What a white hat hacker is
A white hat hacker, also called an ethical hacker, is a person who examines the security of computer systems, networks or applications with the agreement of the person who controls them, in order to find weaknesses before an attacker does. The work includes testing a system for flaws, trying to break in under agreed rules, and reporting what was found so that it can be fixed. Many such people work for security firms or for the organisations whose systems they test, and a group that is hired to attack a system in this way is often called a red team.
The term is used in contrast with a black hat hacker, who breaks into systems without permission and usually with harmful intent, and a grey hat hacker, whose conduct falls between the two. The skills of all three can be the same. What differs is the authority under which they act and what they do with what they find.
Why permission is the legal line
The Information Technology Act 2000 does not use the words hacker or ethical hacking. It draws its line at permission. Section 43 applies to any person who, without the permission of the owner or any other person in charge of a computer, computer system or computer network, accesses or secures access to it, downloads, copies or extracts data from it, introduces a computer contaminant or virus, damages or disrupts it, or denies access to a person authorised to use it. The section makes such a person liable to pay damages by way of compensation to the person affected.
Where the act is done dishonestly or fraudulently, section 66 turns it into a crime punishable with imprisonment up to three years, or a fine up to Rs 5 lakh, or both. A tester who acts with permission, within an agreed scope, does not meet the first condition of section 43, which is the absence of permission. That is why a written agreement is the first document in any security test.
The guide to the IT Act 2000 sets out the other offences in Chapter XI, and the page on cyber terrorism explains the most serious of them.
What proper authorisation looks like
Good practice is for the owner of the system to give written permission that names the systems to be tested, the methods that may be used, the period of the test and the people who may be told about it. It is also usual to agree in advance how any weakness will be reported and how data seen during the test will be treated, since a tester may come across personal information. Testing a system that belongs to someone else, even a system that is plainly weak, is not covered by an agreement with a different party.
Where a test touches a system that the Government has declared a protected system under section 70, because it affects critical information infrastructure, the position is stricter and the matter should be taken up with the authorities responsible for it. The Indian Computer Emergency Response Team is the national agency for incident response under section 70B.
What to do on finding a weakness without permission
A person who finds a weakness by accident, for example while using a service normally, should stop, avoid copying or using any data, keep a note of what was seen and tell the owner or the national agency. The safest course is to avoid any further access, because the legal test turns on permission and not on good intentions. The same advice is given for data that has leaked: the person who finds it should report it and should not circulate it.