When a Penetration Test Becomes a Criminal Offense
A security manager at a technology company hires an independent penetration tester to assess a new system. Eager to demonstrate skill, the tester exceeds the scope agreed upon verbally and reaches a sensitive production system that was never meant to be tested at all. The question that immediately arises isn't just technical but legal: was this action authorized in the first place, and who bears responsibility if damage results.
The Israeli Computers Law, 5755-1995, provides that accessing a computer without authorization, or exceeding the authorization granted, constitutes a criminal offense - even when there is no intent to cause harm and even when the person acting is a professional penetration tester operating in good faith. In practical terms, this means that conducting a penetration test requires explicit, written authorization that precisely defines which systems may be tested, using which methods, and within what time constraints.
General management approval to conduct a "security test" is not sufficient. The authorization must include concrete detail on the IP ranges, servers, applications, and environments where testing is permitted, so that even if a dispute arises later, it is clear exactly what was authorized and what was not.
The Authorization Document: Scope, Timing, and Rules of Engagement
The primary tool for legal protection before a penetration test begins is a detailed authorization document, sometimes called a letter of authorization or Rules of Engagement. This document, signed by an authorized company representative, is effectively the source of legality for every action the tester performs.
A proper authorization document should include, among other things:
- A precise list of systems, IP addresses, and domains where testing is permitted
- A defined testing window, including permitted operating hours
- Permitted and prohibited testing methods - for example, whether social engineering, simulated phishing, or load testing that could cause an outage is allowed
- An available point of contact throughout the testing period, and an immediate stop procedure (kill switch) in case something goes wrong
- A procedure for immediate reporting of any critical finding discovered during testing, rather than waiting for the final report
The more detailed the document, the lower the risk of a legal dispute between the parties over exactly what was agreed - and what exceeded the boundaries of the authorization.
Key Contract Terms with Your Penetration Testing Vendor
Beyond the authorization document itself, the engagement with a penetration testing vendor should be anchored in a commercial agreement that governs the full scope of the legal relationship between the parties.
Clauses worth confirming are in the agreement
- Full confidentiality over test findings, including a prohibition on using or publishing them for any purpose beyond the service itself
- Limitation of liability and an indemnification commitment for damage caused to systems as a result of testing, calibrated to the actual level of risk involved
- A requirement for professional and liability insurance at a level appropriate to the sensitivity of the information the vendor will be exposed to
- A prohibition on subcontracting the work without prior approval, or at minimum a disclosure and consent requirement
- Clear ownership of the report and findings, including limits on how long the vendor may retain them after the engagement ends
- A retest mechanism to verify that identified vulnerabilities have actually been remediated
It's worth remembering that the penetration testing vendor gains access to the most sensitive information a company has - the map of its own vulnerabilities. A loosely drafted agreement on this point can turn the tester itself into a risk factor.
Testing Cloud Environments and Third-Party Systems
Many technology companies run their systems on cloud infrastructure from providers such as AWS, Azure, or Google Cloud, or rely on external SaaS services. In these cases, the company's own authorization for a penetration test is not enough.
Major cloud providers set out, in their terms of use, prerequisites for conducting penetration tests on infrastructure hosted with them - typically a duty of advance notice or the need to obtain explicit approval through the provider's management portal. Running a test without meeting these requirements may be treated as a breach of the provider's terms of use, even if the company only tested its own system, and could even result in temporary suspension of service.
In multi-tenant environments, particular care is needed to ensure that testing does not affect other customers sharing the same infrastructure. It is advisable to check in advance which official channels the provider uses for approval, and to document that approval as part of the project's legal record.
Personal Data Exposed During Testing
Penetration tests are, by nature, designed to expose weaknesses - and the result is often actual access to databases containing customers' personal data, such as a successful SQL injection attack. This exposure triggers obligations under the Privacy Protection Law, 5741-1981, as amended by Amendment 13.
The agreement with the testing vendor should include a clear limitation: to the extent personal data is exposed during testing, actual exposure should be minimized (for example, demonstrating that a vulnerability exists rather than extracting large volumes of records), any data collected as evidence must be secured, and it must be deleted once the process concludes and findings are confirmed.
If the test itself reveals a vulnerability indicating an existing or potential security incident, the company's internal reporting procedures should be triggered in accordance with the security incident notification obligations under the law as amended. It is advisable to include in the agreement a requirement that the vendor immediately report to the company any unintentional exposure of personal data, so the company can meet the relevant timeframes for assessing its notification duty.
Legal Privilege and Handling the Findings Report
A penetration test report is an especially sensitive document - it details every weak point in the company's defenses, and in a sense functions as an attack manual if it falls into the wrong hands. Beyond that, in the event of future litigation, such as a lawsuit following a cyber incident, there is a risk the report could be sought in discovery.
A common way to reduce this risk is to commission the penetration test through the company's legal counsel, so the work is performed for the purpose of legal advice rather than as a purely technical project. Structuring the engagement this way may strengthen a claim of attorney-client privilege or work product privilege, depending on the specific circumstances and how the engagement is managed.
In addition, the agreement should establish a restricted distribution list for the report, secure storage, a defined retention period, deletion once the business need has passed, and an obligation on the vendor to avoid retaining copies after the engagement ends.
What to Verify Before Signing the Agreement
A penetration test is an essential tool in any information security toolkit, but it is also an activity that carries inherent legal risk if it isn't managed properly. Before launching a project, it is worth confirming several key points.
- A written authorization document, signed by an authorized signatory, that precisely details the scope of testing
- A full commercial agreement covering confidentiality, limitation of liability, insurance, and rights to the report
- Verification of prerequisites with cloud providers and third-party infrastructure before work begins
- A defined procedure for handling personal data that may be exposed during testing, including orderly deletion
- Consideration of engaging legal counsel to commission the test, to strengthen a privilege claim over the report
- A retest mechanism to confirm that identified vulnerabilities have actually been remediated
Companies operating in regulated industries, such as financial services, are sometimes also subject to specific regulatory obligations to conduct periodic testing - it is advisable to review the relevant requirements with the specific regulator, as these requirements change and are updated from time to time.
Ultimately, a successful penetration test is not just one that identifies technical weaknesses, but one managed within a clear legal and contractual framework - one that protects the company from legal exposure while allowing it to make the most of the findings without creating additional risk.
The information contained in this article is general in nature and does not constitute legal advice. For advice tailored to the specific circumstances of your company, we invite you to contact our firm.
