Is it legal to forge a Permission to Attack during a physical penetration test engagement?
<p>When doing <a href="https://en.wikipedia.org/wiki/Penetration_test" rel="nofollow noreferrer">penetration testing</a> (hired as a security consultant to examine and test a company's security by simulating an attacker), it's necessary to have a document called &quot;Permission to Attack&quot; (PtA) which outlines the scope of your actions and gives you explicit authorization to perform them. The same is true with physical pentesting where the pentester emulates physical attackers (even to the point of picking locks and forging access credentials, assuming it authorized in the scope).</p>
<p>One must have the document with them in case they are &quot;caught&quot; by the organization's security. On the Information Security site, the answer to <a href="https://security.stackexchange.com/q/221018/106285">a question about this</a> suggests that it could be better to first <em>forge</em> the document and, if it is accepted by security, you continue on your way and document security's failure to stop you (since a real criminal could have forged the document as well). If, on the other hand, they don't accept the forged document, then you provide the real document.</p>
<p>The following is from the accepted answer (emphasis in original):</p>
<blockquote>
<p>If you don't have your Permission to Attack with you, it's like driving without a driver's license. That said, if you are caught during an engagement, I recommend the following:</p>
<ol>
<li><p><strong>Present a <em>forged</em> Permission to Attack.</strong> This way, you can see if criminals could possibly trick a security guard to letting them do their thing with a fake Permission to Attack.</p>
</li>
<li><p><strong>Present the <em>real</em> Permission to Attack.</strong> If a guard has not bought your fake slip, then it's time to hand in the real slip. If the guard believes you, it's time to pick up and leave the perimeter. A real attacker would have been stopped at this point. If the guard did not believe you, ask them kindly to talk to their supervisor. If they insist on not believing you and calling the police, so be it. You're not a criminal, so don't worry about it.</p>
</li>
</ol>
</blockquote>
<p>Are there any circumstances under which this would be illegal?</p>

<p><a href="/questions/tagged/california" class="post-tag" title="show questions tagged &#39;california&#39;" rel="tag">california</a></p>
<h3>It's legal, because the pentester doesn't have the intent to defraud.</h3>
<p><a href="https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=470.&amp;lawCode=PEN" rel="noreferrer">California Penal Code Section 470</a> governs forging documents, signatures, handwriting, etc. All of its provisions making actions illegal begin with &quot;Every person who, with the intent to defraud...&quot;</p>
<p>Because the company itself is aware of and has authorized their actions, the pentester isn't attempting to defraud the company whose premises they are attempting to enter.  They are providing forged documents to the guard (who isn't aware of the test), but a real attacker doing that would be attempting to defraud the <em>company</em>, not the <em>guard</em>.</p>
<p>Of course, as with any otherwise-illegal action taken during a penetration test, this assumes that the agreement with the company granted the pentester permission to take that action (i.e., that it was in scope for the test).</p>

united-states criminal-law