Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 23 guests online
 
Advertisement

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Otherarrow Legality of spy software
EH-Net
May 25, 2013, 06:06:58 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Legality of spy software  (Read 41964 times)
0 Members and 1 Guest are viewing this topic.
BillV
Hero Member
*****
Offline Offline

Posts: 1892


View Profile WWW
« on: February 07, 2008, 07:39:21 AM »

First let me give you a quick background of where this question is coming from. We have a  local radio station here that does this thing they call "War of the Roses." Basically, the idea is that they have a couple in a relationship (whether dating or married) where one of them believes the other is cheating. So the radio station calls the suspected cheater up on the phone and asks them where they want to send a dozen roses. Then they obviously either send it to their partner, or to the person their cheating with.

Well, apparently they've reached a new level with this idea. I'm driving to work this morning listening to the show, and they say that they've installed spy monitoring software onto a computer in order to watch the activities of the suspected cheater. It sounds like it works the same as most, and logs Internet activity, chats, emails, takes screenshots, etc.

My question of the whole thing would be the legal issues involved. Since they're monitoring activity as a third party, what permission do they need? Do they only need permission from the 1 person in the couple to spy on the other? Do you need a Private Investigator license or anything?
Logged
pseud0
Recruiters
Full Member
*
Offline Offline

Posts: 208



View Profile
« Reply #1 on: February 07, 2008, 09:10:28 AM »

Generally this would be considered acceptable if a person with an ownership aspect of the system agreed to it.  That means if they live together and have an assumed shared ownership of the system then one of them could give permission to do so.  Also, you need to remember that nobody in the scenario is a representative of the government so most privacy/wire tap/evidence/search laws would not apply.  My two cents.
Logged

CISSP, CISM, CISA, GCIH, GREM, CEH, HMFIC, KTHXBIROFLCOPTER
g00d_4sh
Sr. Member
****
Offline Offline

Posts: 394



View Profile
« Reply #2 on: February 07, 2008, 10:44:59 AM »

True enough, I think pseud0's take on it is legal.  I've installed spy software for clients before at their request on their own computers, and taught them how to monitor the results... I must say I kind of felt dirty though doing it even though it was technically totally fine.  I don't know, I'm not a big fan of the feel of being a cog in the Orwellian machine, but then again it does pay and it's technically ethical in my case.  Still, it does have a dirty feel, especially when you have to watch the person it takes down realize that their privacy has been violated, even if done so with good reasons.
Logged

"Bad.. Good?  I'm the guy with the gun"
pseud0
Recruiters
Full Member
*
Offline Offline

Posts: 208



View Profile
« Reply #3 on: February 07, 2008, 11:21:08 AM »

One thing that these guys are going to need to consider, legality issues put aside, they might be held liable under civil laws.  If the affected person decides that they have suffered emotional damage, that their job was affected, etc. then the radio station could be held liable.
Logged

CISSP, CISM, CISA, GCIH, GREM, CEH, HMFIC, KTHXBIROFLCOPTER
BillV
Hero Member
*****
Offline Offline

Posts: 1892


View Profile WWW
« Reply #4 on: February 07, 2008, 12:15:09 PM »

Thanks for the replies. That makes sense. I guess when I was thinking about it this morning, it was more from the perspective of breaking into a computer and placing monitoring software on it (which would obviously be illegal). If 1 of them gives permission to do so, I guess it's the same as that person installing it themselves to monitor the other anyway. I had not taken into consideration civil liability though, good point.

edit: What about leaking of confidential information? Is all data fair game? Say for example the person opens work email or connects to a work system and now confidential company data has been breached. What then?
« Last Edit: February 07, 2008, 12:26:02 PM by BillV » Logged
pseud0
Recruiters
Full Member
*
Offline Offline

Posts: 208



View Profile
« Reply #5 on: February 07, 2008, 12:34:54 PM »

You're splitting some hairs at that point.  While a second person might have partial ownership of the system, you would argue that they don't have assumed ownership over all of the material on that system (ie. the work email account).  If data from that account was leaked it would open up some very certain civil liability lawsuits, and depending on how much damage was done you could push for some criminal suits as well.  Think of it this way, your wife might have assumed shared ownership of your desk, but if she searched through your drawers, found some vital work papers, and had them published online, your work would probably sue the hell out of her (and you) while pressing charges of various types.
« Last Edit: February 07, 2008, 12:38:57 PM by pseud0 » Logged

CISSP, CISM, CISA, GCIH, GREM, CEH, HMFIC, KTHXBIROFLCOPTER
BillV
Hero Member
*****
Offline Offline

Posts: 1892


View Profile WWW
« Reply #6 on: February 07, 2008, 12:41:13 PM »

Ok, fair enough. Thanks for the replies and info Smiley
Logged
geekyone
Full Member
***
Offline Offline

Posts: 180



View Profile
« Reply #7 on: February 07, 2008, 02:35:24 PM »

I think from a legal standpoint a lot would depend on how well the unknowing party has separated their data from their significant others data.  For example they both may own the computer but use separate user accounts that maybe password protected.  I think that weighs in heavily when considering whether accessing data is legal or not.
Logged

CISSP, CEH, GPEN, GCIH, GCFA
bigwhiff
Newbie
*
Offline Offline

Posts: 14


View Profile
« Reply #8 on: February 07, 2008, 04:59:59 PM »

At first looking at this I thought they might be breaking Federal Wire Tap laws.  But after further investigation  http://www.securityfocus.com/news/9978 I found that the wiretap law was thrown out by this judge in a keylogger ruling. 

So next would come down to ownership and who owned the system and provided access to it.  If it is a non-martial relationship and the girlfriend granted access to the computer that belonged to the boyfriend I believe that then there would be laws being broken.
Logged

Jack Campbell
CCNP CCDP GCIH GHTQ C|EH
http://secauditor.wordpress.com
pseud0
Recruiters
Full Member
*
Offline Offline

Posts: 208



View Profile
« Reply #9 on: February 08, 2008, 11:11:35 AM »

For the ownership question, be aware that often the law does not distinguish between the legal owner and someone who as some level of presumed ownership.  In the example of a boyfriend and girlfriend, if the computer belongs to the guy and he allows the girlfriend unlimited use, then she is going to have some level of presumed ownership.  As a better example, if the cops wanted to search the house and asked permission from the girlfriend, the search would be legal.  The courts have stated that she has the right to do so.  The same concept would apply to the computer if she had regular access to it with permission from the owner.  As for the wire tap laws, you have to take into account their narrow focus.  In the example given here it is for interstate or international communications that affect commerce.  As for the radio station example we are discussing, there might be other specific commerce laws that would apply (and maybe some FCC laws?) but I just wanted to make a point that most of the big laws everyone is familiar with probably wouldn't apply.
Logged

CISSP, CISM, CISA, GCIH, GREM, CEH, HMFIC, KTHXBIROFLCOPTER
sgt_mjc
Sr. Member
****
Offline Offline

Posts: 294


View Profile
« Reply #10 on: February 08, 2008, 02:37:26 PM »

Various user accounts would not make a difference. So long as the spy ware is installed by an account with admin privileges, then it would run no matter what account is being used. As for the legality of the whole thing, it is perfectly acceptable for parents to use programs to monitor their kids’ activities. Should it be any different for spouses? Of course, this brings up the whole issue of trust on the part of the couple, but that is a different argument. Go ahead and spy on your spouse all you want, but be prepared for the consequences when he or she finds out.
Logged

Mike Conway
CISSP
CompTia Security +
C|EH
Mr. Roboto
Jr. Member
**
Offline Offline

Posts: 67


Himitsu wo shiritai


View Profile
« Reply #11 on: February 22, 2008, 10:15:57 AM »

sgt_mjc has it right.  It works just like parental controls for kids.  You can do whatever/install whatever, but when your significant other finds out...

Not worth losing your marriage/relationship over a key logger or spyware.
Logged

A+, Security+, HDI Support Center Analyst, MCTS: Vista
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.065 seconds with 22 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.