Code of Conduct

Purpose and Scope

This document establishes the overarching Code of Conduct & Ethics for Echelon Security Consulting LLC (hereafter referred to as "ESC"). It dictates the operational, ethical, and legal boundaries for all ESC personnel, contractors, and partners rendering services across Southeast Asia, East Asia, and globally.

These policies apply to all ESC consultancy services, including but not limited to: cybersecurity, risk analysis, intelligence assessment, geopolitics, cyberwarfare and eCrime research, targeted intrusion simulation, threat actor engagement, deep/dark web intelligence, OSINT, CSIRT/SIRT and ISAC enablement, strict/conditional active defence, military upstream consultancy, vendor due diligence, zero-day intelligence, digital transformation, AI consultancy, and CCTV/crowd surveillance intelligence.

Code of Conduct and Professional Ethics

ESC operates at the complex intersection of cybersecurity, geopolitical intelligence, and active defense. To maintain the highest standards of integrity, all ESC personnel must adhere to the following ethical principles:

• Legality and Compliance: All operations, including surveillance, deep web intelligence gathering, and intrusion simulations, must strictly adhere to the local and international laws governing the jurisdictions in which ESC and its clients operate (e.g., Thailand's PDPA, international cyber laws).
• Objectivity and Independence: Geopolitical assessments, attribution of state-sponsored nexus actors, and threat intelligence reporting must be based on verifiable data and unbiased all-source intelligence, free from political or corporate manipulation.
• Proportionality and Restraint: In all military upstream consultancy and strict/conditional active defense operations, ESC advises and executes only proportionate measures designed to neutralize threats without causing collateral damage to civilian infrastructure or non-combatant networks.
• Privacy and Human Rights: CCTV, crowd/public surveillance, and social media assessments must be conducted strictly for security, threat detection, and risk analysis purposes, avoiding unwarranted infringement on personal privacy.

Prohibited Engagements (Absolute Exclusions)

ESC maintains a zero-tolerance policy for specific categories of criminality. Under no circumstances will ESC accept, honor, or facilitate consultancy service requests, intelligence gathering, or technical support for clients, operations, or investigations directly related to the following:

• Pedophilia and Child Exploitation Crimes
• Human Trafficking Crimes
• Illicit Guns and Arms Trafficking Crimes
• Alcohol-related Crimes (e.g., smuggling, illicit distribution)
• Drugs and Narcotics-related Crimes

Operating Parameters (OP)

The following OP governs the operational execution of ESC services:

Information Handling and Sharing

Given the sensitive nature of espionage, malware research, and geopolitics assessments, ESC strictly regulates how data is categorized and shared, particularly within ISAC and CSIRT/SIRT communities.

5.1 Traffic Light Protocol (TLP)

ESC utilizes the FIRST Traffic Light Protocol (TLP v2.0) to facilitate the secure sharing of sensitive information:

5.2 Information Exchange Policy (IEP)

ESC adheres to a strict Information Exchange Policy when collaborating with external entities, vendors, and intelligence networks:

• Attribution & Anonymity: When sharing threat intelligence (e.g., malware hashes, eCrime TTPs) with ISACs, all client-identifying data must be anonymized unless explicit permission is granted.
• Handling Caveats: Any data shared with external partners will include specific Handling Caveats detailing permissible actions (e.g., "For passive monitoring only," "Do not scan").
• Vendor Due Diligence: Information shared with third-party vendors for AI consultancy or digital transformation must be protected under strict Non-Disclosure Agreements (NDAs).

Responsible Disclosure Policy

In the course of providing vendor due diligence, malware research, and zero-day intelligence, ESC personnel frequently discover undisclosed vulnerabilities. ESC is committed to the responsible disclosure of these findings:

1. Verification: The vulnerability is verified internally in a sterile, sandboxed environment.
2. Notification: The vendor or asset owner is notified securely with a proof-of-concept and technical details.
3. Embargo Period: ESC standardizes a 90-day embargo period (or a mutually agreed-upon timeframe for complex hardware/AI systems) to allow the vendor to patch the vulnerability.
4. Active Exploitation Exception: If ESC detects that a state-sponsored nexus actor or eCrime syndicate is actively exploiting a zero-day in the wild, ESC reserves the right to immediately alert CSIRT/ISAC communities and publish defensive indicators (IoCs) to protect the broader ecosystem, while coordinating with the vendor.
5. Public Disclosure: Following the embargo period and patch release, ESC may publish its research to contribute to global situational awareness and threat intelligence.

Policy Enforcement

Violations of this Code of Conduct, particularly regarding the prohibited engagement clauses, will result in immediate termination of the client contract or termination of the ESC employee/contractor involved, followed by legal action if necessary.

Contact & Queries

For questions about this Code of Conduct, to report a concern regarding ESC's operations or the conduct of ESC personnel, or to raise a compliance matter, please contact ESC's leadership team directly:

ESC is committed to resolving all compliance concerns promptly, professionally, and with the same discretion applied to every client relationship. Whistleblower disclosures regarding violations of this Code will be handled in strict confidence.