Threat › Module 8 › Lesson 3
Legal Ethics
TI collection legal ethics literacy — RoE, privacy, consent, sharing boundaries — on `$TI_LAB` program stub only.
Visual · t33_legal_ethics
Legal ethics = named collection RoE rows. $TI_LAB. Original Cyberlium.
Opening
Collection without legal ethics burns programs — name RoE and privacy rows on YOUR lab stub before touching prod sources or stranger data.
Legal ethics literacy names: Rules of Engagement for collection category, privacy/data-protection awareness stub, consent and terms-of-service literacy category, cross-border sharing restrictions category, insider vs OSINT source handling category, and stop conditions when scope unclear. Analyst writes collection RoE one-pager for `$TI_LAB` program — cites Module 8-1 hygiene and 8-2 capability rows — documents stop-if-out-of-scope rule — without harvesting unauthorized data, without 'ethics theater' on marketplace sources, without sharing TLP:RED broadly. Cyberlium ethics gate for all Topic 33 collection artifacts. Refused: unauthorized collection, marketplace sources, skip stop conditions. Lab row: collection RoE one-pager with ten scope items and refused paths.
1. Named RoE sections
Scope in, scope out, privacy, sharing, stop conditions — five literacy anchors.
In-scope = `$TI_LAB` fictional stubs and instructor samples only.
Command guide
Try these commands — Named RoE sections
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, curl. Reference sites: FIRST Trusted Introducer (https://www.first.org/global-sigs/trusted-introducer); CISA (https://www.cisa.gov/); OASIS STIX (https://oasis-open.org/committees/cti/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Refused paths
Marketplace sources, corp mass-enum, doxxing, unauthorized prod feeds — label red.
Stop condition triggers when legal gate unclear — document escalation stub.
3. Sharing boundary
Lab notes → internal mentor review — not public dump of collection stubs.
Real prod finding outside lab → owner notify within org RoE category.
4. What you ship: collection RoE one-pager
Ten scope items + refused paths + stop conditions + NEVER marketplace source line.
5. What you record before the next lesson
Collection RoE one-pager path.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Write RoE that includes 'any dark-web marketplace for IOC collection.'
Right
Collection RoE one-pager for `$TI_LAB` program stub. Next: Collection Lab.
Mission: collection RoE one-pager
1) List ten in-scope items. 2) Five refused paths labeled. 3) Stop conditions UTC. 4) Write NEVER marketplace source line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Stop condition — minimum literacy?”
Knowledge Check
APPLY: Collection legal ethics on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Marketplace sources fit collection RoE.
True or False
Knowledge Check
APPLY: RoE includes:
Multiple choice