Is it illegal to download passwords in bulk from the dark web to make a password checking tool to help people? I remember some password managers like Google's would give me a warning about passwords that have been compromised. My question is this. How is Google or any company able to see that the password I have chosen matches one that has been compromised? My first thought on this is that they must have gotten it from 1 of 2 places. Either they themselves would do what a hacker would do and download a bunch of files with bulk information they could try for like 10 million account combinations. They could get this from where it would be seen first aka the dark web, or they get the bulk passwords from the company that says its been hacked and releases whose information was compromised. I am not sure though and would like to invite other opinions on how they are able to legally obtain the hacked data. Assuming they have some sort of contract with the government that says I promise not to do anything bad with this information. In general there must be some way to get like a permit to explore on the dark web in order to get information on the latest hacks. Seems like the quickest way to counteract hacks.
Most of the question has nothing to do with the law, it's about technical how-to or how-does, which should be asked in Information Security SE. There are two possible legal questions: is it legal to break into a computer system and take a database of passwords, and it is legal to acquire such a database obtained by someone else. As should be known in the US, per 18 USC 1030, breaking into a computer is illegal in the US. Given that, it is extremely unlikely that Google illegally breaks into other computer systems to obtain passwords. The aforementioned law criminalizes accessing computers without authorization, not (just) &quot;taking&quot; stuff from computers without authorization. The law does not criminalize receipt of illegally obtained material. Passwords are not protected by copyright. If Google were to induce someone to break into a computer system to get passwords, that would be legally actionable, however there is no law penalizing innocent receipt of illegally-obtained passwords (insofar as they are not protected by copyright). It is not illegal to access the dark web, at least in the US (probably it is illegal in Saudi Arabia). Using stuff gotten from the dark web can easily be illegal (e.g. logging in to someone's bank account, or forging a passport). There are many services which monitor the dark web and report breaches, which is totally legal.
First of all, Google's TOS says we reasonably believe that your conduct causes harm or liability to a user, third party, or Google — for example, by hacking, phishing, harassing, spamming, misleading others, or scraping content that doesn’t belong to you And you ask: But suppose a researcher, say based in UK, managed to work around them, get a big amount of data from Google searches and use it to publish some research. You're confusing methods with results. Someone uses methods to get a result, but if the results are not legal, the methods are usually illegal, too. Would the above depend on how they circumvented Google's checks (i.e., by using lots of proxies)? The words &quot;or scraping content that doesn’t belong to you&quot; means just that; it does not give any wiggle room for the actual method used to scrape. Could they get, theoretically, into trouble? Very much so. The researcher would have at least civil liability, and possibly criminal exposure. Would they, practically? Google can be very not kind to people who break their TOS. And Google has lots of money to spend on lawyers and court fees to enforce their TOS. Google would probably be able to easily prove the data came from their servers, and would probably have server logs to help prove it. And see user6726's answer for specific legal citations in the US and UK.
That's an old idea that has been tried several times before (such as the first, being Unvarnished: Website Lets You Review People (And Trash Them) | HuffPost, which no longer exists); and one of the latest incarnations is Peeple (mobile application - Wikipedia). There are lots of legal liabilities, including defamation and harassment/stalking, even with the Section 230 of the Communications Decency Act | Electronic Frontier Foundation which (mostly) protects the website owner from others' speech posted on the site (your mileage may vary due to jurisdiction). The only way such a site would survive is to do what Peeple and other sites have done: greatly limit the speech allowed, such as limiting to only positive reviews, giving the subject complete control over what does appear on their profile, only allowing "opt-in" profiles, verify identities, etc. You would have to implement full GDPR compliance; but various lawsuits will either shut you down before you get far enough to launch or soon after and force you to greatly limit the scope of the site. Most lawyers would advise you to find something else to do with your time and money.
In all likelihood, the judge's order related to data collection and reselling is not legally enforceable. They weren't parties to the expungement action, so the judge doesn't have jurisdiction over them. And, the First Amendment protects the right to say truthful things pretty absolutely. Arguably, if the sites provided the information without making clear that it might not be current because records were expunged or corrected, there might be a claim for negligent misrepresentation, false light, or even defamation, but I seriously doubt that even those claims would hold up. The language in the order might cause sites to comply out of not legally justified concern, or just a desire to be accurate, even if it is not enforceable. So, it doesn't hurt to bring that information to the attention of such sites and ask them to take down the information. But, when push comes to shove, I very much doubt that you would prevail in court enforcing that order against them. Certainly, if you do nothing, they will do nothing, because they are not psychic and have no idea that the court order related to those records has been entered. Even a valid and enforceable order directed at a party over whom a court has jurisdiction is not effective until the person ordered to comply with it has notice of the order. And, there is no system that gives sites like that notice without you taking action to inform them of an order.
A law has to be "broad" to include a lot of possible crimes and intent of criminals and account for the good faith of non-criminals. "Intentionally access without authorization/exceed" is actually fairly specific; "intent" is the keyword. Someone making a mistake may have intent to login, but no intent to commit a crime. Someone confused by "different pages of demo and live accounts" can easily defend their actions by pointing out that they were confused. It's up to the reasonableness of the pertinent law enforcement and prosecutors to take into account the evidence that reasonable mistakes were made by little old ladies and not charge them with a crime. And for the most part, 98% of the time, law enforcement and prosecutors are reasonable.
Your VPN scenario is why you have to show the banner to everyone. If you somehow knew beyond any doubt that someone was not in the EU, then you would not have to show a banner, but because you can't verify that, you should always show the banner. Doing so also protects against accidentally violating a similar law in another country; the GDPR is the best-known privacy law, but it is far from the only one. It's good practice to ask for people's permission before collecting their information anyway.
Disclaimer: Not a lawyer or even living in US. I try to write the answer under US law. Other countries law may differ. Make sure you consult a lawyer in your jurisdiction. Here is my understanding of the individual examples: You don't need permission legally, because you are only accessing your own account and your own information. You are the only one damaged by the intrusion and therefore, nobody can really file a lawsuit against you. This is often used by security researchers when the subjects are uncooperative. That being said, if it is an actual pentesting client, you may want to refrain from it regardless. You don't need a permission to modify hardware you own. This is completely legal and not considered an attack. It would qualify as an upgrade, such as replacing a component in your laptop. You are allowed to do that. You should have a permission here. This is an intentional penetration test and you should have permission to do this. The same as 3. This is an intentional penetration test and you should get a permission. Though if you logout immediately and don't mess with the interface, it may not be illegal on the basis that you did not cause any damage or steal any information, or it may be illegal under some circumstances. It may also be impossible to prove that you did not do anything while there.
It doesn't really require anything beyond your say-so that it is what you say it is; that would be enough to satisfy the requirement for authentication. From there though, as with any evidence, it's going to be up to a jury to decide how much weight to give the evidence. So the more you can show them to prove that the record is real -- and to knock down any questions the opposing party will raise -- the more likely they are to believe it. So if you just bring a printout that looks like it could easily have been forged, the jury may be thinking about that. If you can bring in a data forensics expert to say the document couldn't have been faked, that's probably going to help. Addendum: As a practical matter, I wouldn't expect this to be much of an issue. Unless you're dealing with a savvy opposing party, the authenticity of e-mails seems to be generally assumed. Courts (1) generally assume that parties aren't perpetrating frauds; and (2) are generally run by judges with little to no technical savvy, who don't realize that one could forge an e-mail, let alone all the different ways it could be done. I've personally entered countless e-mail printouts without them being questioned, even though either party could have just gone down into the e-mail thread and changed what the other side had said earlier in the conversation. To avoid the issue, though, it might be that sending the e-mail to a Gmail account would elimimate the question.