Ethics and law

1. The principle

The techniques you learn on EVIL — SQL injection, scanning, OSINT, malware analysis — are the same ones used by both attackers and defenders. What changes is not the technique, but the purpose and the permission. Studying how to get into a system is how you learn to close its doors: it is the job of security work.

EVIL’s goal is to train people who can reach the highest technical level together with the highest sense of responsibility: programmers, security professionals, ethical hackers, security researchers, software engineers. Competence and legality always go together.

2. Code of conduct

Those who use EVIL commit to:

using the analysis tools only on their own systems or ones they have written authorisation for;
not damaging, disrupting or overloading third parties’ systems and services;
not collecting or spreading other people’s personal data without a legal basis (no doxxing);
not using what they learn for fraud, extortion, stalking, defamation or any other offence;
treating simulated or sample data as such, without passing it off as real evidence;
reporting the vulnerabilities they find responsibly, without exploiting them.

When you sign up you accept this code and the privacy notice. Breaking it leads to your account being suspended and, depending on the case, legal consequences for which you are personally responsible.

3. Written authorisation

Before analysing a system that is not yours, you need written permission from whoever is entitled to give it, with clear rules of engagement. A verbal agreement is not enough. The document should state at least:

scope: which domains, IP addresses and applications are included, and what is excluded;
timing: the windows in which you may operate and the emergency contacts;
techniques: what is allowed and what is not (for example denial of service or social engineering against employees);
data: how to handle any sensitive data found, how long to keep it and how to destroy it.

Rule of thumb: if you cannot show an authorisation document, do not run the test. EVIL teaches the method; responsibility for carrying it out on real systems remains with you and the client.

4. Italian law

In Italy, unauthorised access to and damage of computer systems are criminal offences. The main articles of the Criminal Code on the subject are:

Article	In brief
Art. 615-ter	Unauthorised access to a computer or telecommunications system, or remaining there against the will of whoever has the right to exclude.
Art. 615-quater	Unlawfully holding, spreading and installing access codes (passwords, credentials) to protected systems.
Art. 617-quater	Unlawful interception, prevention or interruption of computer or telecommunications communications.
Art. 635-bis et seq.	Damaging information, data, programs and computer systems, whether public or private.
Art. 640-ter	Computer fraud: altering a system or data to gain an unjust profit at someone else’s expense.

At European and national level the GDPR (EU Regulation 2016/679) also matters for personal data, as does the NIS2 directive, transposed in Italy in 2024, for the security of many organisations’ networks and information systems.

This page is an educational summary and is not legal advice. Legal references can change: for a specific case, check the text in force and, if needed, consult a professional.

Public information about a person is personal data too. Collecting and cross-referencing it (for example with OSINT) requires a legal basis (Art. 6 GDPR) and, if you reuse that data outside personal study, the duty to inform the person (Art. 14). Doxxing — collecting and spreading someone’s data to expose, intimidate or harass them — is forbidden on EVIL and may be a criminal offence.

That is why EVIL’s OSINT modules are oriented towards assessing your own exposure and public figures, not profiling private individuals.

6. Responsible disclosure

If, during authorised study, you find a vulnerability, the right thing is to report it to whoever runs the system and give them time to fix it before making it public. In practice:

look for an official channel: a /.well-known/security.txt file, a "security" page or a bug bounty programme;
describe the problem clearly and reproducibly, without exploiting it beyond what is needed to demonstrate it;
agree reasonable timescales for the fix and do not disclose the details until it is resolved;
do not ask for money in exchange for silence: that would be extortion.

In Italy the national point of reference for incidents is CSIRT Italia (the National Cybersecurity Agency). Found a problem on EVIL itself? Write to us from the Help page.

7. Grey areas

Some situations look harmless but are not:

a "passive-only" scan of someone else’s site may still breach its terms of service;
reading public data about a person is lawful; collecting and profiling it systematically often is not;
trying a found credential "just once" is already unauthorised access;
a system that "looks abandoned" does not mean it has no owner.

When in doubt, stop and ask. Practise on your own systems, on EVIL’s Virtual lab or on environments built for practice. Uncertainty is not authorisation.