IT & cloud certifications · course 52 of 105
Ethical Hacking: Where the Legal Line Is
Stay on the right side of the law before you test anything: what a penetration test is, what US hacking law and DOJ policy say, and how NIST plans a test. Not legal advice.
Not on sale yet. When sales open: $4.99 USD for this course, paid once, or every course for $9.99 USD a month. Prices
$4.99 USD, paid once. Or every course for $9.99 USD a month until you cancel; try it free for 7 days first (email only, no card, ends on its own). Tax added at checkout where it applies.
Runs in Claude (claude.ai, the Claude apps or Claude Code) with your own Claude account. A course opens there as soon as your payment goes through; nothing is shipped.
Preview
What it teaches
That a penetration test is defined as authorized, what the US Computer Fraud and Abuse Act’s words say about access “without authorization” and “exceeding authorized access”, what the Department of Justice’s charging policy says (good-faith security research, terms-of-service violations, cease-and-desist letters, and that the policy is no legal shield), and how NIST’s testing guide says a test is planned: phases, Rules of Engagement, legal advisors, NDAs, privacy of captured data. The AI asks 3 questions, places you, shows a short card per module, then gives you one question at a time.
The course never says whether anything a student did or plans is legal; it says what the texts say. DOJ’s policy itself says it creates no right anyone can rely on.
No techniques, tools or commands; the build check fails if attack-tool words appear in any question.
How long
21 items. About 20-35 rounds plus a 12-item final: 1 session (estimate, not timed with a real student). The tutor gives a one-line save code at the end of each session.
The modules
3 modules, drilled one item at a time.
- M0
The words and the law’s text
The words and the law’s text: what the CFAA says, and doesn’t define
- M1
What DOJ’s policy says
What DOJ’s charging policy says: Yes or No, and why
- M2
How a test is planned
How NIST says a test is planned: Yes or No, and why
Before it teaches, it asks
- 1What brings you to ethical hacking (a security job, a course, curiosity), and have you ever been asked to test a system?
- 2A user signs up to a social network under a made-up name, which the site’s terms forbid. Does DOJ’s policy say that breaking the terms, by itself, withdraws the user’s authorization under the CFAA? Say why.
- 3In NIST’s four-phase example of a penetration test, does any testing happen in the planning phase? Say why.
What’s exact, and what isn’t
Show
Straight from the course’s own notes.
- Quoted, not interpreted
- Every answer is what a quoted text says: 18 U.S.C. 1030, DOJ’s Justice Manual 9-48.000, NIST SP 800-115 (2008) or Wikipedia’s definition of a penetration test; 20 quotes: 14 matched on the live web pages 2026-10-11, 6 on NIST’s PDF as downloaded that night (hash recorded).
- Honest limits
- US federal law and DOJ policy only; no court cases (the sources here don’t include them), no state or foreign law; NIST’s guide is from 2008 and its four phases are, in its own words, one example.
- Not in it yet
- Court decisions on “authorization”, bug bounty programmes, scoping documents in depth, reporting findings, certifications.