Malware Law, CAN-SPAM and Forensic Standards

What it is

This page covers the legal limits on handling malware, the main US law on unwanted commercial email, and the international standards that describe good forensic practice. Standards do not replace the law, but following them shows that evidence was handled by an accepted method.

How it works

Legal challenges in dealing with malware

Malware is dangerous to hold and legally sensitive to handle. Issues include:

• Authorization: analyzing or testing against systems you do not own can break unauthorized access laws such as the US Computer Fraud and Abuse Act or the UK Computer Misuse Act.
• Hack back: attacking or accessing the attacker's systems to recover data or disable them is generally illegal for private parties.
• Sample handling: possessing and sharing samples needs care. Distribution can spread the harm, and samples may contain stolen personal data.
• Privacy: malware often holds victims' stolen data, so examination must follow data protection rules.
• Jurisdiction: attackers, servers and victims sit in different countries.
• Containment duty: infected evidence must be kept isolated so it does not spread to other systems.
• Attribution claims: naming a culprit without strong proof can create legal risk.
• Evidence integrity: running malware in a lab changes the system, so the original must be preserved and the analysis done on a copy.

Practical control: analyze in an isolated, authorized lab, keep notes, hash every sample, share indicators through approved channels, and involve legal counsel and law enforcement where required.

CAN-SPAM Act

The Controlling the Assault of Non Solicited Pornography and Marketing Act of 2003 is the US law that sets rules for commercial email. It does not ban commercial email and does not require prior permission (opt in), but it requires senders to follow these rules:

Violations carry civil penalties per email, and some aggravated acts (for example harvesting addresses or using false headers to hide the source) can lead to criminal charges. Forensically, the email header is the evidence: forged headers and deceptive routing show a violation.

ISO standards

The ISO/IEC 27000 family includes standards that guide digital evidence handling.

ISO/IEC 27037 introduces the roles of the digital evidence first responder and the specialist, and the principles of relevance, reliability and sufficiency. The series covers the whole path from the scene to eDiscovery.

ENFSI best practices

The European Network of Forensic Science Institutes (ENFSI) publishes a Best Practice Manual for the Forensic Examination of Digital Technology. It gives guidance to laboratories on:

• Quality management and accredited processes.
• Staff competence and training.
• Scene handling and evidence reception.
• Examination methods and validation of tools.
• Documentation, review and reporting.
• Storage and security of exhibits.

It aims at consistent, reliable examination across European laboratories and supports accreditation to ISO/IEC 17025.

A worked example

A security team receives a malicious attachment. A colleague proposes to test it by connecting to the sender's server and checking if it is live.

That would risk unauthorized access. The team analyzes the file in an isolated lab, records the hash, notes indicators such as the server address and passes them to law enforcement and the CERT. They treat the lab work as a documented process under the ISO/IEC 27037 principles.

How the exam asks about this

• "Which US law requires an opt out in commercial email?" → The CAN-SPAM Act.
• "Which ISO standard covers collection, acquisition and preservation of digital evidence?" → ISO/IEC 27037.
• "Which body publishes a best practice manual for digital technology examination in Europe?" → ENFSI.