Learn / Careers in cybersecurity
Legal and ethical boundaries in security
Why written authorization is the line between security work and a crime, a general overview of the US Computer Fraud and Abuse Act and the UK Computer Misuse Act, and how bug bounties and responsible disclosure work.
This page is general education, not legal advice. Laws differ by country and state and change over time. If you are unsure whether an activity is legal, stop and get advice from a qualified lawyer.
Authorization is the line
The same technical activity can be a respected job or a crime. The difference is authorization. A penetration tester and a criminal may use similar tools; the tester has written permission from the system owner that defines exactly what may be tested, when and how.
Rules every learner and professional should follow:
- Never test a system you do not own or do not have explicit, written permission to test.
- Curiosity is not permission. "I was just checking" is not a legal defense, and finding a door unlocked does not mean you were invited in.
- Stay in scope. Permission to test one website does not cover the company's other sites, its staff email or its cloud accounts.
- Do not access, copy or keep data you come across beyond what is needed to prove an issue, and never share it.
- Get permission in writing from someone with the authority to grant it, even for friends, family businesses or your own employer.
The laws in brief
| Law | Where | What it covers in general terms |
|---|---|---|
| Computer Fraud and Abuse Act (CFAA) | United States (federal) | Accessing a computer without authorization or exceeding authorized access, plus causing damage; many states have their own similar laws |
| Computer Misuse Act 1990 | United Kingdom | Unauthorized access to computer material, access with intent to commit further offenses, and unauthorized acts that impair a computer |
| Similar computer crime laws | Most other countries | Unauthorized access and interference; the Council of Europe's Budapest Convention encourages similar laws across many nations |
United States. The CFAA dates from 1986. In 2021 the US Supreme Court's decision in Van Buren v. United States narrowed how "exceeds authorized access" is read, and in 2022 the Department of Justice announced a policy of not charging good-faith security research under the CFAA. Neither change protects testing done without authorization, and state laws and civil lawsuits still apply.
United Kingdom. The Computer Misuse Act has been in force since 1990 and covers unauthorized access even when no damage is done. Proposals to add a defense for legitimate security research have been discussed, but you should assume no such protection exists unless the law clearly says otherwise.
A historical reminder: the Morris worm of 1988 led to one of the first convictions under the CFAA, even though its author said he did not intend to cause harm.
Bug bounties and responsible disclosure
Many organizations invite outside researchers to report security flaws. These programs are the legal way to test real-world systems.
- Bug bounty programs run directly by companies or through platforms such as HackerOne, Bugcrowd and Intigriti pay rewards for valid findings. Each program publishes a scope (what you may test), rules (what techniques are banned, such as denial-of-service or social engineering of staff) and often a safe harbor statement promising not to pursue researchers who follow the rules.
- Vulnerability disclosure policies (VDPs) invite reports without paying rewards but still define scope and safe harbor.
- security.txt is a standard file (RFC 9116) that many websites publish to say how to report security issues.
Read the full program policy before you start. Testing outside the published scope removes your safe harbor protection.
Coordinated disclosure
If you find a flaw by accident, for example while using a website normally, the professional path is coordinated disclosure:
- Stop. Do not probe further or try to access more data.
- Look for the organization's security contact, disclosure policy or security.txt file.
- Report privately with a clear, factual description and give them reasonable time to fix it. Ninety days is a common industry norm.
- Do not demand payment in exchange for the details. That can look like extortion.
- If the organization does not respond, national bodies such as CISA in the US or the NCSC in the UK can sometimes help coordinate.
Ethics beyond the law
Security professionals are trusted with access to sensitive systems and information. Professional bodies such as ISC2 and ISACA require members to follow a code of ethics, and breaking it can cost you your certification. Respect privacy, report honestly, admit mistakes quickly and never use your skills to settle personal scores. A clean record is one of the most valuable assets in this career.