Could one be found guilty of a crime because he can&#39;t prevent cloud computer from being hosted in region where action is illegal? Here is the real question which inspired my last: Does legality of an computerized action depend on user location or computer location? Someone can be found guilty of crime legal in their home state if they use a computer located in another jurisdiction where the action is illegal to perform the action. However, with cloud computing a user may not be aware of where his computer is located, it may even 'move' to another country transparently; possible even as he is using it. Usually you have a good idea of where you computer likely is, but nothing is gaurenteed. So lets imagine someone in the US who has purchased a virtual machine from amazon. This machine is physically hosted on a computer somewhere in the world, but the user doesn't know where that physical computer is. If the physical computer he is using dies for some reason his virtual machine may move to another computer located in a different physical location transparently without his being aware of more then a short system 'hiccup', likewise if he gets more customers to his service a new computer may start up in some other part of the world to support his customers, then kill itself later once demand lowers and it isn't needed. The point being he has no way of knowing where his computer is located or if it will move to another location when he purchases amazon's services. Lets say that he is doing something with this virtual machine (or machines) that is legal in some states, but not in others. Maybe he has a marijuana home delivery service where some states allow selling marijuana and others don't (bad example, since marijuana is still illegal federally, but you get my point, different states have different laws). There is a good chance (but not gaurentee) that his VM from amazon is hosted somewhere within the US, but rather or not it's in a state that would find his action illegal is impossible to know or control. I'm wondering rather he could be found guilty if amazon automatically moves his VM to a state where his action is illegal despite his home state being legal, without his having any way to prevent amazon from moving him to a state where the action could be illegal. I know in reality no one would likely pay enough attention to realize his VM moved to somewhere where his action is illegal, and no prosecute would likely prosecute him for such a thing; but I'm talking about letter of the law, assuming a prosecute is aware of the computer location and for whatever reason chooses to prosecute. Would our theoretical user have any legal defense he could use in this situation to be found innocent? If it matters you could replace my example, of moving between states, with someone from Cuba buying a VM to discover it's in the US; if federal vs state laws actually matter. I'm assuming our unfortunate criminal happens to travel to the location the VM is located in at some point and thus can be arrested without extradition.
It depends on the particular law in the particular jurisdiction in which you are charged. Most statute laws enumerate the defences that are available. In common law countries there is a general defence that (except in strict liability offences) the perpetrator must well ... perpetrate the criminal act; what you describe does not appear to meet that requirement. Other jurisdictions would not be so forgiving.
This is actually a very complicated question, about (1) the scope of "knowingly", (2) what kind of "intent" is required for conviction, (3) how does the jury understand and evaluate concepts of intent and (4) how does an attorney persuade the jury that the situation does or does not satisfy the particular intent requirement. One thing we can dispose of quickly is the possibility that the law says that the accused has to actually know that the act is against the law. It is a standard legal fiction (2,400 years old) that the accused knows the law, or should have known. As for the 4th element, persuasion, on the strong side we have statements of intent by the accused – "And I pulled out my rifle and blew his head off, and I laughed the whole time". What the jury has to decide is whether the accused had in mind a conscious purpose of doing some act (that is, it wasn't just an accident like butt-dialing, or an instant stimulus-response reaction to some event). "Intent" generally falls in the realm of acting "purposely", which the Model Penal Code §2.02 defines as: A person acts purposely with respect to a material element of an offense when: (i) if the element involves the nature of his conduct or a result thereof, it is his conscious object to engage in conduct of that nature or to cause such a result; and (ii) if the element involves the attendant circumstances, he is aware of the existence of such circumstances or he believes or hopes that they exist. which more or less means what you think "with intent" means. That doesn't say what they intended to do, it just distinguishes intent from negligence and accident. The prosecutor would then present factual evidence that the accused had a bad intent, like showing that he actually made an attempt to access credit card account data (that such data had been accessed when he broke into the system), etc. We can sort of dispose of the other scope question about "knowingly", namely, what things would he have to know? The chunk accessing a protected computer without authorization can be interpreted in a number of ways, having to do with which elements of the clause are known to the accused. You might know that you were accessing but not know that you were unauthorized; you might know that you were accessing and unauthorized, but not know that the computer is protected. The only reliable way to know which is which is to study the case law on a statute and see if there is a controlling decision that say e.g. that you have to know that you are accessing and are unauthorized, but you don't have to know that the computer is protected. I haven't determined (yet) is there is decisive case law on this, but I'm betting that the outcome would be that not knowing of the protected status of a computer carries no weight. As for what kind of intent, there is a distinction between "specific intent" and "general intent". The distinction comes down to having some evil purpose like "make him suffer" (general intent) versus a specific evil purpose like "kill him". Finally, the people who actually decide, the jury, will be given instructions that say what they have to look for. Here is the tip of the tip of the iceberg, from California's criminal jury instructions. The judge will say... The People must prove not only that the defendant did the acts charged, but also that (he/she) acted with a particular (intent/ [and/or] mental state). The instruction for (the/each) crime [and allegation] explains the (intent/ [and/or] mental state) required. A[n] (intent/ [and/or] mental state) may be proved by circumstantial evidence. Before you may rely on circumstantial evidence to conclude that a fact necessary to find the defendant guilty has been proved, you must be convinced that the People have proved each fact essential to that conclusion beyond a reasonable doubt. Also, before you may rely on circumstantial evidence to conclude that the defendant had the required (intent/ [and/or] mental state), you must be convinced that the only reasonable conclusion supported by the circumstantial evidence is that the defendant had the required (intent/ [and/or] mental state). If you can draw two or more reasonable conclusions from the circumstantial evidence, and one of those reasonable conclusions supports a finding that the defendant did have the required (intent/ [and/or] mental state) and another reasonable conclusion supports a finding that the defendant did not, you must conclude that the required (intent/ [and/or] mental state) was not proved by the circumstantial evidence. However, when considering circumstantial evidence, you must accept only reasonable conclusions and reject any that are unreasonable. and then there will be some specific elaboration of whether they have to find that the accused just generally intended to do bad, versus intended to specifically defraud.
Boggs v. Merideth was a pretty big case involving private drones and the privacy of neighbors. Happened in Kentucky, though. I would suggest taking a look at that.
Would any offence be committed for: Having this on your person? Buying or selling this? Leaving it around for people to plug in to a computer? In the abstract, I don't think that this conduct would violate either Section 36 of the U.K. law or U.S. law, although, obviously, purposefully destroying a computer itself (i.e. actually using the device without the consent of the owner of the computer) would violate many U.K. laws and would also violate many U.S. laws at both the state and federal level. I also don't think that possession or buying or selling this product would be a crime absent some intent that it be used illegally, in which case there might be an "attempt" to commit a crime offense, or an offense that would make one part of a conspiracy to commit a crime. In the "leaving it around" example, there is arguably an intent to use it to harm another improperly, although the phrasing is ambivalent. While many statutes in the U.S. criminalize possession of burglary tools, or drug paraphernalia, sometimes with an associated intent element (although even these crimes often have an express or judicially implied intent to use element), I'm not aware of any statute that criminalize possession of tools for malicious destruction of property. So, if the tools aren't possessed or used in a manner intended as a step in the facilitation of a crime, I don't think that any law is violated. So far as I know, the U.S. does not have a counterpart to Section 37 of the British statute cited above (it isn't a terribly easy thing to search for to definitively rule out the existence of such a law because federal law has many uncodified crimes in unexpected statutes and there are many sets of state criminal statutes, not all of which are codified either). The example giving in the comments by @gnasher729 of possession of a hammer which could be used to do the same things that this object could be used to do is instructive. Arguably, this USB-like tool is more specifically targeted at malicious conduct. But, for example, when I used to work as a radio news reporter, we had a machine that was basically a high powered magnet that was specifically designed to destroy all information on magnetic media. This was, in part, so that it could be reused, but it was also so that confidential interviews wouldn't fall into the wrong hands once they were no longer needed, in much the way that one might shred paper documents. It isn't so implausible to think that a device like this one might be necessary for individuals or firms with national defense secrets embedded in their hardware and software to have on hand in order to destroy a sensitive computer in order to prevent a security breach, if necessary. In a case like that, leaving one of these devices around the office unlabeled might be negligent, but wouldn't have the intent necessary to be an intended crime. And, it is hard to imagine that the device itself, which seems pretty simple, would itself involve any technology that is a national security secret, so it probably wouldn't violate export control laws. Of course, possession, purchase or sale of such a specialized device, or leaving it around unlabeled would certainly be powerful evidence of an intent to use the device in a wrongful manner, and hence, of an attempt to commit a crime. Indeed, possession of such a device or purchase of one might very well be sufficient to establish probable cause to seize the device and arrest the person holding it on charges of an attempt to destroy a computer. But, this device would be merely powerful evidence of an intent to commit a crime, rather than something that is a crime to commit in and of itself. There are no international laws that govern this kind of thing. The only international laws applicable to individuals pertain to war crimes and nuclear and chemical weapons. Even then, most international laws direct member nations to adopt domestic laws on the subject rather than being self-executing.
Source code is protected by copyright, even if it is designed for an unethical or illegal purpose. Making a copy without permission is copyright infringement, as is distributing a copy without permission, unless an exception to copyright applies. In the US the primary exception is fair use. Whether a use constitutes a fair use or not depends on the detailed facts, including the nature and purpose of the use, and the plausible effect on the market for the protected work. The question does not contain enough information for even a rough fair use analysis. It is generally not unlawful to create malware, only to use it to access a computer or network without permission, or to do other unlawful acts. Thus the copyright holder could sue without implicating him- or herself in a crime. However, damages would probably depend largely on the commercial value of the program, and if the only plausible use was criminal, the legitimate value might be quite low. Possessing an unauthorized copy of a work is not a crime, nor is it infringement. The maker and distributor of an unauthorized copy commits infringement, but the recipient does not. Whether unauthorized access and downloading is a crime under the CFAA depends on the factual details. Many things that might technically be crimes under the CFAA are not prosecuted. That is a matter for the relevant prosecutor to determine.
The CEO wants to "fool" users You are essentially admitting that the company you are working for is about to deceit its customers and asking whether that is legal. The relevant set of laws is rather sparse and does not give direct answers in regards to oAuth tokens or other details of that level (which is probably making your CEO think he can "handle" the arising questions). Probably the most relevant bit of legislation that applies here is The Federal Trade Commission Act (15 U.S.C. §§41-58) which prohibits unfair or deceptive practices and has been applied to online privacy and data security policies. I am pretty sure that, in practice, if the users take your company to court, it will be held liable because: users are allowing us to read their CRM data and once we get the data, the data become ours, and we can do whatever we want with it. Is this true? While the users are still allowing you to read their data it is completely up to the Terms/EULA what you can do with it. However, once you have made the users think that they have withdrawn your access (e.g. they "deleted" oAuth tokens), you are no longer authorized to read the current data (although the Terms may still allow you to use the old data you obtained when you had access). Silently continuing to access their data without their knowledge/approval is definitely a deceit. The CEO wants us to download all of their emails and store them in our database There would be nothing wrong with that if it was in the Terms. But if it is not, that would be a blatant (and easily punishable) breach of privacy. Note that you may also be held personally liable for this wrongdoing (if/when proved so). "Just doing your job" claim will not work.
Yes, you did something wrong; you used both the university's trade mark and copyright without their permission. I don't know the law in India, however, if it is similar to Australia it is unlikely that the police will be interested in doing anything about it. While it is technically a crime, criminal prosecution is usually reserved for egregious breaches on a for profit basis. I suggest you apologise and agree to stop distributing your app.
It is probably illegal in all of the jurisdictions in the US where a fetus is legally declared to be a person and where the murder statutes are written to not explicitly exclude abortion: that is, in no jurisdictions. No law existing or proposed for Georgia specifically addresses "travel for the purpose of getting an abortion". The underlying theory behind the claim (advocated by some Georgia attorneys) is that a person may be open to a conspiracy charge for taking a woman to another state to get an abortion, which would be a crime if committed in Georgia. If a conspiracy exists in Georgia to do something illegal (in Georgia), that is a violation of OCGA 16-4-8 ("when he together with one or more persons conspires to commit any crime and any one or more of such persons does any overt act to effect the object of the conspiracy"). The substantially same law exists in Washington, and most if not all other states. The theory is apparently that "conspire to commit a crime" means something like "conspire to perform an act which would be a crime if performed in in this jurisdiction", e.g. "purchase marijuana, or take a job at certain payday loan companies". No state has successfully claimed extraterritorial jurisdiction, where a Georgia resident can be prosecuted in Georgia for a legal act carried out in another state, so this theory is a bit of a stretch.