> He also noted that a provision in the contract required the SCA to secure all necessary permission for the execution of the contract.

Therefore it seems to me that if anything illegal was done, it was SCA failing to acquire permission the pentest.