Lawful cyber decoy policy