What if a DAO (decentralized autonomous organization) breaks the law? A DAO is a decentralized organization, typically powered by cryptography. It works much like a business, but without borders. Although a DAO typically receives instructions from its stockholders, it is ultimately controlled by its code. One particular DAO, ominously known as The DAO. It's mission statement: The DAO’s Mission: To blaze a new path in business organization for the betterment of its members, existing simultaneously nowhere and everywhere and operating solely with the steadfast iron will of unstoppable code (emphasis present in original source). It already controls at least $20 million worth of assets, and it hasn't even started doing stuff yet! My question is, what happens if The DAO or some other decentralized organization breaks the law? For example, what if it breaks contracts, breaks copyright law, doesn't pay taxes, hires assassins or jay walks? Would its shareholders be punished? Would its contractors (people it pays in the real world to do its dirty work) be punished? Note that it could still theoretically do things like commit financial fraud (such as ponzi schemes) without requiring contractors. Would people involved in the crypto systems allowing it to exist be punished (in the case of The DAO, ethereum miners). Would the original programmer be punished? Note: I'm not saying The DAO or any other decentralized organizations will break the law. The DAO is even thinking of donating money to charity, which quite a nice thing. I guess practically a problem that might arise is that these things often operate internationally, and so if the values of the stockholders are based on one jurisdiction, and they don't really care about complying with the laws of other jurisdictions, you would have a problem (especially if they knew that there was nothing that those other jurisdictions could do about it).
The private organizations, in difference to international organizations (the organizations, members thereof are the countries) or the countries are not subjects of international law. They are also not a subject of criminal laws, so they technically can't break the law. The people can. If the actions of such organizations will break some laws, the people staying behind that organization will be made responsible. Either it will be single individuals, or the whole organization might be declared criminal (such as mafia or a gang) and there everyone, including stakeholders or casual employees/contractors might be subjects to interrogation, arrest and sentence. As for the problem you describe, when the organization made something illegal under one jurisdiction, and the stakeholders are sitting in other country, where such actions are not illegal, they might only partially be safe. They might be arrested not only in the country where the legal actions are taken, but also in third countries, that have extradition agreements with that country.
It infringes the copyright. It can easily be proved that both XOR1 and XOR2 derive from the source work by XOR-ing the streams with each other. It's just like any encrypted copy: it infringes the copyright, but only those who can decrypt it are in a position to know that it infringes the copyright. The posts on the forum are illegal because they infringe the copyright; it doesn't matter that they are derived works rather than the work itself, just as your drawing of a copyright-protected image infringes copyright because it is a derived work without being the work itself.
When does it become illegal to exchange bitcoin for cash? When the transaction purposefully skips the controls in place regarding anti-money laundering. Generally speaking, the issue is not the mere involvement of cryptocurrency in a transaction, but the crimes a wrongdoer seeks to camouflage or conceal by means of cryptocurrencies. Such crimes typically involve money laundering, identity theft, stolen card numbers, and the like. As quoted in one of the links you provide, "[t]he use of bitcoins in the transactions is a new technological flourish to this very old crime". Is there any direct source or any laws with numbers? Apropos of your first link, mentioning that "a Florida judge threw out money transmitting charges against a bitcoiner" (see also here), I will point out that the court's dismissal of charges against that defendant has been reversed early this year. See State v. Espinoza, 264 So.3d 1055 (2019). Although the judges' narratives of a case are questionable and/or sloppy and to be taken with a grain of salt, the appellate decision cites language from Florida legislation as applicable to virtual currencies (and, impliedly, cryptocurrencies). You will notice that the focus in the Espinoza decision is the interpretation of Florida Statutes in its sections 560.125(1) and (5)(a) (regarding unauthorized vendors), and 560.103(21), (29) (defining monetary value as "a medium of exchange, whether or not redeemable in currency"). As usual, each legislation may present subtle and/or fundamental variations. For instance, the court in Espinoza at 1065 identified that federal law is inapplicable there in that 31 C.F.R. § 1010.100(ff)(5)(i)(A) contemplates that "the transmission of currency, funds, or other value that substitutes for currency to another location or person by any means" (emphasis added), and Espinoza's transaction(s) did not involve a third party. By contrast, the Florida statute does not allude to third parties in that transmission of monetary value, hence preventing the statutory sanctions from being preemptively foreclosed in the matter of Espinoza. What about when someone buys with stolen money or money from illegal proceeds. Did you commit a crime if you sell bitcoin to someone and the money is stolen, or the gift cards are stolen? That also depends on the jurisdiction and the facts of the case. In Espinoza, he was allegedly informed that the cash he received (or was about to receive) in exchange for bitcoins "derived from engaging in illegal activity and that [the buyer] was planning to use the bitcoins to engage in further illegal activity", Espinoza at 1058. The court highlighted the State's argument that "dismiss[ing] a charge of money laundering is improper because money laundering requires intent" (emphasis added), which is sanctioned by section 896/101(3)(c).
I think haveibeenpwned would be legal in the EU because it carries out a task in the public interest (Art. 6(1)(e)), and it shares no more data then necessary, for example you can search for a password, but it would not show you the emailaddress which belongs to that password. It would also be legal for you to hold a copy of a leaked database, but only if you have a legitimate interest (Art. 6(1)(f)) to have it. Being a security company does not change that, but finding a legitimate interest might be easier. If you have a legitimate interest to hold a copy of a leaked database, it does not mean you can use it in any way you like. For example testing if the password still works, is very likely illegal everywhere in the EU. But I'm not familiar with the UK laws.
Legally, yes, if you get a license from Blizzard (unlikely, and if so, they'll probably want either money or a portion of your profits). Otherwise, not legally. This is exactly the situation that IP law (e.g. copyright and trademark) was created to address. Blizzard created the game and so they have rights to control and benefit from derivatives there of. There are some exceptions, but prints, buttons, and keychains are not likely to meet the requirements for those.
It might possibly be illegal. For criminal law, usually you need to obey the laws of three countries: The country you are a national of (by personality principle) The country from where you make the sale (by territoriality principle) The country that hosts the attacked interest (by territoriality principle) Then it depends on the jurisdiction (and other factors) whether the sale is legal or not. I'll use the example of my country, Czech Republic. There is a crime called "Unauthorized access to a computer system or data storage device". For example, you commit this crime by exploiting a vulnerability in a web application and copying the web owner's data on your computer. It is also codified that whoever wilfully facilitates the committing of a crime by providing the criminal with resources (such as the exploit) is considered to have also committed the crime. For this to apply, you must have known or expected that the exploit will be used to commit a crime. The courts would decide this.
Are my assumptions correct? Yes, this is precisely the sort of thing that would fall under the purview of "the purposes of the legitimate interests pursued by the controller or by a third party", as it fundamentally enables you to deliver the service to the data subject, and its also difficult to argue that "such interests are overridden by the interests or fundamental rights and freedoms of the data subject" given its a fundamental part of delivering the service before any consent can be given. Its not the intention of the GDPR to solely require a direct relationship between the data controller and data subject, its intention is to allow the data subject to control more of the relationship than they did previously - in some cases, that control remains with the data controller, which is why not all of the lawful basis for processing rest on consent. So long as you ensure that the CDN provider has a relevant privacy policy and is identified as a data processor in your privacy and data policy then you are good to go. In my mind, this is similar to the issue of how the data subjects packets get to you from their computer - we aren't including all of the network providers who carry the packets between the data subject and the processor (despite the fact that those providers will have access to much of the same information as the CDN, such as IP address, source, destination etc), even though in many cases we don't know that information (for example which route it will take over the internet). The only difference here is that as the data controller, you know about the CDN and can include it in your policies, so you should.
There is no case law as yet However, the most likely situation is that there is no copyright in the original works because they are computer-generated. There is certainly copyright in the code that created the art but the output of that code, the art itself, would probably not be subject to copyright. Copyright only exists in art created by humans. The US Ninth Circuit has held that animals cannot create copyrighted works. Subsequently, the US Copyright office has rejected applications for registration (a prerequisite to a suit in the US) of computer-generated art because it “lacks the human authorship necessary to support a copyright claim.” While this position has not been tested in the courts, I don't think they are any more likely to grant copyright to a program than they were to a monkey. What's going on? The OP states that there is litigation: there isn't. What there is, is a DCMA takedown request from Larva Labs. If this is complied with that will be the end of the matter; if it isn't then there may be litigation. However, before Larva Labs could sue CryptoPunks in the US they would first need to get a writ of mandamus to force the USCO to register it. If they try and fail then there will be a legally binding court decision that Larva Labs don't own the copyright in any of their computer-generated art. Which kills their business model and, presumably, them. This would be a very high-risk move. They may choose to sue in a jurisdiction where registration is not a prerequisite, however, that court would still need to be satisfied that there was a copyright that could be breached. So that's just a different take on the same problem. I have ignored the issue of NFTs as these are legally problematic in their own right and irrelevant to the main question. However, the NFT and the artwork are not the same thing.