What is the limitation period for a violation of the Computer Misuse Act of 1990&#39;s provision(s) on phishing? I came across a story about a twenty-something year old male who setup a fake website in order to 'phish' for usernames and passwords for a popular game. After acquiring the credentials he would then login in to these accounts and remove the in-game currency and transfer it over to his own account. After a number of years he was finally found out after admitting to friends what he had done. He was found guilty in court, even though the last time he did it was around 6 years ago. I'm curious as to how this would play out in the UK. I believe the act would be covered under the Computer Misuse Act 1990, but i am un-sure if there would be a time limit for a trial under the Limitations Act 1980. My question is how long would it take for this offence to 'expire' and no longer be punishable under UK law? If I am misunderstanding the limitation act please let me know.
The offences found in the Computer Misuse Act 1990 are criminal offences. The Limitations Act 1980 deals with civil offences and is thus not relevant. Apparently, there is no general statute of limitations for criminal offences in the UK (though for summary proceedings, the limit is in general 6 months).
Possibly The game company has almost certainly excluded liability under the contract you entered. There may be some consumer protection that you have that they cannot exclude - I don’t know enough about German law to meaningfully comment. Notwithstanding, if you were to initiate legal action against the, as yet, unknown wrongdoer, you could subpoena the relevant records from the game company with a court order. No matter what privacy or other protections the other person has, the game company must obey the order or be in contempt. Without such an order the game company is right that they can’t disclose details of other users. As a practical matter, it will cost several hundred € to initiate legal action and several thousand to pursue it to the end. And you might lose. A better response is to treat the lost €80 as a relatively cheap life lesson - many people lose a lot more learning to recognise scams.
Suppose I obtain the ability to access someone else's cryptocurrency. This sounds like fraud e.g. I overheard them saying the password to their wallet out loud or I am a custodian of their assets. Nope, STILL fraud, possibly even Computer Misuse aka hacking... and because you use internet: it's Wire Fraud I now borrow those assets, keep them for some period of time, and then return them, without the owner's consent. hmmm, let's take california... Luckjy you, it is not embezzlement because you were not entrusted with the cryptocurrency, you gave yourself access. 503. Embezzlement is the fraudulent appropriation of property by a person to whom it has been intrusted. No it is plainly... theft under California law: 484. (a) Every person who shall feloniously steal, take, carry, lead, or drive away the personal property of another, or who shall fraudulently appropriate property which has been entrusted to him or her, or who shall knowingly and designedly, by any false or fraudulent representation or pretense, defraud any other person of money, labor or real or personal property, or who causes or procures others to report falsely of his or her wealth or mercantile character and by thus imposing upon any person, obtains credit and thereby fraudulently gets or obtains possession of money, or property or obtains the labor or service of another, is guilty of theft. In determining the value of the property obtained, for the purposes of this section, the reasonable and fair market value shall be the test, and in determining the value of services received the contract price shall be the test. If there be no contract price, the reasonable and going wage for the service rendered shall govern. For the purposes of this section, any false or fraudulent representation or pretense made shall be treated as continuing, so as to cover any money, property or service received as a result thereof, and the complaint, information or indictment may charge that the crime was committed on any date during the particular period in question. The hiring of any additional employee or employees without advising each of them of every labor claim due and unpaid and every judgment that the employer has been unable to meet shall be prima facie evidence of intent to defraud. Giving it back doesn't matter. The person taking the crypto for any amount of time without being entitled to them is committing theft. You see, California doesn't interest that you just want to borrow. They don't even require Mens Rea for the mere taking - only for fraudulent pretense there is an intent question. In fact, it might even be automatically Grand Theft: 484d. As used in this section and Sections 484e to 484j, inclusive:[...] (2) “Access card” means any card, plate, code, account number, or other means of account access that can be used, alone or in conjunction with another access card, to obtain money, goods, services, or any other thing of value, or that can be used to initiate a transfer of funds, other than a transfer originated solely by a paper instrument. 484e. (a) Every person who, with intent to defraud, sells, transfers, or conveys, an access card, without the cardholder’s or issuer’s consent, is guilty of grand theft. YIKES! and now, intent to defraud comes in, but that is actually minimal: that just means taking without being allowed to by the owner in many cases.
It would be a violation of 18 USC 1001, which is the law against making false statements to the federal government. Paul Mozer, who was a Salomon Brothers trader, received a four month sentence for doing something along those lines in 1994. Bidding on something implies an intent to pay for the thing, which in this case is a falsehood: in so doing, one "falsifies, conceals, or covers up by any trick, scheme, or device a material fact" (that you don't intend to pay for the thing).
Your code is considered free speech (Bernstein v. United States) and you have allowed the use of the code via the MIT license. Since the application of your code is very generic and is not specifically targeting anyone. You probably are not criminally liable. This is simply writing a "Proof of Concept" for security testing purposes. That same way Metasploit, Nessus, and Nmap have actual exploit code but are considered tools of the trade. Now if you go around using your spyware on non consenting victims. You might get a visit from some people with guns and badges that have 3 letters on them.
The relevant legislation is found in sections 5361-5367 of the United States Code. The key prohibition is in section 5363. To fall within the scope of this prohibition, a person must: (1) be "in the business of betting or wagering" and (2) accept a payment in connection with the participation of another person in "unlawful Internet gambling". So you need to look at (1) what is betting or wagering and (2) what is unlawful Internet gambling. Both terms are defined in section 5362 and discussed on Wikipedia. Assuming that you are running a video game that is not a thin veneer over a casino, and the users are gambling in-game items that are not purchased with actual money, then you are unlikely to be found to be engaged in the business of betting or wagering, especially given the exclusion in section 5362(1)(E)(viii) for "participation in any game or contest in which participants do not stake or risk anything of value."
It is legal for a company to ask for any information they want as a condition of doing business with you, so long as their request isn't proscribed by law. I don't know of any jurisdiction where a request for banking or credit information is illegal. (In this case, however, it does seem like you are being phished. You could report the matter to your country's consumer protection agency.)
The important question is: was the £200 a fine (which is paid to the state) or compensation (which is paid to you)? Assuming it was a fine He doesn't (at the moment) owe you anything. However you can sue him for damages. Usually a claim for damages is time-barred after six years (and it is now seven years). However you weren't able to sue him yourself until you were 18, so you may have a couple of years left. However the clock may have started ticking immediately after the attack, on the grounds your parents or guardians could have sued. Talk to a solictor about this possibility; they should give you a free 30 minute consultation, and would probably take a case on a contigency fee (no-win no-fee) basis if it has any chance. In principle, you could have applied to the Criminal Injuries Compensation Board for compensation - but you are too late for that; you have to apply within two years (there are some exceptions, but none seem to apply to you). Assuming it was compensation He owes you £200. Now you need to enforce that payment - and again, the problem may be the six year clock. You will definitely need to talk to a lawyer about that. My gut feeling is that the £200 was probably a fine rather than compensation.