GDPR requires that you appoint a data protection officer, who doesn't have to be an employee. You mention that you do not process sensitive data, so that it is currently unlikely you'd be required to appoint a DPO (compare Art 37, but note that the list of sensitive categories of data in Art 9(1) does not match your examples). The requirement to appoint a DPO depends entirely on the kind and scale of your data processing activities, not on number of employees or revenue thresholds. However, some GDPR compliance obligations like Art 30 Records of Processing Activities can also trigger when you reach 250 employees. Aside from that, it is a business decision whether and when to invest in compliance. Note that if your business offers goods or services to people in the EU/EEA, you may be required to appoint an EU representative. Some law firms offer package deals for DPOs + EU/UK representatives.
In the UK, the law was recently changed to outlaw non-consensual upskirting – without consent is crucial. Canada does not appear to have such a specific law, but the Voyeurism law covers some of that ground. What you are not allowed to do is: surreptitiously, observe[] — including by mechanical or electronic means — or make[] a visual recording of a person who is in circumstances that give rise to a reasonable expectation of privacy, if (a) the person is in a place in which a person can reasonably be expected to be nude, to expose his or her genital organs or anal region or her breasts, or to be engaged in explicit sexual activity; (b) the person is nude, is exposing his or her genital organs or anal region or her breasts, or is engaged in explicit sexual activity, and the observation or recording is done for the purpose of observing or recording a person in such a state or engaged in such an activity; or (c) the observation or recording is done for a sexual purpose. This blog article looks at the difficulty of knowing where one has an &quot;expectation of privacy&quot;, since this is a new law with little case history behind it. R v Jarvis seems to be it as far as case law goes. The court allows that many things may go into a reasonable expectation of privacy for this law. Relevant considerations may include (1) the location the person was in when she was observed or recorded, (2) the nature of the impugned conduct (whether it consisted of observation or recording), (3) awareness of or consent to potential observation or recording, (4) the manner in which the observation or recording was done, (5) the subject matter or content of the observation or recording, (6) any rules, regulations or policies that governed the observation or recording in question, (7) the relationship between the person who was observed or recorded and the person who did the observing or recording, (8) the purpose for which the observation or recording was done, and (9) the personal attributes of the person who was observed or recorded. This list of considerations is not exhaustive and not every consideration will be relevant in every case. The line that the Canadian court drew is extremely fine. There is no absolute exemption for consensual acts, instead the courts would engage in a holistic balancing act. The fact that consent was included as a mere factor suggests that consent is not a safe harbor.
Using Tor is not illegal. Nor is hiding your IP address, which is - among other things - what Tor does. Going to .onion links is not illegal. What you find and interact with at those .onion sites may be illegal. See Law StackExchange Is it legal to host a directory of .onion urls? Running a Tor Relay is not illegal. That could change. Running an Exit Relay could expose your IP address as the Relay, so that could lead investigators of illegal activity to you. Read https://www.torproject.org/eff/tor-legal-faq.html.en As always, check your state laws http://statelaws.findlaw.com/criminal-laws/computer-crimes.html And do your own research with the links above and at https://en.wikipedia.org/wiki/Tor_(anonymity_network) and at https://www.torproject.org/