Is cracking software with server emulators illegal? Let's say I have a program that needs you to login with a paid account in order to use it, and it sends authorization data to a server (username and pass) using this example link (I show example credentials): http://foo.bar/checkUser?user=PKTINOS&amp;pass=password In this sample, the authorization link returns "Success" if the credentials are valid and "Failure" if they are not. And let's say I have another 3rd-party program that redirects that link to my own URL, e.g., http://bar.foo/checkUser, that happens to always return "Success." (This would allow you to use the program with false credentials.) Would that violate any law?
Forget about copyright or EULAs. In the UK this would be illegal under the Computer Misuse Act (1998) and you could be jailed for up to a year - specifically Unauthorised access to computer material. (1)A person is guilty of an offence if— (a)he causes a computer to perform any function with intent to secure access to any program or data held in any computer, or to enable any such access to be secured; (b)the access he intends to secure, or to enable to be secured, is unauthorised; and (c)he knows at the time when he causes the computer to perform the function that that is the case. This law has been applied even to simply altering parameters in a GET request to a website, so it is incredibly broad. Other jurisdictions have similar wording, so be aware!
Yes, it's illegal. 18 USC 1030 (a) (5) (A) [Whoever] knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer [shall be punished as provided in subsection (c) of this section]. &quot;Damage&quot; is defined at (e)(8) to mean &quot;any impairment to the integrity or availability of data, a program, a system, or information&quot;. Your proposed attack would certainly cause impairment to the availability of the Stack Exchange system and the data and information which it hosts. Whatever else you may think about the Stack Exchange terms of service, they certainly do not authorize any user or moderator to &quot;destroy the site&quot; in any sense such as you describe. It's not necessary for the TOS to explicitly say &quot;you may not do X&quot;; it's enough that they don't say that you may do it. To use a firewall analogy, it's &quot;default deny&quot;. &quot;Protected computer&quot; is defined in (e)(2) to mean, essentially, any computer that is used in or affects interstate commerce. Which means practically every computer that has ever accessed the Internet, and certainly includes Stack Exchange servers. So your proposed attack would include all the elements of a violation of this section. Such a violation is punishable by up to five years' imprisonment if it causes a loss of more than $5000 (see (4)(A)(i)(I)), which if such an attack were successful, it certainly would. Greater penalties are possible in certain circumstances. Even if the loss does not exceed $5000, or if the attack is merely attempted but without success, it is still punishable by one year imprisonment or a fine ((4)(G)(i)). There is nothing in the terms of service saying you will go to federal jail for destroying stack exchange. Irrelevant. It is not up to Stack Exchange Inc. or its TOS to determine who does or doesn't go to federal prison. Rather, it is up to Congress to determine what conduct deserves such punishment (as they did in 1984 by enacting this law), up to federal law enforcement and prosecutors to investigate and make a case against an alleged violator, and up to the federal courts to determine if the accused is guilty and how they should be punished.
I think haveibeenpwned would be legal in the EU because it carries out a task in the public interest (Art. 6(1)(e)), and it shares no more data then necessary, for example you can search for a password, but it would not show you the emailaddress which belongs to that password. It would also be legal for you to hold a copy of a leaked database, but only if you have a legitimate interest (Art. 6(1)(f)) to have it. Being a security company does not change that, but finding a legitimate interest might be easier. If you have a legitimate interest to hold a copy of a leaked database, it does not mean you can use it in any way you like. For example testing if the password still works, is very likely illegal everywhere in the EU. But I'm not familiar with the UK laws.
The words "proprietary format" are important. Are you sure the format is proprietary? If it is, then it's likely protected in which case they might have grounds to sue (but that does not mean they would definetly win). If the format is not proprietary, and so long as you don't share data which is proprietary then I believe you fine. I'm not a lawyer - but I cite GIF files as an example. They were still protected by the US and some other countries until at least the late 90s and there were various threats to open source linux companies who shared code that used the file format. I'm not aware of anything other than threats and never heard of any company being sued, let alone winning or losing. Another example that comes to mind is the RedHat ISO format. My understanding is RedHat could not stop anyone from sharing open source, but they could prevent folks from sharing the format they assembled and shared the open source. Again, I am not sure if it was ever tested in any court of law anywhere.
This is more than a comment (too long), but not a definitive answer (since I am unfamiliar with the laws regarding this kind of thing). Please forgive me. First, there are some technical misunderstandings. They are not disabling SSL/TLS. Instead, they are inserting themselves in between these connections so they can make sure you aren't accessing material you are not allowed to access. They may actually be required to do this by law. Here is how it works. Typically when you connect to, say Google.com, you are given a certificate from Google.com that has a trusted chain all the way up to some trusted root. That trusted root is explicitly trusted by your web browser manufacturer. In order to be able to inspect these sorts of connections, security appliances will actually replace the certificate provided by Google.com with one that the appliance provides. It has to pretend to be Google.com so your browser doesn't freak out. The problem is, this certificate is no longer has a trusted chain to something that the browser manufacturer trusts. It is provided by the security appliance. So often, the appliance will have a root certificate that the administrators of the system must install on every machine they control. Then the browsers on these machines will not complain that the certificate is invalid. Obviously, you are getting the error on your own machine because you have not allowed the administrator to install these certificates on your machine. Nor should you. You should definitely not allow your school's network administrator to install these certificates on your personal computer. You say that "leaves people's private data being transferred over the school network (such as private e-mail, logins) unsecured and open to packet sniffing". This is not true. Any HTTPS website you visit is encrypted between your computer and the security monitoring appliance using the pretend certificate I mentioned above. Typically then, the traffic is decrypted and inspected by the appliance. Then it is re-encrypted using the real certificate, before being pushed out onto the internet. So, only at the security appliance is data turned back into the clear, only to be protected again before going out to the internet. So, is this illegal? Well, I think you would agree that definitely on the computers that your school owns, they can do anything they want with them. The computers belong to them. Furthermore, the network belongs to them. Likely you signed an agreement (or agree to it each time you connect) that they are allowed to monitor your usage of their computers and their network. This includes when connecting your personal machine to their network.
On the face of the CFAA: How does Aaron Swartz's mass download from JSTOR constitute hacking? He exceeded his authorised access on a protected computer. If this is hacking (the masking of one's IP address) then doesn't that make using VPN hacking? Hacking is not a term used in CFAA. In Aaron's case changing the IP address was a necessity for him to exceed his authorised access; if he stopped when blocked then the unauthorised access would have stopped. If you are authorised to use a VPN for access then you have not exceeded your authorisation, have you?
Legal unless you violate copyright. Screenshots will probably be fair use. The manuals/how-tos need to be your originals, not copies from anywhere.
This is going to depend on several things. First of all, do you have a lawful, licensed copy of the SDK? My understanding is that Nintendo only licensed the SDK to selected game companies. If what you have is an unauthorized copy, you do not have the legal right even to use it. If what you have is properly licensed, then you do. Or is what you have an unofficial SDK created by someone other than Nintendo? Secondly, what does the license agreement that comes with the SDK provide? Does it require developers to register with Nintendo? If it does, you will need to comply. Nintendo cannot prevent others from writing programs designed to run on their hardware. But they can control who uses their development software, if they choose to. You cannot reproduce in your game any of Nintendo's copyrighted software (or anyone else's) without permission. That applies even more strongly if you intend to sell the software. But you can use any development software for which you have a valid license in whatever ways its license permits. I would expect this includes creating games. It would include selling games that you create that do not use any of Nintendo's code, unless there is a specific provision forbidding that in the license agreement.