A county legal memo addresses social-engineering and pentest boundaries. Which statement best captures the legal risk of exceeding rules of engagement?
Select an answer to reveal the explanation.
Short Explanation
A signed ROE is the hall pass—wander into out-of-scope systems and you may look less like a tester and more like a computer-crime defendant. Civic badges do not grant infinite legal immunity.
Full Explanation
Rules of engagement define the authorized systems, techniques, data, and timing for civic SE and penetration tests. Testers who exceed those boundaries—even while employed by or contracted to a municipality—may create exposure under the CFAA and analogous state computer-crime statutes, plus civil and contractual liability. A mayor's informal interest in security does not replace written authorization, and civic purpose does not grant unbounded legal immunity.
Treating ROE as optional after a verbal mayoral mention fails by concept: verbal enthusiasm is not a substitute for scoped written authorization. Claiming that exceeding ROE systems never creates computer-crime exposure is false and dangerous for testers and sponsors. Asserting that CFAA-type concerns only apply to foreign actors ignores domestic unauthorized access theories that can apply to overreaching assessments.
Exam caveat: Good-faith belief that a system should be in scope is not a defense if the ROE excluded it. Change control matters: expanding scope requires documented amendment, not improvisation during a successful pivot. Distinguish policy violations inside an employer disciplinary frame from criminal exposure—both can apply depending on facts, but exam focus is that overreach can create computer-crime risk.
Operational check: Before testing, reconcile target lists with asset inventory and get written confirmation of inclusions and exclusions; if a pivot suggests a new system, stop and obtain documented ROE amendment. Retain authorization letters and ROE versions with the engagement record for legal defensibility.