Recon on Trial - The OSINT Operators Legal Playbook

The talk examines routine open-source reconnaissance tasks, including scraping public sites, enumerating subdomains, searching GitHub for leaked secrets and calling APIs, and asks where each one starts to create legal exposure. The speaker, a court-qualified expert witness with a regulator background, treats three questions separately: is it a crime, can the operator be sued, and how would it look to an employer. Clearing one does not clear the others.

The middle section covers the main statutes. The Computer Fraud and Abuse Act hinges on access "without authorization" and "exceeds authorized access", and the Supreme Court's Van Buren ruling narrowed the second phrase. Scraping public pages was found not to violate the CFAA in the LinkedIn dispute, yet contract terms still created liability. The Uber case shows how a bug bounty payout cannot cover a concealed breach, and the person who covered it up went to prison. Passive enumeration sits low on the risk scale, while forced zone transfers or brute forcing move toward active access. Using a discovered API key is where the line is crossed.

The closing section addresses preservation letters, which can arrive before any lawsuit or charge. The advice is to stop activity, delete nothing, avoid talking to investigators and bring in an attorney. Privacy laws such as GDPR and CCPA can still bring statutory damages even when criminal exposure is avoided. The practical takeaway is to stick to public, ungated data, read terms of service, and get explicit written scope before touching anything beyond that. The talk is not legal advice.