NMAP, also known as Network Mapper, is a free and open-source utility used for network discovery and security auditing. Concerning its legality, NMAP is legal to use for legitimate and ethical purposes. Germany and the UK dictate that the consent of the scanned party is often required whilst in other jurisdictions like the United States, usage and rules are dependent on intentions, consent, and the degree of intrusion.
This tool works by sending packets to system ports and interpreting the responses to determine what services are running on those systems. It is commonly used by system and network administrators, security professionals, and auditing services to find live hosts on a network, open ports, and other relevant data for maintaining, troubleshooting, and securing networks.
However, the use of NMAP can become illegal when it is used with malicious intent, such as unauthorized scanning of networks, planning network attacks, or exploiting vulnerabilities found through scanning. Legally, network scanning can be seen as an invasion of privacy, or unauthorized access under various cybercrime laws, such as the U.S. Computer Fraud and Abuse Act (CFAA).
According to the NMAP Public Source License, users are responsible for ensuring they comply with all applicable laws and regulations, including but not limited to those related to intrusion and unauthorized access. (Source: https://nmap.org/book/man-legal.html). So, if NMAP is used to gain unauthorized access to a system or to perform an action that is illegal in your jurisdiction, then that specific use of NMAP would indeed be illegal.
In the UK, under the Police and Justice Act 2006, it is a crime to possess “any article” that can be used to commit computer crime (Source: https://www.legislation.gov.uk/ukpga/2006/48/section/35). This literally implies that using NMAP could be seen as an offence if it’s not properly justified or given consent for. Similarly, in Germany, Section 202c of the Penal Code criminalizes the distribution of security tools if they are intended for illegal use (Source: https://www.bmi.bund.de/SharedDocs/gesetzestexte/EN/StGB_englisch.pdf?_\_blob=publicationFile&v=2).
A case in point is when Andrew Auernheimer, also known as “weev,” found a flaw in AT&T’s public server and used it to gather the email addresses of early adopters of the iPad in 2010. Even though Auernheimer argued that he used a script to mimic the behavior of a web browser, and that he accessed only information that AT&T had made publicly accessible, he was still prosecuted and convicted under the CFAA (Source: https://www.wired.com/2013/09/att-hacker-loses-appeal/)
So, the tool itself is not illegal, but how it can be used can blur the lines of legality. It is always recommended to get explicit permission from the network or system’s owner before performing any scanning activities to aid in conflict avoidance.
