Legal, Ethical, and Policy Considerations
Core concepts
Intelligence and security work operates within law, policy, and ethics. Know the distinction between legal (what the law permits), policy (what the organization permits), and ethical (what is right) - an action can be legal but still violate policy or ethics. Understand privacy and data protection, proportionality, necessity, minimization, and accountability.
Governance and oversight
Expect questions on oversight and authorization (who approves collection), data retention, handling of personally identifiable information (PII), and the duty to report wrongdoing (whistleblowing). Know that need-to-know and least privilege are both security and legal controls.
Traps to watch
- Assuming "legal" means "allowed" - policy and ethics add constraints.
- Collecting more personal data than necessary (violates minimization).
- Acting without proper authorization or outside one's authority.
- Retaining data indefinitely without a lawful basis.
- Confusing organizational policy with statute; both bind, differently.
Rule of thumb
Before any sensitive collection or action, run the four-question test: Is it lawful? Is it authorized by policy? Is it proportionate and necessary? Am I accountable for it? A "no" to any question means stop and escalate.
Worked example
An officer wants to monitor an employee's personal social media. It may be lawful in some contexts, but ask: does policy permit it, is it necessary and proportionate to a legitimate requirement, and is it authorized? If any answer is unclear, escalate rather than proceed.