Beginner · Security basics · topic 5 of 43 · 25 min
Ethics and the law: permission first
Explanation
Why ethics comes first
Security people learn how attacks work so they can stop them. That knowledge is powerful. Scanning a server, guessing a password or reading someone's traffic is normal work in a lab or a paid test with permission, and a crime on someone else's system without it. A career in security is built on trust: one illegal "test" can end it before it starts.
The law in India: the IT Act, 2000
The Information Technology Act, 2000 (amended in 2008) is India's main cyber law. A few sections every security learner must know:
| Section | What it covers (simplified) | Consequence |
|---|---|---|
| 43 | Without the owner's permission: accessing a computer or network, copying data, introducing a virus, damaging or disrupting a system, denying access to authorised users, and similar acts | You must pay compensation for the damage (civil liability) |
| 66 | Doing any act in Section 43 dishonestly or fraudulently | Crime: up to 3 years in prison, or a fine up to ₹5 lakh, or both |
| 66C | Identity theft: fraudulently using someone's password, electronic signature or other unique identity feature | Crime: prison and fine |
| 66D | Cheating by pretending to be someone else using a computer or phone (impersonation) | Crime: prison and fine |
Fraud cases can also be charged under the Bharatiya Nyaya Sanhita (BNS), which replaced the Indian Penal Code from 1 July 2024. Other countries have similar laws, such as the Computer Fraud and Abuse Act in the USA and the Computer Misuse Act 1990 in the UK. "I was only testing" is not a defence anywhere.
Permission done properly
Professional testers work only with written authorisation from someone who actually owns the system and can give permission. The document sets out:
- Scope: exactly which systems, IP addresses, domains or apps may be tested, and which may not.
- Rules of engagement: what kinds of tests are allowed, at what times, and what is off-limits (for example no denial-of-service, no real customer data).
- Contacts: who to call if something breaks or a real attacker is found.
- Dates: when testing starts and ends.
Where you can practise legally
- Your own lab: virtual machines on your own computer, such as an Ubuntu VM, a Windows evaluation VM, or deliberately vulnerable apps like OWASP Juice Shop or DVWA.
- Legal training platforms: TryHackMe, Hack The Box, PortSwigger Web Security Academy, OverTheWire, LetsDefend and CyberDefenders (blue-team practice).
- Bug bounty programmes: companies publish a scope and rules and pay for reports. Read and follow every rule.
- Capture the flag (CTF) events run by colleges and communities.
Ethics beyond the law
- Confidentiality: what you see in logs and investigations stays private.
- Do no harm: stop and report if a test starts to break something.
- Responsible disclosure: if you find a bug by accident, report it privately to the owner (or to CERT-In) and do not exploit or publish it first.
- Honesty: report what you actually found, not what sounds impressive.
Common mistakes
- Scanning your college or office network "to learn" without asking. Even a scan can break old devices and break the rules.
- Trying a "trick" you saw in a video on a real website.
- Keeping copies of data you found during a test.
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
Ethics and the law: permission first · 1/6
In security, the same action can be a job or a crime. The difference is permission.
Prefer a video by a teacher? Find free videos on “IT Act 2000 section 43 66 explained cyber law India” on YouTube ↗
In real life: A student, a college portal and a lesson
A student notices that changing a number in the URL of the college results portal shows other students' marks. Testing further, downloading records or posting about it could fall under Sections 43 and 66. The right action is to stop, write down only what was seen by accident, and report it privately to the college IT team. Many organisations now publish a security contact or a responsible disclosure page for exactly this.
Practice (0/2 done)
Which of these is legal practice?
Write a one-page "rules of engagement" for a pretend test of your own home lab. Include the owner, the scope, what is not allowed, dates, and an emergency contact.
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- Passwords and multi-factor authenticationSecurity basics · same module
- Threats, vulnerabilities and riskSecurity basics · same module
- The law in India: IT Act 2000, sections 43 and 66Ethical Hacking and Penetration Testing (legal labs) · Rules first: ethics, law and permission
- What ethical hacking is (and is not)Ethical Hacking and Penetration Testing (legal labs) · Rules first: ethics, law and permission
- Security basics: threats, CIA and AAAComputer Networking (CCNA level) · Network security
- Post-exploitation ethics: what to do once you are inEthical Hacking and Penetration Testing (legal labs) · Post-exploitation ethics and reporting
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
Under the IT Act 2000, which section covers unauthorised access and damage with compensation?
Answer: Section 43
Section 43 sets civil liability (compensation) for unauthorised access, copying, damage and similar acts.
What turns a Section 43 act into a Section 66 offence?
Answer: Doing it dishonestly or fraudulently
Section 66 applies when the Section 43 act is done dishonestly or fraudulently.
Who can authorise a security test of a website?
Answer: The owner of the system, in writing
Only the true owner (or someone they formally authorise) can give permission, and it should be written.
You find a bug by accident on a company website. What should you do?
Answer: Stop, and report it privately to the owner or CERT-In
Responsible disclosure: stop, keep only what you saw, and report privately.
Section 43 of the IT Act is best described as…Related
Answer: A civil liability to pay compensation for unauthorised access/damage
Section 43 is civil: compensation for access or damage done without permission.
A "grey hat" who finds a bug on a stranger's site without permission is…Related
Answer: Still acting illegally
No permission means it is illegal, whatever the intention.
A switch still runs old software with a known bug. What is the bug called?Related
Answer: A vulnerability
A vulnerability is a weakness. A threat is something that could use it.
If a service becomes unstable during a test, you should…Related
Answer: Stop and contact the client immediately
Stop and use the emergency contact in the RoE.
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- This is the last topic of “Security basics”. The module exam comes next.
- Module 1 exam: Security basics · 13 questions · 20 min, without help. 5 topics of this module still to finish first.
- Then the next module, Networking for security. 43 topics left in the course before the final exam.