Can I use a workaround I developed to bypass the internet filter at work? I found a workaround (by writing some code) to bypass the internet filter at work. Is that considered hacking? Or perhaps violating the company's rules. Am I the one to be blamed for finding a loophole or is it the filter-team to blame since they didn't do a very good job blocking them.
It's almost certainly violating the company's rules, and yes, you can get into trouble for that (in the sense of an internal disciplinary matter). Whether it's a criminal hacking will depend on a) what you did; b) where you are ... but I wouldn't rule that possibility out.
In such a case the person who bypasses the terms knows that use of the site is conditioned on agreement to the terms, and has taken an explicit action to continue past the terms and use the site. I suspect that if a dispute were to arise where this is relevant, it would be held that taking such action was legally equivalent to clicking "I agree". But I don't know of any court case on this point, and i can't be sure what a court would do. If having intentionally bypassed the terms, such a person tried to raise his or her lack of consent to the terms as a defense to some obligation imposed by those terms, such equitable concepts as "unclean hands" and estoppel might be raised, since such a person, in effect, leads the other party, the site owner, to believe that s/he has accepted the terms, I suspect that such a person will be treated as having accepted them. If this becomes at all common, I suppose that the designers of such sites will in future store a record of such consent being given, and not allow the user to proceed unless it has been.
Would any offence be committed for: Having this on your person? Buying or selling this? Leaving it around for people to plug in to a computer? In the abstract, I don't think that this conduct would violate either Section 36 of the U.K. law or U.S. law, although, obviously, purposefully destroying a computer itself (i.e. actually using the device without the consent of the owner of the computer) would violate many U.K. laws and would also violate many U.S. laws at both the state and federal level. I also don't think that possession or buying or selling this product would be a crime absent some intent that it be used illegally, in which case there might be an "attempt" to commit a crime offense, or an offense that would make one part of a conspiracy to commit a crime. In the "leaving it around" example, there is arguably an intent to use it to harm another improperly, although the phrasing is ambivalent. While many statutes in the U.S. criminalize possession of burglary tools, or drug paraphernalia, sometimes with an associated intent element (although even these crimes often have an express or judicially implied intent to use element), I'm not aware of any statute that criminalize possession of tools for malicious destruction of property. So, if the tools aren't possessed or used in a manner intended as a step in the facilitation of a crime, I don't think that any law is violated. So far as I know, the U.S. does not have a counterpart to Section 37 of the British statute cited above (it isn't a terribly easy thing to search for to definitively rule out the existence of such a law because federal law has many uncodified crimes in unexpected statutes and there are many sets of state criminal statutes, not all of which are codified either). The example giving in the comments by @gnasher729 of possession of a hammer which could be used to do the same things that this object could be used to do is instructive. Arguably, this USB-like tool is more specifically targeted at malicious conduct. But, for example, when I used to work as a radio news reporter, we had a machine that was basically a high powered magnet that was specifically designed to destroy all information on magnetic media. This was, in part, so that it could be reused, but it was also so that confidential interviews wouldn't fall into the wrong hands once they were no longer needed, in much the way that one might shred paper documents. It isn't so implausible to think that a device like this one might be necessary for individuals or firms with national defense secrets embedded in their hardware and software to have on hand in order to destroy a sensitive computer in order to prevent a security breach, if necessary. In a case like that, leaving one of these devices around the office unlabeled might be negligent, but wouldn't have the intent necessary to be an intended crime. And, it is hard to imagine that the device itself, which seems pretty simple, would itself involve any technology that is a national security secret, so it probably wouldn't violate export control laws. Of course, possession, purchase or sale of such a specialized device, or leaving it around unlabeled would certainly be powerful evidence of an intent to use the device in a wrongful manner, and hence, of an attempt to commit a crime. Indeed, possession of such a device or purchase of one might very well be sufficient to establish probable cause to seize the device and arrest the person holding it on charges of an attempt to destroy a computer. But, this device would be merely powerful evidence of an intent to commit a crime, rather than something that is a crime to commit in and of itself. There are no international laws that govern this kind of thing. The only international laws applicable to individuals pertain to war crimes and nuclear and chemical weapons. Even then, most international laws direct member nations to adopt domestic laws on the subject rather than being self-executing.
This would be illegal in Australia (Criminal Code Act 1995 part 10.7: any unauthorised impairment of electronic communication to or from a computer), the US (Computer Fraud and Abuse Act) and any other jurisdiction that I can think of. There is no exception allowing vigilante action in case a person has a reasonable belief that the material on a website is offensive or illegal. In general, the law does not allow immunization against criminal prosecution in case the victim of an attack is himself a criminal. Only the government has the right to punish criminals.
Congrats, you've done well to minimize your processing of personal data. But I think you're still processing personal data, and are subject to the GDPR. Serving a website necessarily involves processing an IP address. This IP address will typically be personal data. While you are not storing the IP address, the GDPR's definition of “processing” extends beyond storage and pretty much covers doing anything with that IP address. As far as I know this is not an entirely settled matter, but it's better to err on the side of caution and to assume that you are in fact performing a processing activity. Even a static web page can easily lead to additional relevant processing of personal data, for example if the HTML embeds resources from third party domains. Since your website is clearly targeted at the public, it does not fall under the GDPR's exception for “purely personal or household” purposes. So I think you do need a (minimal) privacy notice that contains at least the items mentioned in Art 13 GDPR. The main reason why some people try to avoid posting a privacy notice is because it must disclose your identity and contact details. But in Germany, that information has to be provided anyway due to the Impressumspflicht. As part of your GDPR compliance obligations, you must protect how data is processed by others on your behalf. A hosting provider will typically act as your data processor. For this to be legal, you need a contract / data processing agreement that fulfills the conditions in Art 28 GDPR. This contract binds the data processor to only use the data as instructed by you, and not for their own purposes. European hosting providers sometimes include the necessary terms in their terms of service / AGB, but you should check to make sure. Netcup expects you to accept their data processing amendment in your account settings. In the hypothetical case that you were not processing any personal data at all, the GDPR would not apply and it wouldn't require you to post a privacy notice. Other laws might still have information obligations, notably the German TMG and TTDSG.
I think haveibeenpwned would be legal in the EU because it carries out a task in the public interest (Art. 6(1)(e)), and it shares no more data then necessary, for example you can search for a password, but it would not show you the emailaddress which belongs to that password. It would also be legal for you to hold a copy of a leaked database, but only if you have a legitimate interest (Art. 6(1)(f)) to have it. Being a security company does not change that, but finding a legitimate interest might be easier. If you have a legitimate interest to hold a copy of a leaked database, it does not mean you can use it in any way you like. For example testing if the password still works, is very likely illegal everywhere in the EU. But I'm not familiar with the UK laws.
The companies really need to speak to an IP lawyer as this question is seeking specific advice which this site is loathe to give out for fear of compouding issues. The answer would depend on the license agreements and enforceability in various jurisdictions. According to https://social.msdn.microsoft.com/Forums/vstudio/en-US/0368d7ee-0eb3-4e3e-a143-4410969a15bb/eula-for-vs2010?forum=vssetup Microsoft says you cant rent out the software - but this applies to the "Pro" version - I could not find anything on the "Premium" version - so most likely Microsoft to have some clam. The flipside is how enforceable this EULA is - and this would probably vary from jurisdiction to jurisdiction. It would be a very, very good idea to speak to a lawyer before letting Microsoft come onto the premises - as "inviting them" to do this is almost certainly not going to improve the Asians company's case and will allow Microsoft to go fishing further and make it easier for them to expand on and collect evidence should they decide to pursue the matter.
No AFAIK there is no such legal requirement. Why this company told you there was I can’t speculate. But I will. There may be under contract with MicroSoft to put their OS on every box they sell - that would be a legal requirement. Or the just don’t sell boxes without this and they employee told you it was a legal obligation to get out of the conversation.