⚖️ The Law & Authorization

The Laws You Must Know Exist

The exact laws vary by country, but the core principle is universal: accessing a system you don't own and don't have permission to test is illegal. 'I was just curious' and 'I was trying to help' are not defenses.

What 'Authorization' Actually Means

Authorization isn't a verbal 'sure, go ahead.' Real authorization for security testing is a written, signed agreement that defines exactly what you're allowed to do. Without it, you have nothing.

The Rules of Engagement (RoE)

1. 1.Scope — exactly which systems, IP addresses, and applications you may test (and which are off-limits)
2. 2.Timeframe — the specific dates and hours testing is permitted
3. 3.Permitted techniques — what's allowed (e.g., no denial-of-service, no social engineering unless specified)
4. 4.Data handling — what you may access, and how you must protect anything sensitive you find
5. 5.Contacts & escalation — who to call if something breaks or you find a critical, active breach
6. 6.Get-out-of-jail letter — signed written authorization you can produce if challenged

Responsible Disclosure

If you ever find a vulnerability in a system you don't have a contract for — say, you stumble on a bug in a website you use — the ethical path is responsible disclosure: privately report it to the owner (many have a security@ email or a bug bounty program), give them reasonable time to fix it, and don't exploit it or make it public prematurely. Never demand payment — that can be construed as extortion.