Withholding information about a problem as extortion - computer security research Over at Security.StackExchange, a discussion broke out over the use of the term "extortion" in a situation where an anonymous security professional sent an email to a business to say that they found a vulnerability in the business' website, but the security professional asked for money upfront before they would discuss any details. The rest of the context of the email suggests that it is likely a scam (they likely have nothing of value to offer), but I want to put that aside. The actor could or could not have an actual vulnerability to discuss. Does the situation satisfy the general legal understandings of "extortion"? I see that New York State law and this discussion about extortion in the Doha Declaration suggests that it could be, but it might not fit perfectly. There is an implied threat of future harm to the site or business, not by the actor themselves necessarily, that a specific, potentially existential problem exists that anyone could take advantage of. And because all security vulnerabilities are exploited by people, whether by malicious intent, accident, or mistake, then extortion laws that say that the loss/damage could be caused by another, appear to be relevant here. Protection racket discussions seem to also be relevant. We could reframe the situation to something non-technical: PersonA calls PersonB, who is on vacation, and says, "I know you are away from home. There is something wrong with your house. Pay me money and I will tell you what is wrong." Ethics and morality aside, does the situation cross over into a general legal understanding of extortion? This has an impact on how security professionals contact people with whom they have no pre-existing relationship with, to discuss the vulnerabilities they find, while hoping to offer commercial services.
Ethics and morality aside, does the situation cross over into a general legal understanding of extortion? No. Extortion necessarily includes coercion. An offer to tell what is wrong (and from the point of view of the target — only allegedly wrong) is neither threat nor force, therefore no coercion. It would have been coercion (and therefore extortion) if the guy said along the lines "If you don't pay I will exploit the vulnerability, and/or tell a bunch of bad guys about it — they will be sooo thankful to me". Provided that the guy does not say/imply he will do something if not paid, there are no legal issues here.
Assuming that the documents were either true, or Manning reasonably believed that they were true, there would be no cause of action for defamation. Many of the documents disclosed would have been confidential in some sense, but usually a violation of a confidentiality statute has a criminal sanction associated with it, but does not carry with it a private cause of action &ndash; in part, because conceptually, the party actually harmed is considered to be the government and not the person about whom information is revealed. It is also possible that Manning could utilize the state secrets privilege as a defense and have such a suit dismissed on the grounds that a full and adequate defense of the claims would require the disclosure of official state secrets. For example, if a covert agent were murdered due to a wrongful disclosure of information, usually official disclosure of the fact of being a covert agent would be required to prove the case, and that evidence would be barred by the state secrets privilege, effectively barring the lawsuit entirely. Constitutional claims of privacy violations under the 4th Amendment generally relate to the wrongful acquisition of information and not its wrongful disclosure. The constitution bars unreasonable search and seizure, not unreasonable disclosure of information. The only privacy tort that might be applicable is "Public disclosure of embarrassing private facts." (A sister privacy tort, Intrusion upon seclusion or solitude, or into privacy affairs, is directed at the collection of data phase and not the dissemination phase). See Restatement of the Law (Second) of Torts, §§ 652B and 652D. But, this tort raises serious First Amendment concerns and has not been widely adopted. Realistically, this tort is unconstitutional in the absence of an affirmative contractual or quasi-contractual duty not to reveal facts that runs to the person making the disclosure, and in general, Manning would not have that kind of relationship. The classic public disclosure of embarrassing private facts case would involve a lawyer's or psychotherapist's revelations about a client. Also, in the case of the public disclosure tort the basis for damages is largely personal emotional distress and violation of trust, as opposed to damage to reputation, per se. The requirement is that the disclosure be embarrassing or breach of contract, not that it harm someone's reputation since you have no legal right to a reputation that differs from the truth.
Yes, although whether you get any response depends on a lot of factors. Specific, credible threats are much more likely to get a response than &quot;I'm gonna kick your ass, amphibient, you (insert opposing viewpoint/sports team/etc).&quot; The law broken in question would be: 18 U.S. Code § 875.c: Whoever transmits in interstate or foreign commerce any communication containing any threat to kidnap any person or any threat to injure the person of another, shall be fined under this title or imprisoned not more than five years, or both. As you are in different states, this would need to be reported at a national level. This would be done at https://www.ic3.gov/complaint/default.aspx. Whether or not this is the best option depends on what you hope to accomplish and whether the other person is likely to act on those threats.
Financial institutions in the US are subject to regulations that restrict what sorts of things non-licensed employees can talk about with clients and advice they can give about structuring accounts and payments in ways that might avoid triggering money laundering alarms. I think this employee was being cautious about getting into a gray area and phrased the reason they couldn't talk about it poorly. The reason they were restricted from giving you an answer could be a legality, but not necessarily because they are giving you legal advice.
This paper describes a website created to test the hypothesis that nobody bothers to read the TOS, and it contained a privacy clause saying that &quot;we may share everything, and a clause that by agreeing to these Terms of Service, and in exchange for service, all users of this site agree to immediately assign their first-born child to NameDrop, Inc. If the user does not yet have children, this agreement will be enforceable until the year 2050. All individuals assigned to NameDrop automatically become the property of NameDrop, Inc. No exceptions. Since this was not a real webpage, there was no attempt to enforce. TOS is just another kind of contract, so the question is which kinds of contract conditions are enforceable and which kinds are not. It depends on whose laws you are operating under, which explains the use of expressions like &quot;void where prohibited by law&quot;. There are innumerable conditions that could be included in a contract which are unenforceable. A contract requiring a person to commit a crime is unenforceable. Many jurisdictions have laws prohibiting a person from waiving certain rights, for example you cannot sign away your right to be represented by legal counsel in a dispute. There are related &quot;unfair / deceptive&quot; practices laws, which might include meta-conditions that any clause disclaiming liability must be prominently displayed. These are terms that a reasonable person would clearly know in advance are illegal and unenforceable. There is also a concept of &quot;unconscionability&quot;, a finding that a certain condition favors the business to the point of &quot;shocking the conscience&quot;, which may take a deeper legal analysis to evaluate. A requirement to litigate small disputes in California might be deemed unconscionable for a customer in an East Coast state, but it might not be. A typical characterization of an unconscionable contract is one that &quot;leaves one party with no real, meaningful choice and is unreasonably advantageous to the other party&quot;, especially when due to asymmetrical negotiation power. For example, Ellis v. McKinnon , 18 Cal. App. 4th 1796 (employment contract for a salesman, commissions were forfeit if company had not received payment from the customer by the termination of employment). The main case law in the US in this area is Williams v. Walker-Thomas Furniture, 350 F.2d 445, where a customer bought furniture on credit, with a clause allowing repossession of all of the furniture in case of default by the customer. The doctrine is encoded in UCC 2-302. However, &quot;unconscionable&quot; does not mean &quot;I don't like it&quot;. In lieu of statutory price controls, a customer probably cannot avoid paying an agreed on exorbitant price for a product ($100 for a dozen rolls of toilet paper). Here is a bit more legal analysis of unconscionability, which focuses on three factors: one-sidedness, oppressiveness, and likeliness to result in unfair surprise.
You can hire someone to locate the defendant with the information that you have, or you can apply to a court for permission to serve them with process via &quot;substituted service&quot; because their physical address can't be determined. But, in general, better business practice is to not enter into contracts with people with whom you have more than a name that might be false, and an email address, unless you have some means of non-judicial enforcement of your agreement (like the practical ability to shut down access to an internet subscription). If you don't even know if someone's name is real and have done nothing to confirm that then you also have no assurances that they have any assets from which you could collect if you won a breach of contract lawsuit. If you deal with large numbers of people in low value contracts, it may be worth treating the fact that some contracts are effectively unenforceable as a cost of doing business. But, if a contract is important, it was foolish from a business perspective to rely on a contract on that basis alone, even if it is legal to do so.
She could refer this to the Cyrpriot Commissioner for Personal Data Protection, but I would try contacting the company first and telling them to remove her Personal Data from the public website - or delete it completely. If they don't give a satisfactory response, mention the CPDP. This could lead to the data being removed within a few days, while an official complaint is likely to take longer. She may have grounds for legal action which would result in the company being compelled to take down the data (or to close the website), but if your friend is thinking in terms of compensation, what compensation would she seek? If she can demonstrate and quantify financial losses that occurred specifically because of this disclosure there might be a possibility, but I suspect that would be difficult to prove.
There have been cases in the UK where paying someone's legal bills was interpreted as joining their case. So when A with no money libels someone, and B with deep pockets pays A's lawyer, then B risks being held liable for damages if A gets convicted. So B should be very careful. Just giving you money is probably the safest. But attorney-client privilege is between attorney and client. I have been laid off twice with my company asking me to take an employment lawyer and paying for it. (Interestingly each time the bill was exactly the maximum amount the company was willing to pay :-) It would have been absurd if my company could demand information that is under attorney-client privilege just because they paid the bill. Why did two companies pay the lawyers bill? Because that way they ensure that the separation is without problems. The lawyer explained the settlement contract and what it meant exactly. They also checked that the contract didn’t contain anything unacceptable which the company would have fixed. So if I had tried to sue them later I would have no chance to win (but there was no reason to sue). Another reason not to sue was that the company offered I settlement that was very significantly more than was legally required, but if you sued them you would only get what you got in court - most likely less than you would get without suing. So basically they paid to make sure I would have no reason to sue them later.