THX for pointing these out ... for the nmap section, I did not mean to imply I perform such actions without the knowledge of the external entities. Yet my interpretation of the law makes no distinction between using such tools in a professional capacity versus in a terrorist capacity. But I'll re-read it when I get into work this morning EDT.

Who was that guy in Tulsa (?) who found a hole in someone's web server, nabbed some data to prove the problem, notified the site of their security issue, and was arrested? While I do not agree with the data theft or having performed such actions without the knowledge of the site itself, could one argue that finding open ports, software versions, etc. on a remote machine acquiring "data"? I'm no legal eagle, and I've asked my employer's legal department read the legislation and tell me how it may impact my day-to-day activities.

I guess my concern here is having to prove one adhered to the law. It seems easy under this section to have a "Salem Witch Hunt" kind of scenario, moving the burden of proof back to the defendent. And, only time will tell how policing agencies enforce it and how the judicial interprets it.

THX

YMMV
--
idnopheq
Apply yourself to new problems without preparation, develop confidence in your ability to to meet situations as they arrise.

~ Shunryu Suzuki