Legal status of Cellebrite hack The CEO of Signal has posted the discovery of security vulnerabilities in Cellebrite products. These products are used by police to evade security on seized mobile devices and thereby download the contents for forensic examination. More details here. What Moxie Marlinespike claims to have discovered is that malicious files on the device being probed by a Cellebrite product can hack the Cellebrite product in turn, altering not just the findings for the device being probed, but also for other devices probed in the past. (The terms &quot;hack&quot; and &quot;probe&quot; here are used purely to distinguish the direction of the security penetration). So, what is the legal situation if you have one of these files stored on your device? The file contains malicious software, but it only activates if the device is connected to a Cellebrite product. Assuming you didn't give permission for this, are you guilty of hacking the Cellebrite product? I'm principally interested in US and UK law, but answers for other countries would be acceptable too.
A fundamental requirement of criminal culpability is intent. Based on the description this whole process is happening after a user has already had their phone seized. If a person was not aware of Signal's hidden files to damage the police's data forensics software, they will not have met the criminal intent requirement, either maliciously or under a criminal negligence theory. None of the prongs of CFAA are strict liability statutes (18 U.S. Code § 1030 &quot;Whoever having knowingly accessed a computer...&quot;), so that would not apply here. If we imagine a person that is aware of all the information from Signal about their app intentionally abusing Cellebrite's package and with intention to cause damage downloads Signal's malicious files to their phone, I think it's an open question whether or not they would be liable under the CFAA. Specifically, 18 U.S. Code § 1030(a)(5)(A) (emphasis mine) Whoever knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; An argument on this could go both ways. On the one hand, the owner of the phone could be found to not have substantially caused the information to be transmitted to a protected computer, as the police were the integral cause for that in executing their warrant. On the other hand, this sort of file could be considered a digital &quot;booby trap,&quot; and booby traps are illegal for essentially this reason, that they have a foreseeable effect of causing harm to people who are lawfully inside a building without the owner's permission. In this case, the owner's trap was sprung by law enforcement but still placed by the owner in order to damage them.
You can't own a database; you might, however, own (have) the copyright to a database if you created it or the creator transferred that right to you. You can also possess a copy of a database: the question is whether it is legal. "Leaked" implies that it is taken without permission, so you might be in violation of copyright law by possessing a copy. The only databases that would escape copyright protection would be those US government works, things put in the public domain, and things publically licensed to allow copying. Plus, any database whose content fails to exhibit a modicum of creativity (Feist). A database might be inherently illegal (at least in your hands), so it would depend on what the content is. The first thing that comes to mind is a database from a child-porn website, which contains numerous illegal images: see section 110 of Title 18. "Leaked" information might involve violation of 18 USC 1030 (Computer Fraud and Abuse Act), which prohibits unauthorized hacking. It does not directly prohibit being in possession of a hacked database: but you might still be prosecuted as an accessory after the fact. (That is one of those ad libitum areas of the law where there's no way to know for sure what is and is not "okay"). If they do prosecute you, you might rely on Bartnicki v. Vopper, 532 U.S. 514, where because it was a matter of "public interest", propagation of illegally obtained material was held to be protected by the First Amendment. Also there is the case of the Pentagon Papers. At the federal level, there are no controls over storing credit card information so if you get a copy of the Target or Home Depot hacked database, there's no federal law against that (if we discount "accessory after the fact"), but there are circumstances in Minnesota where retaining such information could be illegal.
Some jurisdictions have laws which make it illegal to create a software which is intended to commit crimes (usually computer-related crimes). For example, the German criminal law §202c StGB makes it illegal to create (or sell, convey, etc.) a program which has the purpose to commit crimes against the previous paragraphs 202a (stealing data) or 202b (intercepting data). The constitutional court later clarified that this law is only to be used against programs which serve no other purpose than to commit crimes and not against &quot;dual use&quot; tools which can also be used for legitimate purposes. So if one were accused of committing the crime of creating such a program, then a possible defense strategy could be to convince the court that they never intended for their program to be used to commit crimes.
This sounds a bit far-fetched. There are laws against circumventing copy protection measures (DRM) but not against aimbotting (to the best of my knowledge). Thus, you cannot reasonably believe that a click-assist functionality would be used to break laws. It could definitely be used to break private contracts such as an EULA, but you are not a party to that contract and are not bound by its terms. Of course, when you use such click-assist tech in an online game, you might be breaking your contract with the game vendor or server provider. But this doesn't imply that a click-assist would be forbidden outside of that context. Note that assistive technologies sometimes have exceptions from laws, e.g. a permission to circumvent DRM if necessary for accessibility. In the US, the Librarian of Congress adopts exceptions for a duration of three years. While none of the current exceptions match your specific scenario involving video-games, it can be permissible to break DRM on e-books or videos for certain accessibility enhancements.
So-called AI software does not enjoy a special legal status (at present: one never knows what new law might be added). The question of whether any software can be distributed "safely" or "responsibly" is also not a legal issue. Nor is "true sentience" a relevant consideration, and nothing is guaranteed. When you distribute software of any kind, there is an implied warranty that the product is "fit", and if software kills you, you may be able to sue the creator for negligence. A software creator may then want to disclaim liability, by saying "WARNING: THIS PROGRAM MAY KILL YOU. OCP IS NOT LIABLE FOR ANY INJURIES ARISING FROM USE OF THIS PRODUCT". This may or may not actually remove liability. In the UK "liability for negligence occasioning death or personal injury cannot be excluded", so such a disclaimer will not prevent a suit against the manufacturer. In the US, the issue is determined at the level of the state – here is a summary of the law in the states. Probably the primary question would be whether such a disclaimer is an unconscionable term, and the second question is whether the act constituted gross negligence (not simply "negligence"). Mississippi exceptionally does not allow disclaimers, but even then, it does allow disclaiming liability when it comes to computer hardware and software. A software disclaimer is not inherently unconscionable, though perhaps some specific disclaimer would be found to be. Courts typically disfavor disclaimers in the case of gross negligence, and again determining what constitutes "gross negligence" is determined on a state by state basis. If the act shows "reckless indifference to the rights of others" and "failure to use even slight care or conduct that is so careless as to show com­plete disregard for the rights and safety of others", then the act might be grossly negligent.
The takedown action is a little sketchy. The law regarding takedown notices and host liability is here. The notice includes &quot;Identification of the copyrighted work claimed to have been infringed&quot;, a &quot;signature of a person authorized to act on behalf of the owner of an exclusive right that is allegedly infringed&quot;, and a statement that &quot;the complaining party has a good faith belief that use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law&quot;. These things are present in the notice, for which reason the items were taken down. The complaint states that The clear purpose of this source code is to (i) circumvent the technological protection measures used by authorized streaming services such as YouTube, and (ii) reproduce and distribute music videos and sound recordings owned by our member companies without authorization for such use. We note that the source code is described on GitHub as “a command-line program to download videos from YouTube.com and a few more sites.” and the source code expressly suggests its use to copy and/or distribute the following copyrighted works owned by our member companies: Icona Pop – I Love It (feat. Charli XCX) [Official Video], owned by Warner Music Group Justin Timberlake – Tunnel Vision (Explicit), owned by Sony Music Group Taylor Swift – Shake it Off, owned/exclusively licensed by Universal Music Group Complainants are &quot;confused&quot; about actual infringement (which is prohibited by copyright law), and creating a method for infringing copyright. Under DMCA and US copyright law, copying is infringing, programming is not infringing. The complaint does not clearly allege unauthorized copying of another person's intellectual property, and their complaint is based on the theory that certain programming actions constitute copyright infringement. I don't actually think they are confused, I think they are testing the boundaries. Github has no reasonable options but to comply; the authors have the option of filing a counter-notice; then RIAA has the option of claiming that they have filed a copyright infringement lawsuit. If they do, the material remains taken down and the courts sort it out if a lawsuit is actually filed. There is minimal burden on the complainant to reign-in over-zealous takedown notice practices: Lenz v. Universal Music finds that complainants must give good faith consideration to a fair use defense. 17 USC 1201(a)(1)(A) states that No person shall circumvent a technological measure that effectively controls access to a work protected under this title. Let's assume that the removed material does circumvent a technological measure protecting a work. This is a separate offense in Title 17. 17 USC 501(a) defines infringement of copyright, saying Anyone who violates any of the exclusive rights of the copyright owner as provided by sections 106 through 122 or of the author as provided in section 106A(a), or who imports copies or phonorecords into the United States in violation of section 602, is an infringer of the copyright or right of the author Production of an anti-circumvention technology is not included in those sections: on a plain reading of the law, this is not infringement. To summarize the legal dance at issue: RIAA has taken the first legal step in alleging infringement, and Github has taken the material down because Github does not get to decide what the courts would conclude. Let's assume the authors file a counter-notice stating that there is no infringement; then, equally, let's assume that RIAA states that they files a lawsuit. Github will leave the material down. Let's also assume that RIAA actually files suit. Under the prior assumption that the material violates 17 USC 1201(a)(1)(A) which seems likely, the authors could be slapped for being in violation: but they would not have been in violation of §106-122. What recourse would the authors have for RIAA's misuse of the term &quot;infringe&quot;, and against whom? Nothing against Github: the service provider does not get to decide the merits of the case. Perhaps RIAA. From Lenz supra, If an entity abuses the DMCA, it may be subject to liability under § 512(f). That section provides: “Any person who knowingly materially misrepresents under this section—(1) that material or activity is infringing, or (2) that material or activity was removed or disabled by mistake or misidentification, shall be liable for any damages․” Id. § 512(f). Subsection (1) generally applies to copyright holders and subsection (2) generally applies to users. Only subsection (1) is at issue here. The court said that We must next determine if a genuine issue of material fact exists as to whether Universal knowingly misrepresented that it had formed a good faith belief the video did not constitute fair use. This inquiry lies not in whether a court would adjudge the video as a fair use, but whether Universal formed a good faith belief that it was not. Contrary to the district court's holding, Lenz may proceed under an actual knowledge theory, but not under a willful blindness theory. Perhaps the authors can prove actual knowledge. The Lenz reasoning on this point (§IV C) is rather contorted.
The Radiocommunications Agency (now OFCOM) issued some guidance about this in 2001. The specific offence is defined by s5 Wireless Telegraphy Act 1949: Any person who ... uses any wireless telegraphy apparatus with intent to obtain information as to the contents, sender or addressee of any message (whether sent by means of wireless telegraphy or not) of which neither the person using the apparatus nor a person on whose behalf he is acting is an intended recipient ... shall be guilty of an offence under this Act. It's also an offence under s5(1)(b)(ii) to disclose the contents of any such message, so the reception and disclosure of radio messages not sent by or addressed to you are both offences. I don't know if there have been any successful prosecutions specifically for monitoring aircraft communications. I doubt whether a hobbyist listening for his own enjoyment would attract the attention of the authorities, but if he started to publish recordings of the traffic then that might well do it.
Source code is protected by copyright, even if it is designed for an unethical or illegal purpose. Making a copy without permission is copyright infringement, as is distributing a copy without permission, unless an exception to copyright applies. In the US the primary exception is fair use. Whether a use constitutes a fair use or not depends on the detailed facts, including the nature and purpose of the use, and the plausible effect on the market for the protected work. The question does not contain enough information for even a rough fair use analysis. It is generally not unlawful to create malware, only to use it to access a computer or network without permission, or to do other unlawful acts. Thus the copyright holder could sue without implicating him- or herself in a crime. However, damages would probably depend largely on the commercial value of the program, and if the only plausible use was criminal, the legitimate value might be quite low. Possessing an unauthorized copy of a work is not a crime, nor is it infringement. The maker and distributor of an unauthorized copy commits infringement, but the recipient does not. Whether unauthorized access and downloading is a crime under the CFAA depends on the factual details. Many things that might technically be crimes under the CFAA are not prosecuted. That is a matter for the relevant prosecutor to determine.