Is it legal to host a directory of .onion urls? .onion is a special-use top level domain suffix designating an anonymous hidden service reachable via the Tor network. .onion. (2016, March 11). In Wikipedia, The Free Encyclopedia. Retrieved 12:46, March 23, 2016, from https://en.wikipedia.org/w/index.php?title=.onion&amp;oldid=709560870 I would like to host and maintain a directory of .onion urls on the normal Internet. I am not sure if this is 100% legal because these urls often refer to highly illegal services. There are already directories on the Internet but that does not mean that they are legal. I am living in Germany and the servers will be hosted in Germany too. Is it legal? Do I need a special disclaimer?
Generally speaking, you are only linking to other resources on the web, and generally that's not illegal. But that could be different depending on the country that hosts the site and the country of the user's access. This site seems to have no problem: http://thehiddenwiki.org/hidden-wiki/ Read their TOS, too: http://thehiddenwiki.org/2013/06/26/terms-of-service-and-privacy-policy/ That site is hosted in Romania (the domain is privately registered in Malaysia), but Germany and Romania are both EU. Now, what users may use those links for may be illegal. And that's still in legal flux in some jurisdictions, i.e. the hosting of a site of BitTorrent links that allow downloading of copyrighted material while the link itself does not contain the material themselves. See https://en.wikipedia.org/wiki/Legal_issues_with_BitTorrent Besides, a list of .onion links on the regular web is useless unless you know how to use the links; you're linking to resources on the &quot;dark&quot; that are not even directly accessible from those links on the &quot;bright&quot; web. Someone who wants to go to an .onion link needs to install Tor https://www.torproject.org/ to enable the DNS changes to access the .onion TLD (Top Level Domain). .onion is not even in the Internet's Root Domain; it's a special case TLD. https://en.wikipedia.org/wiki/.onion Installing and using TOR is one more step that someone has to take to make use of a link in the &quot;bright&quot; web to reach a link in the &quot;dark&quot; web. So your links are &quot;isolated&quot; in one more sense from usefullness, and that could be a legal defense, if it even comes down to it. Like anything, do your own research and draft a good TOS for your site. And, at the same time, using TOR is not illegal itself (but could be in some countries), but can result in illegal activity: https://en.wikipedia.org/wiki/Silk_Road_(marketplace) Read TOR's own legal FAQ: https://www.torproject.org/eff/tor-legal-faq.html.en
This is relatively uncharted legal territory, so until multiple cases establish some sort of precedent, we can only guess. I know of no legal requirement that a Browser or User has to submit cookies or referrer data or other meta-information accurately. In that regard, a user is unlikely to be prosecuted just for submitting HTTP headers. It is likely closely related to Free Speech issues. The DMCA spells out that it is illegal to circumvent copyright protection measures. While this law is typically used to make it illegal to copy DVDs, video-games or streaming movies, it is possible that the "3-free articles" policy could be interpreted as a copyright protection mechanism, and defeating it by changing HTTP headers is a circumvention. A good summary is here. A specific site's TOS (Terms of Service) probably contains language that spells out it is a violation to use the site in a manner other than as it is intended. This is a typical anti-hacking, anti-screen-scraping provision. Altering a browser session to circumvent their services is probably a violation of the license to access the site, and may open a user to a civil lawsuit for damages or even criminal hacking charges (the details of which are different state-to-state)
It might possibly be illegal. For criminal law, usually you need to obey the laws of three countries: The country you are a national of (by personality principle) The country from where you make the sale (by territoriality principle) The country that hosts the attacked interest (by territoriality principle) Then it depends on the jurisdiction (and other factors) whether the sale is legal or not. I'll use the example of my country, Czech Republic. There is a crime called "Unauthorized access to a computer system or data storage device". For example, you commit this crime by exploiting a vulnerability in a web application and copying the web owner's data on your computer. It is also codified that whoever wilfully facilitates the committing of a crime by providing the criminal with resources (such as the exploit) is considered to have also committed the crime. For this to apply, you must have known or expected that the exploit will be used to commit a crime. The courts would decide this.
If the operators of a site post them in such a way that anyone with a browser can access them, with no login or other security precaution required, and not even any notice that the files are confidential, they are implicitly inviting anyone to view them, and thus it is legal to do so. There was a case where a site owner gave specific notice to a user not to access the site, and blocked the user's IP. When the user hired a proxy service to get around the blockage, this was held to be unauthorized access, a crime under the CFAA (Computer Fraud and Abuse act). But in that case the individual notice was considered essential to the applicability of the act. That case was Craigslist, Inc v. 3Taps, Inc et al, 942 F.Supp.2d 962 (N.D. Cal. 2015). See also This Wikipedia article and thisJaxEnter article. As the Wikipedia article put it: Craigslist Inc. v. 3Taps Inc., 942 F.Supp.2d 962 (N.D. Cal. 2013) was a Northern District of California Court case in which the court held that sending a cease-and-desist letter and enacting an IP address block is sufficient notice of online trespassing, which a plaintiff can use to claim a violation of the Computer Fraud and Abuse Act. Note that in this case web scraping was apparently impacting the craigslist site.
Like many other jurisdictions, in the UK sites like the Daily Mail are liable for the content they host. In other words, the legal issue here is they either do not have the staff available to (or simply do not want to) spend the time moderating the comment sections in order to remove potentially defamatory or otherwise illegal content. As Lag added in a comment below: another legal reason may be liability for publishing something that creates a substantial risk of seriously impeding or prejudicing the course of justice in some ongoing legal proceeding. Far easier to prevent it beforehand than moderate it (and risk missing it) later. Content on Twitter (for example, replies to their own tweets), on the other hand, is not the Daily Mail's problem to moderate.
You can put anything you like in a ToS document, but not everything you might put there will be enforceable. By posting something on the web, you are inviting anyone to read it. In some jurisdictions that may include the right to make and store a personal copy, although not multiple copies or a copy for commercial use. You can taker technical measures to prevent automated access and automated downloads (scraping). There was a case (hiQ Labs, Inc. v. LinkedIn Corp, 938 F.3d 985 (9th Cir. 2019)) in which access restrictions were held binding in a US court, but in that case the site owner had notified the would-be reuser (a competitor) directly. The laws on this sort of thing may differ from country to country, and are not as well-settled as older parts of the law tend to be. The question asks: can I list in my terms of service that all users acknowledge I own their posts ... The only way in which the host could &quot;own&quot; the posts would be if the users transferred copyright to the host, or granted the host an exclusive license. Under US law this would take a written and signed document. Clicking an &quot;I agree&quot; box or button might constitute a valid signature. A statement that &quot;by using this site you agree ...&quot; would pretty clearly not. You might prohibit bots copying from your site and posting duplicates, but to prohibit users re-posting their own messages elsewhere is harder, legally, and leas reasonable in my view. Under US law you could not actually file suit for copyright infringement until you had registered the copyright, but that is not true in many other countries.
Two questions, here: Can a text story be obscene under the law? As one who hosts a website, can you be held liable for the content of a site? Can a text story be legally obscene The United States Court of Appeals for the Eleventh Circuit published their opinion on United States of America v. Frank Russell McCoy on March 12, 2015. Mr. McCoy maintained a website, young-stuff.com, from his home. He authored or edited more than 200 graphic stories detailing "sexual abuse, rape, and torture of young children." Mr. McCoy was indicted in June, 2007 and found guilty. The appeals court affirmed the conviction. Both the initial trial court and the appeals court found Mr. McCoy's stories "lack serious literary, artistic, political, or scientific value." Can a web site's host be held liable for the content of a site? Section 230 of the Communications Decency Act says that No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider. It also states that no internet entity has immunity from federal criminal law. Section 230 has been found to apply to intermediaries of third-party content. Generally, most assume that when the content is simply hosted and not moderated by the web site then there is no liability for the provider. That's not always the case and is determined by whether the host of the web site is considered a provider of interactive computer services or an information content provider. Any person responsible "in whole or in part...for the creation or development of information" is an information content provider. Which are you? In Fair Housing Council of San Fernando Valley v. Roommates.com, the 9th Circuit Court of Appeals ruled that roommates.com was not immune under Section 230 because they asked questions of their users that helped facilitate a potentially illegal search under the Fair Housing Act. They, therefore, helped create the content the site hosted. The question will ultimately rest on whether someone decides the content is obscene enough to be prosecuted and then if you, the site's host, aided in creating the content. This definitely requires the assistance of competent legal counsel.
Such use might well be illegal, and subject the user to tort liability, or possibly even criminal liability. Parties For this discussion let us call the person or company that developed and wants to protect the information D, the person or company that downloaded and wants to use the information U, and the person who placed the information on the server P. Trade Secret One possible source of liability is if D considers the information to be a trade-secret. The law on trade secrets varies to some extent in different countries, although there is a general similarity. Since no jurisdiction is specified in the question, I am going to look at the united-states law. Definition The LII page on &quot;Trade Secrets defines a trade secret under the US Uniform Trade Secrets Act (&quot;UTSA&quot;) as: &quot;information, including a formula, pattern, compilation, program, device, method, technique, or process that: Derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from its disclosure or use; and Is the subject of efforts that are reasonable under the circumstances to maintain its secrecy. A similar definition is given by the USPTO page on &quot;trade secret policy&quot;. Prior to the USTA, and still in those US states that have not adopted the USTA, trade secrets were/are protected under the common law. The LII page lists the common law factors, as given by the Restatement of Torts (1939) § 757, comment b: The extent to which the information is known outside the claimant's business The extent to which it is known by employees and others involved in the business The extent of measures taken by the claimant to guard the secrecy of the information The value of the information to the business and its competitors The amount of effort or money expended by the business in developing the information The ease or difficulty with which the information could be properly acquired or duplicated by others These factors may apply in other common-law countries. In either case, one must consider how the would-be user came to acquire the information, and thus how it came to be on the server from which it was downloaded. One must also consider whether it was the subject of &quot;reasonable efforts&quot; to protect its secrecy, under the circumstances. Circumstances If P was violating an obligation of confidentiality, such as an NDA or a duty as part of an employment relationship, then the placement of the info on the server was improper. In such a case its acquisition by another, such as U might constitute misappropriation. The same would be true if a person under an obligation of confidentiality arranged for the server to be indexed by a search engine, when it should not have been. The case for misappropriation would be stronger if U knew that the information was considered confidential by D, and also if P had informed U about where to find the info, or what search terms would uncover it. If P was acting with the permission of D, and P or someone else at D simply failed to realize that the server was, or might become, indexed, then the question is whether the steps taken by D to keep the info secret were reasonable. If this a case of &quot;inadvertent disclosure resulting from the trade secret holder's failure to take reasonable protective measures&quot; then there is no misappropriation, and the actions of U are lawful. That will depend of a judgement of whether D's actions were reasonable in light of the value of the info and the overall circumstances. If the placement of the info on the server is considered to constitute &quot;general publication&quot; of the info, so that it is no longer secret in any meaningful sense, then D may have a claim against P, but not against U unless U acted in collaboration with P. Copyright Law The documents downloaded from the4 server are almost surely protected by copyright. Directly incorporating them into an open source project without permission from the copyright holder would be copyright infringement, and would subject U to a suit for infringement. However, copyright does not protect ideas, methods, or facts. If U learns a method or idea from the document, and uses that knowledge without directly copying or closely paraphrasing the document, there is no copyright infringement and no claim under copyright law. Patent Law The question does not mention any patents. It is possible that D has patented the method describe in the downloaded documents. If so, and if the patent is valid, any use by U would be patent infringement, and the question of how U learned the info becomes irrelevant. However, most software developments such as data structures are not patented, so this is a somewhat unlikely, albeit possible, case. Notre that if the information is covered by a patent is is by definition not secret, as all patents must be openly disclosed. But they may not be widely publicized, and if U does not make a patent search, U may not realize that the document includes patented technology. This possibility is largely incompatible with the trade secret possibility, althogh it is possible to use trade secrets in connection with patented tech. Conclusion In short whether U may lawfully use then info, or is subject to a tort claim by D, or even criminal action, depend on the details of the overall facts. U would do well to take legal advice on the matter before proceeding to use the info.