legal-research ethical-hacking
How to go about learning cyber security if possessing such software (hacking software) is highly and explicitly illegal in my and most countries?
<p>A question for &quot;ethical hackers&quot; or cyber security professionals. I am very interested in the world of cyber security and all aspects of it. I am genuinely interested in the security aspect of it and from a highly ethical and moral perspective. I have purchased &quot;self-teaching&quot; online courses for learning cyber security, this is also dubbed loosely &quot;ethical hacking&quot;.</p>
<p>At this point we should not debate my intentions with such activities and I wish you to take them as genuinely ethical. I do understand that many high level organizations such as the NSA, Intelligence Agencies in many countries etcetera do monitor these activities heavily. Therefore I'm sure any such research would be monitored one way or another--- enough said on that.</p>
<p>My question here is, how is it possible to learn in this direction if my country and many others forbid even the possession of software for &quot;hacking&quot; despite intentions? This seems one of the main tools used to learn vulnerabilities and how to defend against them. For ones own security purposes as well as better security for others also and my own software development securities.</p>
<p>While I understand the intentions behind such laws being directed at nefarious intentions, what about progress in this direction, what about people who want to enter the field or simply learn for ethical reasons? According to the criminal code of Canada there is no grey area, see first link below.</p>
<p>An FYI of how I intended to go about learning &quot;hacking&quot; ethically. By using my computer to break into my old brick laptop and learning from there. I wouldn't use such software to hack anyone else unethically, just not interested.</p>
<p>References:</p>
<p><a href="https://www.itworldcanada.com/blog/understanding-canadian-cybersecurity-laws-interpersonal-privacy-and-cybercrime-criminal-code-of-canada-article-4/440337" rel="nofollow noreferrer">https://www.itworldcanada.com/blog/understanding-canadian-cybersecurity-laws-interpersonal-privacy-and-cybercrime-criminal-code-of-canada-article-4/440337</a></p>
<p><a href="https://devcount.com/is-ethical-hacking-legal/" rel="nofollow noreferrer">https://devcount.com/is-ethical-hacking-legal/</a></p>
<p><a href="https://laws.justice.gc.ca/eng/acts/C-46/page-1.html" rel="nofollow noreferrer">Criminal Code of Canada</a></p>

<p><strong>...many [countries] forbid even the possession of software for &quot;hacking&quot; despite intentions</strong></p>
<p>That is not the case in the <strong><a href="/questions/tagged/united-kingdom" class="post-tag" title="show questions tagged &#39;united-kingdom&#39;" rel="tag">united-kingdom</a></strong> where accessing a computer, and possessing the tools to do it, are only offences if the activity is <strong>unauthorised</strong>. In fact, private entities and government departments are encouraged to carry out <a href="https://www.ncsc.gov.uk/guidance/penetration-testing" rel="noreferrer">authorised penetration tests</a> to identify vulnerabilities in their systems.</p>
<p><strong>[by] using my computer to break into my old brick laptop...</strong></p>
<p>This is perfectly legal as you have authorised access to the brick.</p>
<p>The relevant offences are at <a href="https://www.legislation.gov.uk/ukpga/1990/18/crossheading/computer-misuse-offences?timeline=false" rel="noreferrer">s.1 to s.3A of the Computer Misuse Act 1990</a>, in particular:</p>
<blockquote>
<p><strong>s.1</strong> - <em>Unauthorised access to computer material.</em></p>
<p>(1) A person is guilty of an offence if—</p>
<ul>
<li><p>(a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer, or to enable any such access to be secured;</p>
</li>
<li><p>(b) the access he intends to secure, or to enable to be secured, is <strong>unauthorised</strong>; and</p>
</li>
<li><p>(c) he knows at the time when he causes the computer to perform the function that that is the case</p>
</li>
</ul>
<p>[...]</p>
</blockquote>
<p>Sections 2, 3 and 3ZA (not reproduced here to save space) follow similar wording for <strong>unauthorised access</strong> relating to such things as commiting other offences, impairing a computer's functionality, or creating serious damage to health, infrastructure etc.</p>
<blockquote>
<p><strong>s.3A</strong> - <em>Making, supplying or obtaining articles for use in offence under section 1, 3 or 3ZA</em></p>
<p>[...]</p>
<p>(3) A person is guilty of an offence if he obtains any article—</p>
<ul>
<li>(a) <strong>intending</strong> to use it to commit, or to assist in the commission of, an offence under section 1, 3 or 3ZA, or</li>
</ul>
<p>[...]</p>
<p>(4) In this section <strong>&quot;article&quot; includes any program or data</strong> held in electronic form.</p>
<p>[...]</p>
</blockquote>
<p>So, hacking is not always unlawful - all it needs is the right permission from someone who is authorised to give it.</p>
<p><strong>Edited To Add</strong></p>
<p>This is also the case in <a href="/questions/tagged/canada" class="post-tag" title="show questions tagged &#39;canada&#39;" rel="tag">canada</a> (the subject of the OP's first linked article) where <a href="https://laws.justice.gc.ca/eng/acts/C-46/page-78.html#docCont" rel="noreferrer">s.342.2 of the Criminal Code</a> makes an exception for having a lawful excuse to possess &quot;hacking tools&quot;:</p>
<blockquote>
<p>(1) Every person who, <strong>without lawful excuse</strong>, makes, possesses, sells, offers for sale, imports, obtains for use, distributes or makes available a device that is designed or adapted primarily to commit an offence under section 342.1 or 430, knowing that the device has been used or is <strong>intended to be used to commit such an offence</strong>, is</p>
<ul>
<li><p>(a) guilty of an indictable offence...</p>
</li>
<li><p>(b) guilty of an offence punishable on summary conviction.</p>
</li>
</ul>
<p>[...]</p>
<p>(4) In this section, <strong>device includes</strong></p>
<ul>
<li><p>(a) a component of a device; and</p>
</li>
<li><p>(b) <strong>a computer program</strong> within the meaning of subsection 342.1(2).</p>
</li>
</ul>
</blockquote>
