Your company performs penetration tests and security assessments for small and medium-sized business in the local area. During a routine security assessment, you discover information that suggests…

Security professionals who uncover evidence of serious crimes are legally and ethically obligated to report it to the appropriate authorities without delay. Continuing the assessment could be construed as complicity, and the professional duty of care to society supersedes the contractual obligation to the client in cases involving criminal activity.

Copying the data to removable media risks tainting the evidentiary chain of custody and could constitute evidence tampering, complicating any subsequent prosecution.

Confronting the client directly is dangerous, could allow the client to destroy evidence, and is not the role of a security assessor.

Ignoring criminal activity and completing the engagement makes the assessor potentially complicit in ongoing crimes and exposes them to serious legal liability.