Section 3A of the United Kingdom&#39;s Computer Misuse Act 1990 Section 3A of the United Kingdom's computer misuse act states you are not allowed to produce, obtain or supply articles which can be used for computer misuse. How do UK information security bloggers and conference speakers go about this, as technically, even with non-malicious intent, there is a violation of the CMA?
The legislation in question is section 3A of the Computer Misuse Act 1990 (this section was added to the original text of the CMA by section 37 of the Police and Justice Act 2006): 3A Making, supplying or obtaining articles for use in offence under section 1 or 3 (1) A person is guilty of an offence if he makes, adapts, supplies or offers to supply any article intending it to be used to commit, or to assist in the commission of, an offence under section 1 or 3. (2) A person is guilty of an offence if he supplies or offers to supply any article believing that it is likely to be used to commit, or to assist in the commission of, an offence under section 1 or 3. (3) A person is guilty of an offence if he obtains any article with a view to its being supplied for use to commit, or to assist in the commission of, an offence under section 1 or 3. (4) In this section “article” includes any program or data held in electronic form. (Sections 1 and 3 refer to unauthorised access and impairing the operation of computer) In England and Wales, prosecutions are brought by the Crown Prosecution Service, there are guidelines produced by the CPS for section 3A: Prosecutors should be aware that there is a legitimate industry concerned with the security of computer systems that generates 'articles' (this includes any program or data held in electronic form) to test and/or audit hardware and software. Some articles will therefore have a dual use and prosecutors need to ascertain that the suspect has a criminal intent. ... Prosecutors dealing with dual use articles should consider the following factors in deciding whether to prosecute: Does the institution, company or other body have in place robust and up to date contracts, terms and conditions or acceptable use polices? Are students, customers and others made aware of the CMA and what is lawful and unlawful? Do students, customers or others have to sign a declaration that they do not intend to contravene the CMA? For Section 3A (2): In determining the likelihood of an article being used (or misused) to commit a criminal offence, prosecutors should consider the following: Has the article been developed primarily, deliberately and for the sole purpose of committing a CMA offence (i.e. unauthorised access to computer material)? Is the article available on a wide scale commercial basis and sold through legitimate channels? Is the article widely used for legitimate purposes? Does it have a substantial installation base? What was the context in which the article was used to commit the offence compared with its original intended purpose? Original answer from Sec.SE by Tom77
There is nothing preventing the OP's &quot;subject&quot; from making a Subject Access Request in these circumstances From the British Transport Police's Privacy Notice page, under the heading &quot;How we use personal data&quot;: This privacy notice explains: ... the rights individuals have when we process their personal data. ... Right of Access: You can request access to the personal data we hold about you free of charge. You can request access to the personal data we hold about you using the contact details in this privacy notice. ... We collect personal data from a variety of sources, including: ... sound and visual images (e.g. from body worn cameras, CCTV, or facial recognition software); ... our own CCTV systems and body worn cameras. There's more detail in the link, which I have not replicated here to save space and avoid unnecessary &quot;noise&quot;, but the above should cover the relevant points raised by the OP
This is not (necessarily) copyright violation It's possible that Quora's usage falls within Fair Use. At the very least, the argument could be made. If it does, then there is nothing that Stack Exchange or the OP can do. Stack Exchange can choose not to protect their copyright Unlike trademarks, which lapse if not protected, copyright endures. Therefore Stack Exchange can pick and choose the copyright fights they want to get involved in and those they don't. If you have brought it to the attention of the copyright owner (or, in this case, licensee) and the copyright owner chooses not to act then you have done all you can and significantly more than you have to do. The OP has copyright I note that one of the examples is your question. As the copyright holder, you are free to issue a DCMA takedown notice on Quora if you feel your copyright has been violated.
Such use might well be illegal, and subject the user to tort liability, or possibly even criminal liability. Parties For this discussion let us call the person or company that developed and wants to protect the information D, the person or company that downloaded and wants to use the information U, and the person who placed the information on the server P. Trade Secret One possible source of liability is if D considers the information to be a trade-secret. The law on trade secrets varies to some extent in different countries, although there is a general similarity. Since no jurisdiction is specified in the question, I am going to look at the united-states law. Definition The LII page on &quot;Trade Secrets defines a trade secret under the US Uniform Trade Secrets Act (&quot;UTSA&quot;) as: &quot;information, including a formula, pattern, compilation, program, device, method, technique, or process that: Derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from its disclosure or use; and Is the subject of efforts that are reasonable under the circumstances to maintain its secrecy. A similar definition is given by the USPTO page on &quot;trade secret policy&quot;. Prior to the USTA, and still in those US states that have not adopted the USTA, trade secrets were/are protected under the common law. The LII page lists the common law factors, as given by the Restatement of Torts (1939) § 757, comment b: The extent to which the information is known outside the claimant's business The extent to which it is known by employees and others involved in the business The extent of measures taken by the claimant to guard the secrecy of the information The value of the information to the business and its competitors The amount of effort or money expended by the business in developing the information The ease or difficulty with which the information could be properly acquired or duplicated by others These factors may apply in other common-law countries. In either case, one must consider how the would-be user came to acquire the information, and thus how it came to be on the server from which it was downloaded. One must also consider whether it was the subject of &quot;reasonable efforts&quot; to protect its secrecy, under the circumstances. Circumstances If P was violating an obligation of confidentiality, such as an NDA or a duty as part of an employment relationship, then the placement of the info on the server was improper. In such a case its acquisition by another, such as U might constitute misappropriation. The same would be true if a person under an obligation of confidentiality arranged for the server to be indexed by a search engine, when it should not have been. The case for misappropriation would be stronger if U knew that the information was considered confidential by D, and also if P had informed U about where to find the info, or what search terms would uncover it. If P was acting with the permission of D, and P or someone else at D simply failed to realize that the server was, or might become, indexed, then the question is whether the steps taken by D to keep the info secret were reasonable. If this a case of &quot;inadvertent disclosure resulting from the trade secret holder's failure to take reasonable protective measures&quot; then there is no misappropriation, and the actions of U are lawful. That will depend of a judgement of whether D's actions were reasonable in light of the value of the info and the overall circumstances. If the placement of the info on the server is considered to constitute &quot;general publication&quot; of the info, so that it is no longer secret in any meaningful sense, then D may have a claim against P, but not against U unless U acted in collaboration with P. Copyright Law The documents downloaded from the4 server are almost surely protected by copyright. Directly incorporating them into an open source project without permission from the copyright holder would be copyright infringement, and would subject U to a suit for infringement. However, copyright does not protect ideas, methods, or facts. If U learns a method or idea from the document, and uses that knowledge without directly copying or closely paraphrasing the document, there is no copyright infringement and no claim under copyright law. Patent Law The question does not mention any patents. It is possible that D has patented the method describe in the downloaded documents. If so, and if the patent is valid, any use by U would be patent infringement, and the question of how U learned the info becomes irrelevant. However, most software developments such as data structures are not patented, so this is a somewhat unlikely, albeit possible, case. Notre that if the information is covered by a patent is is by definition not secret, as all patents must be openly disclosed. But they may not be widely publicized, and if U does not make a patent search, U may not realize that the document includes patented technology. This possibility is largely incompatible with the trade secret possibility, althogh it is possible to use trade secrets in connection with patented tech. Conclusion In short whether U may lawfully use then info, or is subject to a tort claim by D, or even criminal action, depend on the details of the overall facts. U would do well to take legal advice on the matter before proceeding to use the info.
Laws against such actions are not stated in terms of popular and fluid concepts like "computer virus", they are stated in terms of clear concepts like "unauthorized access". There are federal and state laws against this. This web site lists and links to all of the state laws on the matter. There is also a federal law: a detailed legal analysis by DOJ is given here. There are some limits to federal jurisdiction, for example "protected computers" include "computers used in or affecting interstate or foreign commerce or communication". The term "affecting interstate or foreign commerce or communication" is widely used in federal law, and can be used to prohibit growing feed for your own animals. Anything that you "send" clearly affects interstate commerce (the internet is internationally connected). 18 USC 1030(a) says Whoever ... (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains...(C) information from any protected computer Essentially, a computer connected to the outside world is protected. The key here is "without authorization". If you authorize MS to report back stuff about your computer, that is not unauthorized. It may not be possible to use their product without giving such authorization, in which case you can use a different product that doesn't require that you grant authorization. There is also the possibility that some software producer has technically violates the law because they think that it's okay for them to access the computer as long as they do no harm. Typically, people are not aware that they have granted software publishers access to their computer. The concept of "harm" is pretty much irrelevant to computer-crime criminal law. It would be relevant, though, if a plaintiff were to sue someone for sniffing around their computer: then you'd have to show that you were damaged.
You can’t “mislead or deceive” in “trade or commerce” in Australia It is flat out against the law to mislead or deceive - you can’t lie, you can’t conceal salient facts, you can’t tell half truths, you can’t even tell the truth, the whole truth and nothing but the truth if that could be misleading. The fines are huge (for example), plus the contracts are unenforceable, plus the reputational damage is extreme. The types of practice that you describe would result in orders to return the premiums, plus fines plus probably revocation of the licence to be an insurer in Australia if they were systemic. This is particularly true of insurance companies - the legislation that applies to them is enumerated here.
Source code is protected by copyright, even if it is designed for an unethical or illegal purpose. Making a copy without permission is copyright infringement, as is distributing a copy without permission, unless an exception to copyright applies. In the US the primary exception is fair use. Whether a use constitutes a fair use or not depends on the detailed facts, including the nature and purpose of the use, and the plausible effect on the market for the protected work. The question does not contain enough information for even a rough fair use analysis. It is generally not unlawful to create malware, only to use it to access a computer or network without permission, or to do other unlawful acts. Thus the copyright holder could sue without implicating him- or herself in a crime. However, damages would probably depend largely on the commercial value of the program, and if the only plausible use was criminal, the legitimate value might be quite low. Possessing an unauthorized copy of a work is not a crime, nor is it infringement. The maker and distributor of an unauthorized copy commits infringement, but the recipient does not. Whether unauthorized access and downloading is a crime under the CFAA depends on the factual details. Many things that might technically be crimes under the CFAA are not prosecuted. That is a matter for the relevant prosecutor to determine.
No, it is not illegal in UK to use proxies. No, it is not like the tor concept. No, the ISP does not slow you down (they mostly throttle detectable p2p connections), but if you use public proxies, many of them will be unacceptably slow. Note: for things like facebook, a proxy is utterly useless. You already donated your private data to them, there's nothing to hide.