Legal Ethics

TI collection legal ethics literacy — RoE, privacy, consent, sharing boundaries — on `$TI_LAB` program stub only.

Legal Ethics• Audio Walkthrough

00:00/03:01

Visual · t33_legal_ethics

Legal ethics = named collection RoE rows. $TI_LAB. Original Cyberlium.

Collection without legal ethics burns programs — name RoE and privacy rows on YOUR lab stub before touching prod sources or stranger data.

Legal ethics literacy names: Rules of Engagement for collection category, privacy/data-protection awareness stub, consent and terms-of-service literacy category, cross-border sharing restrictions category, insider vs OSINT source handling category, and stop conditions when scope unclear. Analyst writes collection RoE one-pager for `$TI_LAB` program — cites Module 8-1 hygiene and 8-2 capability rows — documents stop-if-out-of-scope rule — without harvesting unauthorized data, without 'ethics theater' on marketplace sources, without sharing TLP:RED broadly. Cyberlium ethics gate for all Topic 33 collection artifacts. Refused: unauthorized collection, marketplace sources, skip stop conditions. Lab row: collection RoE one-pager with ten scope items and refused paths.

1. Named RoE sections

Scope in, scope out, privacy, sharing, stop conditions — five literacy anchors.

In-scope = `$TI_LAB` fictional stubs and instructor samples only.

Command guide

Try these commands — Named RoE sections

═══ LINUX / macOS (Terminal Practice) ═══

Check system state and user context

Command — copy this

id
whoami
uname -a

Inspect network sockets listening for connections

Command — copy this

ss -tuln 2>/dev/null || netstat -tuln

Audit active processes

Command — copy this

ps aux | grep -v "\[" | head -15

═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information

Command — copy this

whoami /all
Get-ComputerInfo | Select-Object CsName, OsName, OsVersion

Primary tools to practice this lesson: grep, curl. Reference sites: FIRST Trusted Introducer (https://www.first.org/global-sigs/trusted-introducer); CISA (https://www.cisa.gov/); OASIS STIX (https://oasis-open.org/committees/cti/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Refused paths

Marketplace sources, corp mass-enum, doxxing, unauthorized prod feeds — label red.

Stop condition triggers when legal gate unclear — document escalation stub.

3. Sharing boundary

Lab notes → internal mentor review — not public dump of collection stubs.

Real prod finding outside lab → owner notify within org RoE category.

4. What you ship: collection RoE one-pager

Ten scope items + refused paths + stop conditions + NEVER marketplace source line.

5. What you record before the next lesson

Collection RoE one-pager path.

6. Wrong vs right: criminal markets vs YOUR lab IOCs

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Write RoE that includes 'any dark-web marketplace for IOC collection.'
Right: Collection RoE one-pager for `$TI_LAB` program stub. Next: Collection Lab.

Hands-on Exercise