Someone suggested using PCRE to look for content on Web pages and email:jihad |al Qaida|allah|destroy|kill americans|death|attack|infidels)(washington|london|new york) Without obtaining consent from end users (and thereby protection under the “consent exception”), that means the IDS is conducting a wiretap. The administrator could go to jail, or at least expose himself and his organization to a lawsuit from an intercepted party. Does anyone think real terrorists use any of the words listed in the rules?”]
Source: https://taosecurity.blogspot.com/2005/07/how-to-misuse-intrusion-detection.html