Malicious actions by individual moderators This is a follow up on a previous question. Using Stack Exchange as a example, moderators should be able to destroy the site within minutes by automated means. There is no meaningful terms of service. I am not talking about the site intentionally deleting itself as a policy, as Stack Exchange has no policies or rules that would stand in a court room. Just saying if one of the moderators — there are hundreds of them — or not even a moderator, just a individual user who hacked the site — did this, there's nothing in the terms of service saying &quot;you're not allowed to destroy our site.&quot; Again, it doesn't have to be a moderator, it could be a individual user, or anyone. There is nothing in the terms of service saying you will go to federal jail for destroying Stack Exchange. Does this make it illegal? Even if it is illegal, how many mods, or just one, can just run an automated script in Java AWT and destroy the site in seconds or minutes?
Yes, it's illegal. 18 USC 1030 (a) (5) (A) [Whoever] knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer [shall be punished as provided in subsection (c) of this section]. &quot;Damage&quot; is defined at (e)(8) to mean &quot;any impairment to the integrity or availability of data, a program, a system, or information&quot;. Your proposed attack would certainly cause impairment to the availability of the Stack Exchange system and the data and information which it hosts. Whatever else you may think about the Stack Exchange terms of service, they certainly do not authorize any user or moderator to &quot;destroy the site&quot; in any sense such as you describe. It's not necessary for the TOS to explicitly say &quot;you may not do X&quot;; it's enough that they don't say that you may do it. To use a firewall analogy, it's &quot;default deny&quot;. &quot;Protected computer&quot; is defined in (e)(2) to mean, essentially, any computer that is used in or affects interstate commerce. Which means practically every computer that has ever accessed the Internet, and certainly includes Stack Exchange servers. So your proposed attack would include all the elements of a violation of this section. Such a violation is punishable by up to five years' imprisonment if it causes a loss of more than $5000 (see (4)(A)(i)(I)), which if such an attack were successful, it certainly would. Greater penalties are possible in certain circumstances. Even if the loss does not exceed $5000, or if the attack is merely attempted but without success, it is still punishable by one year imprisonment or a fine ((4)(G)(i)). There is nothing in the terms of service saying you will go to federal jail for destroying stack exchange. Irrelevant. It is not up to Stack Exchange Inc. or its TOS to determine who does or doesn't go to federal prison. Rather, it is up to Congress to determine what conduct deserves such punishment (as they did in 1984 by enacting this law), up to federal law enforcement and prosecutors to investigate and make a case against an alleged violator, and up to the federal courts to determine if the accused is guilty and how they should be punished.
On the face of it there is nothing illegal about your proposal, however, "Australia maintains some of the most restrictive Internet policies of any Western country". In addition, a suit can be brought under Australian law for any material accessible in Australia irrespective of the original source or where it is hosted. Offensive Content The Australian Communications and Media Authority (ACMA) is empowered to look into complaints from Australians about prohibited content on the Internet and issue takedown notices. The ACMA is not mandated to scour the Internet for potentially prohibited content, but it is allowed to begin investigations without an outside complaint. Prohibited content is content that which would attract an R18, X18 or RC by the Australian Classification Board. Note that this is more restrictive than what is allowed for offline publication; offline publications can be R18 and X18. Once the determination has been made that content hosted within Australia is prohibited, the ACMA issues a takedown notice to the Internet content provider (ICP). It is not illegal for the ICP to host prohibited content, but legal action could be taken against it by the government if it does not comply with the takedown notice. For offensive content hosted outside of Australia, the ACMA itself determines whether content is prohibited and notifies a list of certified Web-filter manufacturers to include the prohibited Web sites in their filters. Australian Internet Service Providers (ISP) are required to make these filters available to their customers but their use is not mandatory. Your type of site is unlikely to fall foul of this but it could happen, particularly if you allow images or video uploads. You would need to be able to respond quickly to any take down notice. Hate Speech Australia addresses hate speech through the Racial Discrimination Act 1975, which makes it "unlawful for a person to do an act, otherwise than in private, if: the act is reasonably likely, in all the circumstances, to offend, insult, humiliate or intimidate another person or a group of people; and the act is done because of the race, colour or national or ethnic origin of the other person, or of some or all of the people in the group." The Federal Court has ruled that publication on the Internet without password protection is a "public act" and hate speech on your website could fall foul of this provision. ACMA does not have the statutory authority to deal with hate speech complaints so the only avenue is through the courts, however, ACMA will pass on complaints to the ICP. This area is much more likely to be an issue for your site - it is easy to see a complaint about a product with a distinctive national origin descending into hate speech as defined. Copyright As a publisher, you could be held liable for the uploading of copyright infringing materials by others. Defamation This is probably where your greatest risk lies. For a defamation action to be successful, it must be established that the communication: was published to a third person, i.e. to at least one person other than the plaintiff (person/entity defamed). Putting it on the internet does this. identifies the plaintiff, for example, by name or by a reference to a small group of people, etc. Identifying the person as, say BMW, does this. contains a defamatory statement or imputation (whether intentionally published or not). Very generally speaking, material that could be found to be defamatory includes that which has the tendency to lower the person in the estimation of others, or that would tend to result in the person being shunned or avoided or that is likely to expose the person to hatred, contempt or ridicule; say a criticism about a car the person makes. In theory, any individual or entity who considers damage to their reputation has or is likely to occur, as a result of material published, may sue the publisher/s of the material. In practice, the laws are inaccessible to ordinary individuals who are defamed due to the exorbitant legal costs involved in bringing a defamation action. Australia's defamation laws are often used by politicians and corporations who consider the media, individuals or community groups have defamed them in publishing information critical of their activities. Defamation action may be brought, not only against the original publisher (writer/speaker), but also against anyone who takes part in the publication or re-publication of the material. However, the fact that a person can be sued does not necessarily mean they would be found liable by a court. There are numerous aspects relevant to liability. Defences that may be successfully pleaded in relation to a defamation action vary throughout Australian jurisdictions. Depending on the jurisdiction, these may include: truth/justification fair comment (e.g. an expression of an honestly held opinion or a criticism on a subject matter of public interest) absolute privilege (this attaches to the occasion, not the statement or speaker, such as during parliamentary proceedings, judicial and quasi-judicial proceedings, executive communications and communications between spouses) qualified privilege (e.g. fair and accurate reports of parliamentary proceedings, judicial proceedings, public meetings concerning matters of public interest/concern) consent (e.g. where the plaintiff expressly or impliedly consented to the publication of the particular imputation) triviality (e.g. where the circumstances/occasion of the publication were trivial to the extent that the person defamed was not likely to suffer harm) innocent dissemination (e.g. applicable to re-publishers/re-distributors such as newsagents/book sellers, including potentially to ISPs/ICHs. The defence in Clause 91 of the BSA is also relevant to ISPs/ICHs.) etc The Broadcasting Services Act (C'wlth) ("the BSA") provides a statutory defence to an ISP/ICH who carries/hosts Internet content in Australia and who was not aware that they were carrying/hosting a defamatory publication. You need to have good procedures in place to remove defamatory content ASAP after you become aware of it. Defamation action under Australian law may be commenced in any State or Territory in which the allegedly defamatory material was published. The Australian High Court has ruled that a party within Australia can sue a foreign party in an Australian court for defamation resulting from an online article hosted on a foreign server.
First, read the definitions of defamation and libel be sure you understand them: Defamation | Wex Legal Dictionary | Cornell. Yes, posting to Twitter and Reddit is publishing, and people can post provably false facts on those services and defame someone in a civil law sense. But Section 230 of the Communications Decency Act (Electronic Frontier Foundation) mostly protects those services from defamation claims based on statements made by users of such a service. (Things are different if the case is criminal as a result of clear threats of violence, terrorism, etc.) ...what are the steps for them to exact damages in a civil court case? Find a lawyer, convince him/her to take the case, and file suit. if you don't know the person's real name, your lawyer will have to sue "John Doe" and point that out in the suit (and subpoenas) with the alleged Twitter handle or Reddit user name. How would a person compel Twitter/Reddit/etc to disclose the ISP information on their account? Read the various legal aspects of each service, i.e. Twitter Legal FAQs and User Agreement - Reddit and others. Your lawyer can explain that you can only try to compel them to disclose the IP and the ISP used with a subpoena during your lawsuit. How would a person compel an ISP to disclose the subscriber information (address, name) on the IP address? Since most ISPs protect their customer data, you will probably have to subpoena the ISP during your lawsuit. But your ability to do this can depend on if the ISP is a private company or a government entity, such as a university. State laws may come into play. Is obtaining the ISP subscriber's information enough to bring a lawsuit against them? Would they able to argue they didn't post the messages and bear no liability, even if it originated from their network? If it originated from an open wifi hotspot, would the proprietor bear responsibility at this point? Yes, you can sue an individual with such information; but there's no guarantee you'd win. Sure, because they can claim anything, such as someone else was using their computer or IP. No, owners of hotspots are generally not liable, and they protect themselves with TOS you agree to when you use the hotspot. Can the extensive legal costs of pursuing the case to it's conclusion be added to the damages sought easily? Legal costs can possibly be added, depending on jurisdiction. But seeking damages and actually winning them through a jury verdict are completely different things.
The answer depends in part what venue you're talking about, e.g. Reddit, Facebook etc. The details are revealed somewhere in the Terms of Service for that venue. The general pattern is that you are allowed to use that venue, provides you grant permission for the service to do what they do with your content. You cannot legally send them a take-down notice for your stuff, because a take-down notice requires you to say that the stuff was posted without your permission (and that is false – and you can be punished for making that statement). There could be a venue where they do not hold you to an irrevocable license, in which case you could revoke that permission (but not Reddit: you granted them a "royalty-free, perpetual, irrevocable, non-exclusive, unrestricted, worldwide license to reproduce, prepare derivative works, distribute copies, perform, or publicly display your user content in any medium and for any purpose, including commercial purposes, and to authorize others to do so"). I've seen a site that actually asserts ownership of user-contributed content (I don't know if their TOS ended up being litigated) – if is not at all hard to write a TOS that includes transfer of copyright, rather than granting of a license. The only hard parts are (1) figuring out what you want in terms of permission to use and (2) whether your answer to (1) means nobody will use your service. SE and Reddit TOS probably are as close as you need to get for what you describe.
The conditions for lawfulness of processing are spelled out in Article 6 of the GDPR. As for it being legal for website operators to log the IP-addresses of visitors, this is covered by the following paragraph (also pointed out by phoog in a comment). The paragraph says it is legal to process personal data if processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. (my emphasis) You are not the only web site that logs IP addresses for the purpose of security. Every web site I've ever worked on - from those controlled by large corporations to tiny NGOs - do this. This security practice will not be impacted by the GDPR (if it were, I am sure we would have heard about it by now). there is the EU cookie law too If your website are going to be accessible to European citizens and not only accessible by your friends and familiy, you have to comply with the EU cookie directive of 2002 (a exemption for "personal websites" does not exist).
There is pretty much never a right to retaliate against harm to oneself, even blatantly unlawful harm. There is a right to defend oneself and others. One can use force to stop someone from inflicting unlawful or unjustified harm, or to prevent someone from inflicting such harm when the harm is imminent. One is not permitted to use more force than is "reasonably required" under the actual circumstances. This is true in pretty much every jurisdiction that i know of. The details on how much force will be considered "reasonable" will vary. In some jurisdictions there is, under some circumstances, a s"duty to retreat". This generally means that if a person attacked can avoid the harm by fleeing with reasonable safety, that person must do so rather than using force in self-defense. In some jurisdictions this "duty to retreat" applies id the victim is attacked in public, but not in the victim's own home. The right to self defense does not apply when the "attacker" is an agent of the state acting lawfully. For example, a prison guard taking a condemned prisoner to a death sentence cannot be attacked on the grounds that the prisoner is engaging in self defense. In theory a police officer engaging an excessive force, particularly unjustified deadly force, may be resisted in self-defense. But courts are quite reluctant to find such resistance justified in practice. There generally must be very clear evidence of egregious misconduct for the court to rule for the non-police person in such a case. Note that "self" defense can equally be defense of another person. Pretty much all the same rules apply. Self defense applies no matter who the attacker is, but that force is reasonable may vary depending on the attacker. Only such force as is reasonably required to stop or prevent the harm may be used with a justification of self-defense.
Why isn't forcing users to accept new Terms of Service by threatening financial loss, (like denying access to purchased content, or inhibiting or prohibiting the ability to earn an income), considered extortion and therefore illegal? Usually this is not illegal, and even if it is, it usually doesn't constitute extortion (or extortion's civil counterpart, which is called &quot;duress&quot;, which is an affirmative defense to contract enforcement). Generally speaking, exercising a legal right someone already has, for a purpose that is not improper, does not constitute extortion. A TOS Rarely Creates A Reasonable Expectation That It Won't Change Most importantly, in the case of terms of service governed information technology services, the firm that creates the terms of service reserves, at the outset, the right to change them at any time. So, the user has no reasonable expectation that the terms of service won't change in a manner that they dislike. There is no implied promise to never change anything material about the service. Terms of service are usually specifically drafted from the outset to avoid creating something that looks like a property interest on the part of the user in having the service continue to work in a particular manner. TOS Terms May Not Be Unconscionable Both the original terms of service and any subsequent amendment of them, is not permitted to be &quot;unconscionable&quot; (e.g. it can't make the life of your first born child a liquidated damages provision that applies if the terms of service are breached). But, there isn't much of a legally protected reliance interest in not having the terms of service changed in this situation (although almost every general rule could conceivably have some exception to it, probably far more factually extreme than the fact patterns identified in the question). If a term is unconscionable, it may not be enforced as contrary to public policy, without regard to what prior versions of the same agreement may have stated. TOS Changes Are Usually Prospective Only On the other hand, a terms of service amendment is generally only effective prospectively and does not generally change rights that have fully accrued and vested prior to their amendment, at least until the user takes some act to affirmatively continue to use the service going forward. When there are vested rights under old versions, the remedy is not to characterize the change as extortion, however. It is to not apply the amendment to the terms of service retroactively to the already vested rights. For example, if the old terms of service did not contain an arbitration clause, and litigation was in progress under the old terms based upon old transactions, and then a new terms of service were adopted that mandated arbitration, this amendment would not generally be applied to require the pending lawsuit in court to be stayed and transferred to an arbitration forum. The right to litigated vested when the lawsuit was filed.
That's probably not a violation of that rule...but that's not your biggest problem. The most reasonable interpretation of that line in the terms is that you can't use a bot or do anything that looks kind of like using a bot. So if you and all your friends used a script to enter your picks for you, that wouldn't be allowed. Manually entering picks based on some predetermined methodology is hardly &quot;robotic, repetitive, automatic, programmed or similar.&quot; Your much larger problem is mathematical, not legal: you'll need 42,467,327 friends (plus yourself) to guarantee a perfect pick. It seems like you need to correctly rank 4 groups of 4 in order, plus correctly guess the result of an additional 7 two-team games, so that's ((4 nPr 4) ^ 4) * 2^7 = 42467328 entries required to cover all possible rankings. Last year, there were 5 million participants (and only one perfect pick among them), so if you get that many people to enter, I'd bet Riot would be more than happy to give you a free computer for advertising their tournament to so many people.