Ethical hacking: permission, scope, law and disclosure
In short: The technical skills of an ethical hacker and a criminal can look the same; the difference is permission. Ethical testing needs written authorisation, a clear scope and agreed rules, respects the law, and reports findings privately so they can be fixed.
Permission is everything
Ethical hacking means using attacker techniques to find weaknesses so they can be fixed, with the owner's agreement. Without permission, the same activity is usually a crime, however good your intentions. "I was only checking" is not a defence.
Permission must come from someone with the authority to give it, and it must be in writing. Your manager cannot authorise a test of a cloud provider's infrastructure, and a client cannot authorise a test of a website hosted by a third party without that party's agreement as well. Many cloud providers publish policies on what customers may test on their own resources; read them before you start.
Scope and rules of engagement
Scope defines exactly what may be tested: IP ranges, domains, applications, buildings or people. Anything not listed is out of scope. The rules of engagement (RoE) say how testing is done:
- Testing windows (for example, only outside business hours).
- Techniques allowed or banned, such as denial of service or social engineering.
- How to handle sensitive data you find.
- Emergency contacts and a "stop" procedure if something breaks.
- What happens if you discover evidence of a real attack.
If you find a path into a system outside scope, stop and ask. Do not follow it "just to see".
The law
Most countries have computer misuse laws. In the UK, the Computer Misuse Act 1990 makes it an offence to access computer material without authorisation, to do so with intent to commit further offences, and to carry out unauthorised acts that impair a computer's operation. Making or supplying tools intended for these offences can also be an offence. Other countries have comparable laws, for example the US Computer Fraud and Abuse Act and Sri Lanka's Computer Crimes Act of 2007. Data protection law, such as UK GDPR, also applies to any personal data you see during testing.
| Situation | Ethical? |
|---|---|
| Scanning your own home lab | Yes, you own it |
| Testing a client network with a signed contract and scope | Yes, within scope |
| Scanning your employer's network "to help" without approval | No, get written approval first |
| Trying a login form on a public website you do not own | No, unless it runs a published programme that allows it |
Responsible disclosure
Sometimes people find flaws outside a formal test. Coordinated (responsible) disclosure means reporting the issue privately to the owner, giving them a reasonable time to fix it, and only then publishing details. Many organisations publish a vulnerability disclosure policy and a security.txt file at /.well-known/security.txt saying how to report. Bug bounty programmes go further, inviting testing within published rules and paying for valid findings.
Tip: practise only on your own equipment, isolated labs, or legal training platforms designed for the purpose. Keep copies of every authorisation you receive.
Practice
What two things must be true of permission for a test?
During a test you find credentials that would let you into a system outside scope. What should you do?
What is a security.txt file for?
Key takeaways
- Permission separates ethical hacking from crime; get it in writing from the right person.
- Scope says what may be tested; rules of engagement say how.
- Laws such as the UK Computer Misuse Act 1990 make unauthorised access an offence.
- Report findings privately and allow time to fix before disclosure.
- Practise only on your own lab or permitted training platforms.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.