1

Let's assume that Hacker Corp. offers a penetration testing service to other businesses, and ACME Corp. contacts Hacker Corp. to conduct a penetration test for some internal testing.

Hacker Corp. requires ACME Corp. to sign a "Permission to Attack" document, which outlines that Hacker Corp. is allowed to attack a specific system of ACME Corp. during a specified timeframe in a specified way.

Due to internal turmoil in ACME Corp., the Permission to Attack document never gets signed by the people with the powers to sign it, and instead a low-level IT employee in ACME Corp. signs instead. During the penetration test, a machine in ACME Corp.'s infrastructure fails and causes an outage, which costs ACME Corp. millions of dollars. This failure was not foreseeable and not caused by negligence.

ACME Corp. now wishes to sue Hacker Corp. for damages, claiming they were attacking ACME Corp. without a valid Permission to Attack. Can Hacker Corp. claim that they acted in good faith, believing that the Permission to Attack was granted by someone from within the company who was allowed to grant such a permission?

Improve this question

1 Answer 1

Reset to default
4

Can Hacker Corp. claim that they acted in good faith, believing that the Permission to Attack was granted by someone from within the company who was allowed to grant such a permission?

Unless ACME proves that Hacker knew or should have known that ACME's low-level employee had no authority to make the decision on behalf of ACME, Hacker ought to prevail on the basis that it performed the contract. There is no indication in your description that Hacker targeted other system(s) than the one(s) specified or that it departed from the agreed conditions. Therefore, there is no sign of Hacker breaching the implied covenant of good faith.

ACME's evidently poor management (i.e., the turmoil, the delay for signing or denying permission, its low-level employee's opportunity to make sensitive decisions, the company's failure to withdraw the authorization or to take precautions) is not Hacker's fault.

Improve this answer
18
  • 1
    In my hypothetical scenario, Hacker Corp. only attacked the systems that were outlined in all previous conversations with ACME Corp. So I assume ACME have to deal with the damages done.
    – MechMK1
    Apr 16, 2021 at 13:25
  • Such documents usually contain a provision in which the signer warrants that s/he has authority to sign on behalf of the company. Hacker Corp is entitled to rely on such a provision unless hey knew or had reason to know that they should not have.
    – David Siegel
    Apr 16, 2021 at 13:28
  • I think you've reached the right outcome, but the wrong way. If the company is alleging there was no contract to begin with, it isn't raising a contract claim, and performance of the contract therefore can't be the basis for Hacker to prevail. Instead, Hacker should assert apparent-authority under agency theory, claiming that it reasonably believed the IT grunt had authority to enter into the contract. It could then use that contract to argue that it had Acme's consent to conduct its test, defeating whatever negligence or intentional-tort claims Acme has raised.
    – bdb484
    Apr 16, 2021 at 15:44
  • Of course, either analysis relies on common-law principles, which may not even be relevant, given the EU tag.
    – bdb484
    Apr 16, 2021 at 15:44
  • @bdb484 "I think you've reached the right outcome, but the wrong way. If the company is alleging there was no contract to begin with". ACME cannot simply allege that. The document with the employee's signature evidences ACME's acceptance of Hacker's offer. Hence the formation of a contract. ACME would need to present evidence that outweighs the probatory value of the signed document.
    – Iñaki Viggers
    Apr 16, 2021 at 18:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .