Can a company claim they acted in good faith in this situation?
<p>Let's assume that Hacker Corp. offers a penetration testing service to other businesses, and ACME Corp. contacts Hacker Corp. to conduct a penetration test for some internal testing.</p>
<p>Hacker Corp. requires ACME Corp. to sign a &quot;Permission to Attack&quot; document, which outlines that Hacker Corp. is allowed to attack a specific system of ACME Corp. during a specified timeframe in a specified way.</p>
<p>Due to internal turmoil in ACME Corp., the Permission to Attack document never gets signed by the people with the powers to sign it, and instead a low-level IT employee in ACME Corp. signs instead. During the penetration test, a machine in ACME Corp.'s infrastructure fails and causes an outage, which costs ACME Corp. millions of dollars. This failure was not foreseeable and not caused by negligence.</p>
<p>ACME Corp. now wishes to sue Hacker Corp. for damages, claiming they were attacking ACME Corp. without a valid Permission to Attack. Can Hacker Corp. claim that they acted in good faith, believing that the Permission to Attack was granted by someone from within the company who was allowed to grant such a permission?</p>

<blockquote>
<p>Can Hacker Corp. claim that they acted in good faith, believing that the Permission to Attack was granted by someone from within the company who was allowed to grant such a permission?</p>
</blockquote>
<p>Unless ACME proves that Hacker knew or should have known that ACME's low-level employee had no authority to make the decision on behalf of ACME, Hacker ought to prevail on the basis that it <em>performed</em> the contract. There is no indication in your description that Hacker targeted other system(s) than the one(s) specified or that it departed from the agreed conditions. Therefore, there is no sign of Hacker breaching the <em>implied covenant of good faith</em>.</p>
<p>ACME's evidently poor management (i.e., the turmoil, the delay for signing or denying permission, its low-level employee's opportunity to make sensitive decisions, the company's failure to withdraw the authorization or to take precautions) is not Hacker's fault.</p>

contract-law european-union