If you inadvertently go beyond the range of IP adresses you intend to test (e.g., mistype an IP address) you are likely not CRIMINALLY liable, as the statute requires intentional access without authorization -- but this presupposses that the prosecutor believes you when you tell him it was an accident. Sort of like breaking into the wrong car in a parking lot, because you forgot your keys -- they may not believe you and you may go to trial, or worse, to jail! If you want to test your own domain which is hosted by someone else, you likely need their consent as well. More difficult is when you accidentally cause damage during a pen test - you can be civilly liable for this. Finally, and the point of the article -- a mere ping sweep ALONE -- or a port scan -- may be enough to open civil or criminal liability!

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/167/20499#20499