Legality of using data obtained by hacking to make a blog post As a data scientist, based in the UK, I am thinking about downloading the recently leaked Ashley Madison data, producing some interesting statistics (none of them incriminating), and using them to write a data blog post or making a dashboard about them. I would make all text completely impartial towards Ashley Madison or the users, since I only care about the statistical insights that could be drawn from the data. What possible legal problems could I face? I'm guessing that the data is "owned" in the IP sense by Avid Life Media, but it's also very public. Many thanks.
These are some thoughts about the state of affairs in the US, I do not know how it works in the UK. In the US it seems to be a legal gray area. Gray enough that I do not think any lawyer could say for certain that the use of the data is legal. The data is stolen. If possessing stolen property is illegal then possessing this data is also likely illegal. Of course experts disagree, Stuart Karle, an adjunct media professor at Columbia University and former general counsel for the Wall Street Journal says: ...the documents have been published by the hackers, they are now public by virtue of being put on the Internet. But Barrett Brown was charged with trafficking in stolen authentication when he forwarded a link to some stolen emails. He signed a plea for acting as an accessory after the fact. He spent more than a year in jail while they sorted it out. In the US there is no law banning the download of hacked documents. In fact Bartnicki v. Vopper 532 US 514 (2001) stands for the rule that journalists can report on illegally obtained information. But contrast that with the Barret Brown prosecution! And decide where a data scientist fits. Also there is the question of whether an illegally recorded conversation is of the same "illegal" nature as hacked personal information.
You are clearly seeking legal advice. Answers on this site come from anonymous people on the internet and are not legal advice. You should not act based on information from this site. I am unaware of any lawsuit where one would be sued for merely storing and reading HTML for personal use. Downloading a webpage is probably not a copyright violation. Most things you create, including HTML source code, are protected by copyright and copyright includes the exclusive right to choose who can read what you created. I couldn't find any actual reference to this but I would hazard a guess that displaying an HTML webpage online is implicitly allowing others to read that code. I believe this guess is correct because all modern web browsers have the capability to view source that nobody considers illegal and browsers also include the capability to save webpages to disk. These browsers are made by companies with large legal departments, I doubt Internet Explorer would include this function if using it was a copyright violation. Here begins speculation: However, your expanded question says that not only you wish to read the HTML code but you also wish to process it, extract information from it and use what you learn this way. This could, I think, be prevented by the copyright holder. Still, what you are describing is commonly done in the world. Services such as Google, Bing or the Wayback Machine go far beyond what you are doing. In theory, I can see this as being a copyright violation but again, the fact that these big companies - without any kind of contract with the website owners - keep doing it is big evidence in favor of legality of storing webpages. You should be careful about how you use the stored data, though. For example, computer programs often have a stipulation in EULA that prevents you from reverse engineering the code. I could see that the use of some websites could be protected in such manner. Further (not authoritative) internet pages on this topic: https://stackoverflow.com/q/22819287/1580088 https://answers.yahoo.com/question/index?qid=20120621055815AAvJPvN
How can I truly say that I 'consent' to data collection and processing when I am coerced, so to speak, by the threat of failing my courses if I do not use this novel software? There is no need for you to "consent". Consent is just one of the reasons that allows a data processor to collect your data. There are other reasons that allows the data processor to capture your data. In this case, it seems of application the "legitimate interest clause", as it is in your university's legitimate interest to capture your activity in order to evaluate you. Of course, that covers only the data collected that is relevant to that interest. They will certainly capture your identity and your answers, they may log your sessions and may try to gather some data to detect if you are somehow cheating, but they would not be allowed to check which are your favorite pornhub videos because that is not relevant for the university's legitimate interest. Art. 6 of the GDPR states: Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. This page also provides some in-depth analysis
At least in the United States (and I'm pretty sure this is true around the world), facts and information cannot be copyrighted. Just because a work is copyrighted, doesn't mean every part of that work is copyrighted, and factual information conveyed by the work is a part which is not subject to copyright. Copyright on a collection of facts is limited to the selection and arrangement of those facts, and only if that selection and arrangement has some bare minimum amount of originality. See Feist v. Rural, 499 U.S. 340. In this case, it looks at first glance like the person who made that site made their own selection of which materials and which sources would be included; the one place where they really seem to have copied their selection is from glass catalogs with datasheets from specific manufacturers, who would have a hard time arguing that "everything we manufacture in this widely-recognized class of substances" is an original selection. What the author of the website has done is relinquish his rights in his selection and arrangement of the data. In some places, there are other rights besides copyright that do apply to databases; for instance, the EU recognizes database rights to protect significant investment in compiling a database of stuff. But the US does not have that concept. For citing stuff, that's not really a legal question, and has more to do with academic standards. Ask your adviser or teacher if you have one.
Assuming the USA, since that's where they appear to be located. Spreading misinformation is not illegal- it is protected by the first amendment. There are exceptions but I can't see how any would apply here. You haven't mentioned any that you think apply. If some of the videos on the site guaranteed results or made medical claims, maybe that could be considered false advertising. However, I see no evidence of this. Users are advertised that paying for access to a bunch of hocum videos will get them access to a bunch of snake oil and this appears to be the case.
Generally speaking, if a person sends you an email you can publish it. Like if they call you a bunch of nasty names, or threaten you in some way, that information is yours and you can publish it. However, I'll give you three scenarios where you should not publish an email sent to you (and I'll edit to add more if they come up). Private facts. There is a tort called publication of private facts. A plaintiff must establish four elements to hold someone liable for publication of private facts: Public Disclosure: The disclosure of facts must be public. Another way of saying this is that the defendant must "give publicity" to the fact or facts in question. Private Fact: The fact or facts disclosed must be private, and not generally known. Offensive to a Reasonable Person: Publication of the private facts in question must be offensive to a reasonable person of ordinary sensibilities. Not Newsworthy: The facts disclosed must not be newsworthy. Stated differently, the facts disclosed must not be a matter of legitimate public concern. From Digital Media Law Project Note one thing - the offensive fact does not need to have been completely private for you to be liable, it must not have been generally known. In other words, someone like you who has a really low "public" bar needs to be careful. Also note that your buffer system might not help if the facts you publish are about someone other than the email sender; you are the one who published them. Stolen Information If someone sends you some intellectual property of a third party it is not yours to publish. Trade secrets, copyrighted works, prototype photos, etc. The sender might be breaking the law by sending the stuff to you but you're the one who published it so you can join as co-defendants. Barrett Brown was indicted for sharing a link to some stolen information. A link! He's in prison on other charges. Copyright held by the original sender (ht to @Dave_D) If the sender is the original author of the email, then the sender holds the copyright to the body of the email. Publishing the email violates the copyright. However, you could account for this in your buffer. Maybe. I am not sure is that is explicit enough.
She could refer this to the Cyrpriot Commissioner for Personal Data Protection, but I would try contacting the company first and telling them to remove her Personal Data from the public website - or delete it completely. If they don't give a satisfactory response, mention the CPDP. This could lead to the data being removed within a few days, while an official complaint is likely to take longer. She may have grounds for legal action which would result in the company being compelled to take down the data (or to close the website), but if your friend is thinking in terms of compensation, what compensation would she seek? If she can demonstrate and quantify financial losses that occurred specifically because of this disclosure there might be a possibility, but I suspect that would be difficult to prove.
It is probably illegal, just not pursued. In the case of something like bank robbery, you'd have a victim that filed a police report. A murder would need to be discovered somehow - either a missing person report or a dead body. If the porn shoot happened somewhere that a member of the public saw it and subsequently filed a police report, the video could be used as evidence. Absent a report, the police simply have no reason to look into it (unless the police catches them in the act, but we probably don't see those videos posted online). Why would these public offenses go unreported? Perhaps nobody sees it. Perhaps the bystanders in the video are paid extras. Maybe they're filming in what appears to be public but is actually private property. Perhaps they have a permit to use a public space for this purpose. Perhaps they just got lucky. Again, there might be some confirmation bias here - you're not going to see as many videos of folks they catch breaking the law, since they will either be interrupted and stopped or (maybe) have their videos ordered taken down.