Why government can catch silkroad but not bitconnect? I think part of the answer should be in computer science. But part of this is probably law. Bitconnect is a ponzy that recently collapse. The thing is it's not on dark web. Yes the people are anonymous. But there have to be some people working on that website. Government can just subpoena the server. Silkroad, however, is behind dark web. Very difficult. What did bcc did to avoid law enforcement? Do they host their site at some bulletproof server? How do they remain anonymous without dark web? Why government can't just subpoena the host and got their names? What I am thinking is the following. BCC is suspected of being a ponzy for a very long time. C'mon. Every single company like BCC is a ponzy. They offer fix return. They claim outrageous money machine (they call it volatility engine) that most likely don't exist. BCC is not hosted on dark web. So there must be some servers that does it. Government can request image of the server like they did on silk road. Then it'll be obvious who access it, where the money go, etc. Then just seize the guy. Update: Now Bitconnect has collapse as expected However, the website is there https://bitconnect.co/ I think a judge has ruled against them. https://www.coindesk.com/us-court-freezes-bitconnect-assets-as-lawsuits-mount/ So I wonder why there was no progress? My point is, we all know, this is is fraud. And we know they try to do this anonymously. However, their server is there in plain sight. So I wonder why the cops couldn't track the operators?
The answer is more law than it is computer science. You can't tell if a Ponzi scheme is a Ponzi scheme by looking only at individual transactions in the scheme. The individual transactions involve buying something, selling it, entering into loan or investment contracts, and the like. What makes a Ponzi scheme a Ponzi scheme is that the promoters make their money primarily from the investors and individuals acting as sub-promoters in the scheme and not from end users of whatever is being nominally promoted by the Ponzi scheme. Only by analyzing the finances of a purported Ponzi scheme can you determine that it is indeed one. The individual transaction documents and transactions can be facially legal, but still be an illegal Ponzi scheme if the economics of the scheme as a whole are illegal. (Similarly, it is impossible to tell if an anti-trust violation is illegal simply by looking an individual transactions carried out in furtherance of the anti-trust violation. You can't tell if goods are being sold below cost to damage competition, for example, just from a single sale of goods transaction in isolation.) In contrast, many of the transaction at Silkroad were illegal in isolation - buying or selling controlled substances or child pornography or whatever else was forbidden to sell to the counterparty in the transaction. If you can just look at a single transaction and determine that it violates the law, it is much easier to develop the probable cause needed to do a fuller investigation or to make arrests.
Whether this is considered a trade secret (at least in the US) depends partly on whether you've taken reasonable action to keep it secret. If an employee thought it was OK to publish the algorithm, that's evidence that you didn't try very hard to keep it from getting out. Even if nobody's noticed it yet, getting the blog post taken down in't going to get it off the internet. You may as well try to do it anyway. If nobody has noticed the algorithm by now, you want to make it harder for them to find. You need an IP lawyer pronto. Depending on where you are, you might be able to get a patent on the algorithm still, but patents are hard to enforce, and it appears to be getting harder in the US to patent algorithms. (There's a Stack Exchange site so people can look at patent applications and see if they can invalidate the application with prior art.) You can't license out the algorithm without having some legal way of stopping other places from just using it. If you have more proprietary algorithms or things that aren't generally known that give you a competitive advantage, it would be a good idea to inform employees that they aren't supposed to reveal them. Check with your IP lawyer to see what you should do.
According to Julian Assange, CNN committed a crime violating § 135.60 of the New York criminal code "coercion". Reddit, while being a private company, is still considered a public forum. Anything said on these sites can be used against you if your actually identity is discovered.
You can't own a database; you might, however, own (have) the copyright to a database if you created it or the creator transferred that right to you. You can also possess a copy of a database: the question is whether it is legal. "Leaked" implies that it is taken without permission, so you might be in violation of copyright law by possessing a copy. The only databases that would escape copyright protection would be those US government works, things put in the public domain, and things publically licensed to allow copying. Plus, any database whose content fails to exhibit a modicum of creativity (Feist). A database might be inherently illegal (at least in your hands), so it would depend on what the content is. The first thing that comes to mind is a database from a child-porn website, which contains numerous illegal images: see section 110 of Title 18. "Leaked" information might involve violation of 18 USC 1030 (Computer Fraud and Abuse Act), which prohibits unauthorized hacking. It does not directly prohibit being in possession of a hacked database: but you might still be prosecuted as an accessory after the fact. (That is one of those ad libitum areas of the law where there's no way to know for sure what is and is not "okay"). If they do prosecute you, you might rely on Bartnicki v. Vopper, 532 U.S. 514, where because it was a matter of "public interest", propagation of illegally obtained material was held to be protected by the First Amendment. Also there is the case of the Pentagon Papers. At the federal level, there are no controls over storing credit card information so if you get a copy of the Target or Home Depot hacked database, there's no federal law against that (if we discount "accessory after the fact"), but there are circumstances in Minnesota where retaining such information could be illegal.
You wrote: As far as I believe, it is permitted under GDPR to record and store non-anonymized web server access logs, as these can be useful for security reasons. True, Recital 49 GDPR: The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems. You asked: My question is whether this anonymization process counts as processing personally identifiable data under GDPR? IP addresses are personal data in some cases, so yes, you're processing personal data. Then, these anonymized logs will be fed into an analytics tool to provide stats on unique visitors, page hits, etc. These are purposes considered compatible with initial purposes according to Article 5.1.(b): Personal data shall be (...) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for (...) statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’); As a matter of fact, you might be required to anonymize the data for those purposes, see Article 89.1: Processing for (...) statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner. If I were to anonymize the logs and continue to use them exclusively for security reasons, would that change anything? No, you would be processing data in a manner compatible with initial purposes (ensuring network and information security). Or does it not matter what I do with them once they are anonymized? Yes, it does. If you're not using them for &quot;archiving purposes in the public interest, scientific or historical research purposes or statistical purposes&quot; then you're using them for purposes incompatible with initial purposes. You would need to find new legal basis for processing. does this extra anonymization process on top then take it over the line meaning that consent and a privacy notice would be required? It depends on what you want to do with anonymized data. In your case, for security purposes or security and statistical purposes, you don't need the consent and there is no requirement for the privacy notice (but sure, it would be nice to publish one). For other purposes it might be different.
There are three main aspects to this: Its their website, and their terms of service. They can enforce those terms, or change them (in some appropriate manner). You have no recourse if they remove you, block you, or delete your account, for example. That's the measure that you would probably have, virtually every time. To claim damages, or litigate beyond just website access control, requires a legal claim. But there's a catch there. To claim damages, they need to show actual damage, which they wish to be compensated for. If you misused their website but no actual harm can be shown, the total damage claimable is zero, whether or not you followed their rules. Merely entering dishonest information isn't by itself harm. So they would have to show they suffered damage/harm because of that, which is directly attributable to your behaviour, was foreseeably harmful etc, or similar. They also need to consider legal costs, and ability to enforce, especially if you are in a different country. If for some reason the computer use was also illegal, then a criminal act could be committed and they could notify law enforcement. For example suppose you did this in the little known country of Honestania, where the law says that to prevent trolling and online abuse, anything posted on social media under any but your own legal name is a crime. Or suppose you'd been banned from the system and ignoring/evading such a ban was criminal computer use or criminal trespass due to the forbidden/unauthorised access (which can happen in several places). But this is purely for completeness; I guess you'd know if you were taking it further, into criminal computer use.
This would probably constitute illegal wiretapping and would certainly constitute a 4th Amendment search if conducted by law enforcement. Normally, the definition of whether something is "public" for purposes of an expectation of privacy is whether it could be detected by a human being unaided by technological enhancements from a place where someone could lawfully be to make that kind of observation. Some of the relevant cases are Katz v. U.S., 389 U.S. (1967) (tape recorder outside a public telephone booth was a search violating the expectation of privacy) and U.S. v. Karo, 468 U.S. (1984) (tracking device placed in barrel by authorities violated expectation of privacy). RFID signals are not "public" even if they are not encrypted with a private code because a device, such as the ones identified in the question, is necessary to receive them. The Wiretap Act, codified by 18 U.S. Code § 2511, is a federal law aimed at protecting privacy in communications with other persons. Typically, when you think of a "wiretap," the first thing that comes to mind is someone listening to your telephone calls. But the Act protects more than that. Under the Act, it is illegal to: intentionally or purposefully intercept, disclose, or use the contents of any wire, oral, or electronic communication through the use of a "device." The Act provides criminal and civil penalties for violations, although it creates various exceptions to when interceptions and disclosures are illegal. From here. In this circumstance, despite being passive, one is intentionally intercepting the contents of electronic communications through the use of a device. The fact that there was not in all cases an intent to communicate through, for example, an RFID chip, on a specific occasion probably does not suffice to render it not a communication.
If the website containing the GDPR-wall processes any personal data of users who hit the GDPR-wall, the GDPR applies to that website. This can be as simple as writing a logfile of all visits to the website. In this case it will be illegal if the website owner does not comply with the GDPR. However a supervisory authority would probably not spent any time on such a minor violation. As long as the the website with the GDPR-wall does not process any personal data, the GDPR does not apply, so nothing in the GDPR can forbid the GDPR-wall. Some related remarks: The GDPR does not require a "privacy policy" on the website if the website does not process any personal data. If personal data is processed based on consent, that consent must be freely given. Also it may not be disruptive. So a cookie wall asking for consent would be illegal. But the GDPR does not care about any other disruptive popups, as long as they are not related to asking for consent. Using GeoIP is a perfect way to implement such a GDPR-Wall, because it would block everyone from within the EU, but nobody else. So it blocks exactly those for who the GDPR would apply. In such a case it would not be reasonable to expect anything more from a website owner. A user which uses a proxy, can not expect to be protected by the GDPR, because it bypasses a restriction set by the owner of the website. A webserver does use the IP-address of all incoming requests, to send the reply back. That could be considered a processing of personal data, but everybody seems to agree it is not. I am not sure why. But I do agree that it would be very impractical if that is considered processing of personal data. I added an example from the Washington Post So you have to pay $9/month for a GDPR compliant subscription. Because the price you have to pay is not unacceptable high, I think it would be valid to offer the premium version this way. This does not force you to choose one of the other subscriptions. In december 2018, the Austrian DPA (DSB) has confirmed that a similar offer is lawful. On derstandard.at you get a choice between free access with tracking and advertising, or pay 6 Euro/Month for tracking free access. Because 6 Euro/Month is cheaper than subscribing to the printed edition, the DSB accepted that as a valid choice. More information can be found on noyb.eu or, (with more details but in German), on wbs-law.de.