Legal, Ethical, and Governance Considerations
Legal, Ethical, and Governance Considerations tests lawful and responsible intelligence work. Expect privacy and data protection, computer misuse, terms of service, handling and sharing, oversight, minimization, retention, and ethical judgment.
Core rules
- Establish authority before collection. Know the legal basis, jurisdiction, organizational approval, and any contractual limits. 'Publicly available' does not automatically mean unrestricted use.
- Minimize personal data. Collect only what the requirement needs, define purpose limitation, set retention periods, and protect special categories of data. Privacy laws such as GDPR impose lawful-basis, transparency, and storage-limitation obligations.
- Respect computer misuse laws. Do not access systems without authorization, do not purchase criminal access, and do not use dark-web research methods that exceed approved legal boundaries.
- Honor terms of service, licensing, and data-sharing agreements. Sharing intelligence requires a lawful basis, proper handling caveats, and sometimes a formal agreement.
- Apply ethical review to foreseeable harm, bias, overreach, and the treatment of third parties. Document decisions and escalate dilemmas.
- Governance includes policy, roles, training, audit, and incident escalation. Handling rules must be enforceable, not aspirational.
Worked example
A partner shares an indicator list that includes personal email addresses and names. The receiving team strips the personal data, retains only technical indicators relevant to the requirement, and shares those under TLP:AMBER with the SOC. The original file is stored with access controls and a retention date. Because the partner did not authorize redistribution, the team does not post the indicators publicly. Legal review is requested before any attribution claim that would identify individuals.
Traps that cost marks
- Assuming public data is free of legal or ethical constraints.
- Ignoring terms of service, licensing, or sharing agreements.
- Retaining personal data indefinitely because it might be useful later.
- Mishandling TLP or distributing a partner's data without authorization.
- Collecting or researching without documented authority.