Threat › Module 8 › Lesson 3
Legal Ethics
TI collection legal ethics literacy — RoE, privacy, consent, sharing boundaries — on `$TI_LAB` program stub only.
Visual · t33_legal_ethics
Legal ethics = named collection RoE rows. $TI_LAB. Original Cyberlium.
Opening
Collection without legal ethics burns programs — name RoE and privacy rows on YOUR lab stub before touching prod sources or stranger data.
Legal ethics literacy names: Rules of Engagement for collection category, privacy/data-protection awareness stub, consent and terms-of-service literacy category, cross-border sharing restrictions category, insider vs OSINT source handling category, and stop conditions when scope unclear. Analyst writes collection RoE one-pager for `$TI_LAB` program — cites Module 8-1 hygiene and 8-2 capability rows — documents stop-if-out-of-scope rule — without harvesting unauthorized data, without 'ethics theater' on marketplace sources, without sharing TLP:RED broadly. Cyberlium ethics gate for all Topic 33 collection artifacts. Refused: unauthorized collection, marketplace sources, skip stop conditions. Lab row: collection RoE one-pager with ten scope items and refused paths.
1. Named RoE sections
Scope in, scope out, privacy, sharing, stop conditions — five literacy anchors.
In-scope = `$TI_LAB` fictional stubs and instructor samples only.
Command guide
Try these commands — Named RoE sections
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
FIRST Trusted Introducer — https://www.first.org/global-sigs/trusted-introducer CISA — https://www.cisa.gov/ OASIS STIX — https://oasis-open.org/committees/cti/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export TI_LAB=${TI_LAB:-$HOME/cyberlium-lab/t33-ti}
cat > "$TI_LAB/collection/legal-ethics.txt" <<'EOF'
TI legal & ethics — YOUR org notes:
Authorization: written scope for collection activities
Privacy: minimize PII; comply with GDPR/local privacy law
Sharing: traffic-light protocols (TLP) for dissemination
Proportionality: collect only what requirements demand
Prohibited: doxxing, buying access, criminal forum participation
Prohibited: sharing IOCs derived from unauthorized intrusion
Cross-ref: roe.txt, no-criminal-markets.txt, darkweb-policy-note.txt
EOFCommand — copy this
grep -E 'Authorization|TLP|Prohibited|doxxing' "$TI_LAB/collection/legal-ethics.txt" curl -sS https://www.first.org/ | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: FIRST Trusted Introducer (https://www.first.org/global-sigs/trusted-introducer); CISA (https://www.cisa.gov/); OASIS STIX (https://oasis-open.org/committees/cti/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Refused paths
Marketplace sources, corp mass-enum, doxxing, unauthorized prod feeds — label red.
Stop condition triggers when legal gate unclear — document escalation stub.
3. Sharing boundary
Lab notes → internal mentor review — not public dump of collection stubs.
Real prod finding outside lab → owner notify within org RoE category.
4. What you ship: collection RoE one-pager
Ten scope items + refused paths + stop conditions + NEVER marketplace source line.
5. What you record before the next lesson
Collection RoE one-pager path.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Write RoE that includes 'any dark-web marketplace for IOC collection.'
Right
Collection RoE one-pager for `$TI_LAB` program stub. Next: Collection Lab.
Mission: collection RoE one-pager
1) List ten in-scope items. 2) Five refused paths labeled. 3) Stop conditions UTC. 4) Write NEVER marketplace source line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Stop condition — minimum literacy?”
Knowledge Check
APPLY: Collection legal ethics on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Marketplace sources fit collection RoE.
True or False
Knowledge Check
APPLY: RoE includes:
Multiple choice