Law, Contracts, and Rules of Engagement

If work is worth doing on someone else’s systems, it is worth a document the owner would recognize in an audit: who is testing, for whom, on which assets, from which source IPs, during which window, with which techniques allowed or banned, and who signs. Chat messages rot. People leave companies. The intern who said “sure” may not have had authority to offer the payroll network. A contract, statement of work, or signed email from someone who actually owns the asset is the kind of writing that belongs in a folder next to your report — not a screenshot of a meme.

Your own machines still deserve writing. That sounds fussy until you share a house, a cloud account, or a family Wi-Fi name. A personal RoE makes the boundary explicit: localhost and VMs I created are in; roommate laptops, the ISP modem’s neighbor SSIDs, and “that AWS bucket I found” are out. When a later module offers a scanner, you will have a page to check instead of a feeling. chmod 600 because the file will list hostnames and maybe a lab password you invented — still not a live bank password, still not someone else’s.

Authorization is specific. “Test our security” is not specific. “These three hostnames, no denial-of-service, no phishing staff, staging only, 18:00–22:00 local, contact on-call at this number if something falls over” is specific. If you cannot get specificity, you do not start “a little bit” and hope. You wait. Cyberlium’s wait-state is: stay in cyberlium-lab, describe, do not probe third parties. That wait-state is the entire ethics engine of Topics 7–8 as well. This lesson only names the legal reason the engine exists.

cat >> "$NOTES" << 'EOF'
authorization_type: (self-owned lab / signed RoE / bounty policy I actually read)
signer: (me, for MY machines) OR (legal entity name + date)
not_enough: friend who does not own the company; job title after hours; YouTube public IP
EOF

date -u +"%Y-%m-%dT%H:%M:%SZ" | tee -a "$NOTES"

Scope is the set of assets and activities that are allowed. Out of scope is not a dare. Rules of engagement are the operating rules inside that set: how loud you may be, whether you may use exploits or only identify missing patches, whether you may target people (usually no, unless a social-engineering exercise is explicitly bought), what you do with data you happen to see, and when you stop. A good RoE also names evidence handling: screenshots without secrets, secrets redacted, storage encrypted or at least mode 600 on a disk you control.

Typical clip-points you should expect in professional paper — described here as ideas, not as a copied vendor form: production versus staging; time windows and freeze dates; banned techniques (often availability attacks, ransomware simulation, physical break-in, attacking third-party SaaS the client does not own); data minimization (do not download the customer database to prove you could); retest rules; and a kill switch — who can halt the test. If a document lacks a kill switch, you still need a personal one: if you are not sure, you stop.

Bug bounty programs are not “the internet is in scope.” They are posted policies with asset lists, exclusions, and disclosure rules. Hitting a target that is not on the list, or using a forbidden technique, can still be unauthorized. Reading a bounty page after you already tested is backwards. Public does not mean invited. A login form on the internet is not an invitation to password-guess it. Your personal RoE for this course will not include bounty hunting on third-party programs unless you separately choose that as an adult with their policy in hand — and Cyberlium will not assign it.

sudo apt install nmap

brew install nmap

choco install nmap  # or download https://nmap.org/download.html

cat >> "$NOTES" << 'EOF'
in_bounds: 127.0.0.1 ; MY VMs ; files I created under cyberlium-lab
out_of_bounds: cafe clients, campus portals, neighbor gateway, employer SaaS
techniques_allowed: reads, notes, loopback listeners I start
techniques_forbidden: nmap /24, hydra, floods, people-tests without people-scope
data_handling: no stockpiles; chmod 600 notes
stop_button: if DEMO is a router login, STOP and use 127.0.0.1
EOF

Most legal systems that address computer misuse ask some version of: did you have permission to access this system or data in this way? Your intent to learn can matter at sentencing in some places and matter zero in others. You should not plan your lab around the optimistic version. A course, a certification brand, a hat color, a resume line, or “I would have told them” does not create permission. Discovering a serious bug does not retroactively authorize the method you used to find it if the method was unauthorized access.

We will not dump exam-style lists of statute names from many countries. Those lists go stale, get copied, and trick people into thinking memorization is compliance. You need a local habit: if you are not the owner and you do not have writing, you do not test. If you work for an employer, their policy and your contract control what you may do with company systems — “I am the IT intern” is still not a pentest charter. If you are a student, the acceptable-use policy of the school is usually the opposite of a blank check.

Responsible disclosure, when you stumble on a problem in a system you were not testing, is a separate narrow path: stop digging, do not exfiltrate, consider vendor or national coordinated-disclosure channels, do not tweet proof. This course does not assign you to go looking for accidental bugs on live strangers. If you were already on a site as a normal user and something broke, that is not a license to become a tester. Write the instinct down: stop, do not pivot, do not store their data in cyberlium-lab.

Professional testing usually sits in a stack of paper: a master services agreement, a statement of work, maybe an NDA, and an RoE or test plan. The NDA is about what you may say. The RoE is about what you may do. Mixing them up produces people who stay quiet about a finding they were supposed to report, or people who report loudly about a test they were not supposed to run. You do not need to draft a law-firm stack for localhost. You do need to know the stack exists so you do not treat a tweet as a contract.

Home lab paper is shorter and still real: authorized targets, forbidden targets, allowed activities for this course, data handling (chmod 600, no gists, no live secrets), emergency stop (Ctrl+C and close the laptop is allowed), and the legal disclaimer that Cyberlium is not EC-Council and not a cert. That is what Lesson 4 will force you to type. Lesson 3’s notes are the field list so you are not inventing headings under time pressure. Empty headings fail. Headings filled with “the whole internet” fail ethics even if the file is locked.

Insurance, professional licenses, and background checks exist in the industry because tests go wrong: a scan knocks over a factory controller, a tester walks into the wrong VLAN, a laptop with findings is stolen. You will not buy insurance for a notes file. You will still treat the notes as if a future employer asked “show me you understand RoE.” That is the career use of this lesson. The legal use is: you can explain, without smirking, why practice is not a defense.

Today’s artifact is ceh-law-roe-notes.txt — headings and your sentences for why paper matters. Do not invent a third-party target. Do not paste a vendor’s copyrighted RoE template. The next lab expands this into ceh-roe.txt with authorized-target rules you will actually live by. chmod 600 both when they exist. Empty notes fail.

You now have the legal clip for the five-phase map: writing first, specificity, a stop button, and no faith that a course brand will testify for you. Next — Lab — Write Your Personal RoE — you will turn this field list into $HOME/cyberlium-lab/ceh-roe.txt, fill authorized-target rules for YOUR lab only, and chmod 600. That file is the artifact later modules will assume exists. Still original Cyberlium. Still not official EC-Council training. Still not a CEH grant.