Is it illegal to ask a company for money in exchange for information on a bug in their software? Let's assume that I have a found a bug in a company's website/software which – if exploited – bypasses their paywall and allows me to use their website/software without any payments. I then inform the company about what this bug is capable of (when exploited), and ask them for money in exchange for the information on where the bug is and how I could exploit it. Can the company take legal action against me?
Is it illegal to ask a company for money in exchange for information on a bug in their software/website? That in itself is legal. Indeed, the company would incur unjust enrichment if it coerced you to disclose your discovery for free. Only if you threatened the company to divulge to others your discovery unless the company pays you, it would be illegal and trigger charges such as extortion (likewise, legislations outlaw the unjustified delivery of programs or instructions for hacking a software/network/etc., although this goes beyond your actual question). Can the company take legal action against me? That seems doubtful, futile, and it could backfire (please note I have not done any research on legal precedents about this). Although the terms and conditions of the website or the End User License Agreement (EULA) of software might prohibit you to reverse engineer (RE)/decompile/etc. the application, anti-RE clauses are unenforceable and the remedies therefor are indeterminate because the sole act of conducting reverse engineering does not subject the company (or third parties) to any losses. The company's decision to take legal action for your discovery could backfire from two standpoints. First, it calls attention to the fact that the software at issue is defective and unsafe. And second, the bug is likely to be detected by someone else anyway, thereby potentially compromising customers' systems.
Using software generally does not entail any legal requirement to acknowledge the use of that software, and would only arise as a licensing condition. Google services, including Translate, are subject to certain terms of use especial the part about what they expect of you. They do not impose any requirement regarding acknowledgment, therefore they cannot later demand any royalties. If a translation program imposes any demands on your usage of the program, that has to be part of the original agreement whereby you were allowed to use the software at all.
If you were to seek legal recourse for breach of contract (their Terms and Conditions), the best outcome you could hope for would be "making whole", and since they have already offered this a court could award you what the retailer already offered, but make legal costs on both sides the plaintiff's liability (ie. you), since you could have taken the offer and avoided court. The Terms and Conditions associated with the discount code mean that you won't be able to return the gift cards for cash. It will be argued that by using the code, you agreed to those terms and conditions. The second paragraph of their reply looks like an attempt to scare you, but it has legal merit. By using the unauthorised code you could be considered to have made false representation when you entered into the contract. This could render the contract void, and if they could demonstrate it had been done deliberately to gain money it could meet the threshold for fraud (which is what the police would possibly investigate : if it can be shown that you were aware the discount code didn't apply to you it would constitute making "a false representation ... to make a gain for himself" [sub-paragraphs 1-5, paragraph 2 of the Fraud Act 2006]). You may be able to argue that the voucher websites misled you (though it sounds like you, I and the retailer already know that's not true), but since the retailer has offered to repay what you paid there are unlikely to be any damages - and, unless the voucher site took commission from your transaction, a contract between you and the voucher sites would be difficult (possibly impossible) to establish. In the circumstances, returning what you originally paid is a good offer.
In the abstract, two businesses that cooperate in violating a third party's copyright could both face liability. Applying that information to the facts you gave would amount to legal counsel. If you don't want to tell the client 'no,' you should speak to a lawyer about your potential liability. Beyond the legalities, do you really want your portfolio to advertise that you design sites by ripping other sites off?
Liable, yes. How much liable, depends. There would be copyright infringement, and with copyright infringement the exact facts count. Like did you commit copyright infringement to make money, were you aware that you committed copyright infringement etc. With your contract, it seems clear you didn't set out to commit copyright infringement to make money (because you paid someone else telling them not to commit copyright infringement). Up to the point where you learned what happened, you didn't know it was copyright infringement. After this, you better remove all the infringing works, because now you know it's copyright infringement, and now you are saving money by not hiring a second developer. Obviously you can sue the employee for damages.
In the UK it is an offence to cause a computer to gain unauthorised access to any program or data held in any computer (s1 Computer Misuse Act 1990). It seems likely that other European jurisdictions have similar laws. Certainly Germany does: Penal Code 202a data espionage (German text - English translation). (I mention Germany because the linked thread does.) It might constitute theft in the jurisdiction if the finder did not take reasonable steps to find the owner - which may include informing the police of the find. Depending on the jurisdiction it might count as 'treasure' or abandoned property such that the finder is obliged to inform the authorities (the jurisdiction has the presumption of ownership of abandoned or lost property - e.g. Scotland), which then decide what to do with it. Legally speaking it seems to me that, to declare it legal, we have to get over such hurdles. [edit] There seems to be some dispute in the comments that cryptocurrency is subject to any regulation, counts as property, is something of value or is something that is owned and can be stolen, such that the person in the questioner's scenario could be held to account under the law for his behaviour. Aren't they merely numbers? No - plainly they do have value because people trade them with currency and goods and services. The UK's tax authority, HMRC, "does not consider cryptoassets to be currency or money" but sees them as having economic value because "they can be 'turned to account' - for example, exchanging them for goods, services, fiat currency (that is money declared by a government to be legal tender) or other tokens". They are "a new type of intangible asset". Individuals are liable "to pay UK tax if they are a UK resident and carry out a transaction with their tokens which is subject to UK tax". They are liable for "Income Tax and National Insurance contributions on cryptoassets which they receive from their employer as a form of non-cash payment [or from] mining, transaction confirmation or airdrops." (HMRC cryptoassets for individuals) Are they property? Something that can be owned, something that can be dishonestly appropriate (i.e. stolen)? That's the interesting dispute. Recently, the High Court of England and Wales ruled in a bitcoin ransomware-related case that "for the purpose of granting an interim injunction in the form of an interim proprietary injunction ... crypto currencies are a form of property capable of being the subject of a proprietary injunction". In that judgment there is some discussion of the authorities for considering or deciding they are property. ([2019] EWHC 3556 (Comm)) read from para 50 if not the whole judgment. In at least two other cryptocurrency-related cases the High Court treated the cryptocurrency as property. Vorotyntseva v Money-4 Limited, trading as Nebeus.com [2018] EWHC 2598 (Ch) and Liam David Robertson v Persons Unknown 2019. There was also a suggestion in the comments that the police would not understand and would not be interested. But there are several jurisdictions where people have been investigated, arrested, prosecuted and convicted of crimes relating to cryptocurrencies. A simple internet search for bitcoin theft, fraud or money laundering will result in some reports. In any case their interest or lack of it is irrelevant to what the law may say.
First of all, Google's TOS says we reasonably believe that your conduct causes harm or liability to a user, third party, or Google — for example, by hacking, phishing, harassing, spamming, misleading others, or scraping content that doesn’t belong to you And you ask: But suppose a researcher, say based in UK, managed to work around them, get a big amount of data from Google searches and use it to publish some research. You're confusing methods with results. Someone uses methods to get a result, but if the results are not legal, the methods are usually illegal, too. Would the above depend on how they circumvented Google's checks (i.e., by using lots of proxies)? The words &quot;or scraping content that doesn’t belong to you&quot; means just that; it does not give any wiggle room for the actual method used to scrape. Could they get, theoretically, into trouble? Very much so. The researcher would have at least civil liability, and possibly criminal exposure. Would they, practically? Google can be very not kind to people who break their TOS. And Google has lots of money to spend on lawyers and court fees to enforce their TOS. Google would probably be able to easily prove the data came from their servers, and would probably have server logs to help prove it. And see user6726's answer for specific legal citations in the US and UK.
As I understand it, you can pretty much sue anybody for anything. The question, of course, is would you win the suit? All the lawyers here can correct me, but I believe in order to win, you would have to Show standing, that is, they're your comments and not someone else's Show that it's a deliberate act, and not just someone accidentally clicked the wrong checkbox. Show that it was an act by the agency and not by Facebook, for example. Show that you've been singled out for your viewpoint (they allow some people's comments) Show that there is no other reason to delete your comments (they're obscene, or advocate for an illegal act, for example). I'm probably missing something else. The real question is, even if you could demonstrate all these things, would it be worth it? You may spend $1,000's and you might not recover your legal fees. The case might take years.