Pen-Testing Scope Approvals and Liability Waivers

Introduction

Penetration testing (pen-testing) is an authorised cybersecurity assessment designed to identify vulnerabilities in computer systems, networks, applications, and cloud infrastructure. Scope approvals define which systems may be tested, which methods are permitted, and when testing must occur. Liability waivers and contractual indemnities allocate certain risks between the tester and the organisation.

Written approval is essential because a security test can otherwise involve unauthorised access, data extraction, service disruption, or damage to third-party systems. A liability waiver does not legalise unauthorised hacking or automatically remove criminal liability.

Legal Framework in India

1. Information Technology Act, 2000, Section 43: Unauthorised access, copying data, introducing malicious code, or damaging computer resources can attract compensation liability. Section 43 expressly concerns acts performed without the required permission.

MeitY

2. Section 66: Where conduct covered by Section 43 is committed dishonestly or fraudulently, Section 66 provides for imprisonment up to three years, a fine up to ₹5 lakh, or both. Valid written authorisation helps establish the permitted scope, but does not protect a tester who exceeds that scope or commits other offences.

IndiaCode

3. Contractual scope and liability waivers: A robust agreement should identify authorised IP addresses, domains, applications, testing dates, permitted techniques, prohibited actions, emergency contacts, data-handling rules, reporting obligations, and termination procedures. It should also clarify responsibility for third-party infrastructure, data loss, service outages, and remediation costs.

4. Third-party systems: Permission from a client does not necessarily authorise testing a cloud provider’s infrastructure, external payment gateway, or another organisation’s systems. Relevant provider approvals and contractual restrictions must also be checked.

Important Case Laws

1. Van Buren v. United States, 593 U.S. 374 (2021)

The US Supreme Court held that the Computer Fraud and Abuse Act’s “exceeds authorised access” provision applies when a person accesses information in computer areas to which their access does not extend. Merely using information for an improper purpose does not necessarily violate that provision. Although not a penetration-testing case, the judgment illustrates why access permissions and system boundaries matter.

LII / Legal Information Institute

+1

2. hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022)

The Ninth Circuit considered the Computer Fraud and Abuse Act in the context of collecting publicly accessible LinkedIn profile data. The decision discussed the distinction between publicly accessible information and access to restricted systems. It does not grant general permission to conduct penetration tests or bypass technical restrictions; its relevance is limited to the interpretation of US computer-access law.

cdn.ca9.uscourts.gov

+1

3. Gagan Harsh Sharma v. State of Maharashtra, 2018 SCC OnLine Bom 6271

The Bombay High Court considered the application of Sections 43 and 66 of the Information Technology Act in a dispute involving software and company control. The Court cautioned against using these criminal provisions as substitutes for resolving a private civil or commercial dispute. The case is relevant to distinguishing contractual disagreements from conduct that genuinely satisfies the statutory elements of a cyber offence.

IndiaCode

Conclusion

Pen-testing agreements should clearly define the authorised scope, approved techniques, testing window, reporting process, and allocation of financial risks. In India, Sections 43 and 66 of the Information Technology Act are particularly relevant to unauthorised computer access and associated damage. Case law reinforces the importance of distinguishing permitted access, contractual disputes, and unlawful conduct. A waiver may allocate certain civil risks, but it cannot override criminal law, bind non-consenting third parties, or excuse activity outside the approved scope.