Libra40 Scout: how it works and how it stays safe

At a glance

What it does

Finds the devices on the networks you choose, and compares them with the list you gave us.

What it sends

The list you see on screen. Only when you press Send to Libra40.

Where it goes

Libra40's Fieldbook Cloud, on Microsoft Azure in the UK, over an encrypted connection.

How long we keep it

Until our engineer collects it, then it is deleted. Never more than 90 days.

Who makes it

Libra40 Tech Limited.

How it works

1. After you send your answers on your private Libra40 page, the page offers Download Libra40 Scout.
2. On a Windows computer plugged into the network you want checked, unzip the download and double-click Libra40-Scout.exe. It opens a page in your browser. That page runs on your computer only.
3. Tick that you may check this network. Choose which networks to check, then press Start the check. Most networks take a few minutes.
4. Scout shows what it found: each device, what it is, and whether it is on your list. It also shows devices on your list that it did not find.
5. Look through it. Then press Send to Libra40, or Save a copy to keep or send another way.

Seven ways we keep it safe

1. Signed by Libra40.Scout is code-signed by Libra40 Tech Limited before any client receives it. When you open it, Windows shows Verified publisher: Libra40 Tech Limited. If Windows says "Unknown publisher", do not run it. Tell us.
2. Our own address, encrypted.Scout downloads only from scout.libra40.com, with the padlock in your browser. The download and the results both travel over HTTPS.
3. Your own private link.Your link works only for your organisation. It runs out after the time we set, and we can close it at any time. Scout is not on any public page. It is stored privately and encrypted, and reaches you only through your link.
4. A fingerprint you can check.Your page and the READ ME in the download show Scout's fingerprint, a SHA-256 code. Your IT team can check it with one PowerShell line: Get-FileHash .\Libra40-Scout.exe. The two must match. If they do not, do not run it.
5. Plain answers for your IT team.This page says exactly what Scout does and does not do. The technical details are below. It is in every download as "About Libra40 Scout.html", so you can pass it on.
6. You will know it is coming.We tell you on the phone before we send a link. The email comes from a libra40.com address. If a Scout link arrives that you did not expect, call your Libra40 contact before you open it.
7. Checked by Microsoft.We send each new version of Scout to Microsoft for analysis before any client gets it, so Microsoft Defender knows it.

For your IT and security team

• The program. One Windows program (Windows 10 or 11), with a settings file beside it. It runs as the signed-in user and needs no administrator rights. It installs nothing, adds no service, and stops when you press Close.
• Its page. The page Scout opens is served on 127.0.0.1, on a random port. Only this computer can reach it, and it refuses requests made by other web pages.
• Finding devices. On the network the computer is plugged into, Scout asks each address for its hardware (MAC) address, as Windows does whenever it talks to a device. On other ranges you choose, it tries a few common ports on each address to see which ones answer.
• Looking at each device. Scout tries a connection on ports 21, 22, 23, 80, 443, 445, 554, 631, 3389, 8080, 8443 and 9100, and notes only whether each port answers. It reads the device's name (NetBIOS and reverse DNS), asks for its web page once to read the title, and reads the first line an SSH service announces. It never sends a user name or password.
• Limits. Only the ranges you choose. At most 1,024 addresses (a /22) in one range, and 4,096 in all.
• Network load. Light: a few small packets per address. An intrusion detection system may still notice the port checks, so tell your security team or IT provider when you plan to run it.
• What is sent. For each device: its IP address, hardware address, maker, name, which of the ports above answered, its web page title, its SSH first line, and whether it is on your list. Also: the ranges checked, and the devices on your list that were not found. Nothing else. No files, user names, passwords, configurations or network traffic.
• How it is sent. HTTPS to scout.libra40.com (outbound port 443). Scout carries a token that can only add a Scout result to your intake. It cannot read your answers or the documents you sent us.
• Where it is kept. Microsoft Azure, UK South, encrypted at rest. Only Libra40's own laptops can read it. It is deleted as soon as our engineer collects it, and after 90 days at most.
• Save a copy. Writes the same results, as a JSON file, to your Documents folder. Please send that copy the way we agree, not as a plain email attachment.

Before you run it

1. Make sure whoever owns or runs the network agrees. If you have an IT provider or security team, tell them the day and time.
2. Use a Windows computer plugged into the network you want checked.
3. Check the fingerprint, or ask your IT team to.
4. When Windows opens Scout, check it says Verified publisher: Libra40 Tech Limited.

If anything does not match what this page says, stop and call your Libra40 contact. We would much rather you ask.