Legal & Ethical Boundaries — Labs & Discussion

Rules for every lab: passive techniques only unless the lab says otherwise; only approved targets (yourself, consenting classmates, instructor-provided or instructor-owned targets, purpose-built practice sites); don’t share findings about real people outside class.

These labs are mostly scenario-based: students practice judgment on fictional findings, so no real person is investigated. Lab 3 reads a real platform’s published legal pages, which is public and passive.

Lab 1: Scope Decision Workshop

• Objective: Practice deciding whether findings are in scope, out of scope, or need escalation, and justify each decision.
• Time: 30–40 minutes / Difficulty: Beginner
• Setup / what the instructor prepares:
• Hand out the fictional CompanyX scope excerpt from 2.1-authorization-and-scope.md.
• Prepare 10–12 “finding cards” (fictional). Suggested cards:
  1. A CompanyX engineer’s public conference talk slides showing an internal network diagram
  2. The CFO’s spouse’s public Facebook post about a family vacation, with dates
  3. A companyx.com subdomain found in certificate transparency logs: vpn.companyx.com
  4. A former employee’s personal blog complaining about CompanyX’s password policy
  5. A public code repository owned by a CompanyX contractor containing what looks like a CompanyX API key
  6. A breach-notification result showing 25 companyx.com addresses in a 2021 breach
  7. A forum post offering to sell “CompanyX VPN access”
  8. An employee’s public LinkedIn photo showing their badge
  9. A local news article about CompanyX’s new office, naming the building
  10. A job posting listing CompanyX’s firewall vendor and SIEM product
  11. An employee’s public post mentioning a medical condition and taking leave
  12. A subsidiary CompanyX announced it is acquiring “next quarter”
• Steps:
  1. In small groups, sort each card into In scope, Out of scope, or Stop and ask.
  2. For each card, write one sentence explaining why, referencing a specific line of the scope.
  3. For every Stop and ask card, write the message you would send to the client contact.
  4. Groups compare answers; the instructor highlights disagreements.
• Deliverable: A completed sorting sheet with reasoning, plus at least two escalation messages.
• Debrief questions:
• Which cards caused the most disagreement? Why?
• Card 7 suggests an active compromise. What’s the urgency, and what should you not do?
• How would you rewrite the scope so fewer cards are ambiguous?

Lab 2: “Would You Include This in the Report?”

• Objective: Apply minimization and proportionality, and see the mosaic effect firsthand.
• Time: 30–45 minutes / Difficulty: Beginner–Intermediate
• Setup / what the instructor prepares:
• Create a fictional “raw findings” document for a phishing-risk assessment of CompanyX’s finance team (about 15 findings). Mix useful work-related findings with oversharing: home streets, children’s names, a pet’s name, a gym schedule, a political post, a mother’s maiden name from an old birthday post, and so on.
• Optionally print the findings on separate slips so students can physically group them.
• Steps:
  1. Mosaic step: Pick one fictional employee. Combine their findings and write down what an attacker could now infer (home location, when the home is empty, likely security-question answers).
  2. Minimization step: Go through every finding and mark it Include, Include in summarized form, or Exclude, using the objective (“assess phishing risk for the finance team”).
  3. Redaction step: Rewrite the included findings into a short report section. Report patterns rather than individuals where possible (e.g., “4 of 9 finance staff publicly list their direct manager”).
  4. Set a data retention and deletion plan for the raw findings.
• Deliverable: A one-page redacted report section and a retention plan.
• Debrief questions:
• What did the combined profile reveal that no single finding did?
• Which excluded findings would an attacker find most useful? Why is it still right to leave them out of the report?
• How would your decisions change if the report were going to 50 people instead of 2?

Lab 3: Terms of Service Reading Exercise

• Objective: Learn to find the ToS sections that matter for OSINT, and read them for hints about what a platform can do.
• Time: 40–50 minutes / Difficulty: Beginner
• Setup / what the instructor prepares:
• Assign each group a different real platform with published legal pages (for example: a social network, a professional network, a code hosting site, a forum/community site, a fitness app).
• Students only read the publicly posted terms, privacy policy, developer/API terms, and robots.txt. No accounts, no scraping.
• Steps:
  1. Find and link the platform’s current Terms of Service, privacy policy, developer/API terms, and robots.txt.
  2. Fill in a worksheet:
  • Does the platform allow automated collection? Quote the clause.
  • What are the account rules (real name, one account, age)? Quote them.
  • Is there an official API or research access program? What are its key limits?
  • What does robots.txt disallow for general crawlers?
  • Which governing law or dispute process applies?
    3. Hints of what’s possible: List at least three prohibitions or privacy policy statements, and for each, write what it suggests the platform can technically do (for example, “prohibits bulk contact downloads → contacts can be exported”).
    4. Possible vs. permitted: For each hint, write whether an investigator could legitimately act on it, and how (approved API, your own account’s data download, advising users on privacy settings).
    5. Recommend an approved collection path for a hypothetical authorized investigation on this platform.
• Deliverable: A completed worksheet and a two-minute group presentation.
• Debrief questions:
• Which platform’s terms were most restrictive? Most permissive?
• Did any “hint” surprise you about what the platform stores or allows?
• How do hiQ v. LinkedIn and Meta v. Bright Data change how you’d collect from your platform while logged in vs. logged out?

Lab 4: Responsible Disclosure Role-Play

• Objective: Practice handling an accidental discovery without making things worse.
• Time: 25–35 minutes / Difficulty: Beginner–Intermediate
• Setup / what the instructor prepares:
• A fictional scenario: while researching CompanyX (authorized), a student finds a public code repository belonging to ExampleCorp (a different, fictional company) containing what appear to be cloud access keys and a database connection string.
• Optionally, show students a real organization’s published security.txt file (found at /.well-known/security.txt on sites that publish one) so they see the format. Reading a public file is passive.
• Steps:
  1. List what you should and shouldn’t do in the first ten minutes (no testing the keys, no downloading the repository’s data, document the URL and time).
  2. Decide who to notify: ExampleCorp (how would you find the contact?), your client, or both? Does your scope say anything?
  3. Write a short, professional disclosure message to ExampleCorp: what you found, where, when, why it matters, and what you did not do.
  4. Swap messages with another group and review them: is anything missing? Could anything be read as a threat or a demand?
• Deliverable: A disclosure message and a short “what I did / what I didn’t do” log.
• Debrief questions:
• Why is testing whether the keys work a bad idea, even with good intentions?
• What if ExampleCorp doesn’t respond after two weeks?
• How is this different from posting the finding on social media to warn people?

Discussion Questions

1. “You’re doing OSINT on Company X for a pentest and find the CEO’s teenager’s Instagram, which shows the family’s home address. Is it in scope? Does it go in the report? What would you do?”
2. hiQ likely didn’t commit a CFAA crime but still paid $500,000 and deleted its data. What does that tell you about “legal” vs. “safe”?
3. The DOJ says it won’t federally charge good-faith security research. Why isn’t that enough protection for a researcher?
4. Is using a sock puppet account ever ethical? What would need to be true for you to say yes?
5. A journalist wants to use a leaked database to report on a company’s misconduct. How is that different from a pentester downloading the same database? Is it?
6. Someone online is harassing your friend. You could find their real identity with the skills from this unit. Should you? What are the risks if you’re wrong?
7. Face-search engines can help find scammers using stolen photos. They can also help stalkers. Should they exist? Who should be allowed to use them?
8. Under the GDPR, public personal data is still protected. Under California law, much public information is excluded. Which approach do you think is better for OSINT, and for the people being investigated?
9. Your client asks you to “find everything” about a job candidate before they’re hired. What legal and ethical issues does that raise?
10. You find a public post in which an employee describes a mental health struggle. It explains why they might be vulnerable to a particular phishing pretext. Does it belong in your report? Why or why not?