How does the FBI seize websites if they cannot use the law? After doing some research about websites that have been taken down like Silk Road I have been extremely curious about the procedure that the FBI does to take down a website from the Internet. How do they do it if the website is hosted in another country for example? Do they just contact the hosting company and blackmail them? Does the FBI "hack" the websites they cannot seize? My question applies for both Dark Web and Clear Web websites. I understand that is much easier for a government entity to just use the law for their purposes but that's not always possible...
Hacking a website to take it down is not effective; the target can simply regain control of their machine or restart the service somewhere else. The objective of the FBI is to make arrests and obtain convictions, not play whack-a-mole. When the FBI targets a website and its operators there are a number of approaches that it can use, depending on the circumstances. For clear-web sites one simple approach is just to seize the domain name. When you type badsite.com into a web browser a system called DNS looks up the name in a distributed database and from that gets an IP address. The DNS database is managed by a number of national and international authorities, and most national authoritities will cooperate with legal requests from the FBI, possibly routed through INTERPOL or via a Mutual Legal Assistance treaty. Of course there are some countries that won't cooperate, and this on its own doesn't help the FBI to arrest anyone. The FBI can use an IP address to find out where the physical servers are located. If that is in the US then they can simply go and seize those servers as evidence, or use a subpoena. If it is outside the US then its back to INTERPOL or Mutual Legal Assistance. Servers on the "dark net" use TOR to bounce the packets around the Net a few times. This hides the IP addresses of both servers and clients, so the challenge for the FBI is to find out what the IP address of the target machine is. Once they have that they can proceed as normal. Getting the IP address generally means hacking the target machine via TOR, and then finding the IP address once inside. If the DNS and servers are hosted in a country that won't play ball with the FBI, well that is just too bad. The FBI can carry on investigating of course, and if someone running the website ever travels to a country where the FBI can get them arrested then they will do so.
If it was something important to the owner, they would file injunctions/suits against everybody that they find the code in, and make those very public. This isn't unlike what the RIAA did to individual downloaders of pirated music files, filing over 18,000 lawsuits. They could subpoena GitHub for information related to IP addresses for who downloaded the code and go after them. It is unlikely that they would get a financial award but they could have the court order them to stop using it. Eventually the RIAA found that filing these lawsuits was more trouble than it was worth and started going after the internet service providers. These reduced the number of lawsuits and forced ISP's to moderate its own users, blocking some sites and protocols that programs like Napster relied on. Basically they shifted responsibility from themselves to the ISP's.
Yes a company can be sued (since anyone can sue anyone). But in order to win a lawsuit, you have to have damages as a result of some action, AND you must prove that the action was done with intent to harm or was otherwise negligent. So following your website example, a lot of things would have to happen: The website would have to be hacked. If the passwords are encrypted instead of hashed (which still qualifies as "plain-text" once they email it to you), the hacker would have to figure out how to decrypt the passwords. (Which a good hacker could probably do.) The hacker would have to take those passwords and do something with them that causes damage to their owners. Even if all of those things happened, you would still also have to prove negligence on their part which would be pretty difficult to do because the flaw that was hacked would be the focus of negligence discussions moreso than what was stolen. That being said, if your goal is simply to get them to fix the problem, rather than receive monetary damages, then you could still sue for an action to be taken. You'd have to pay by the hour for the attorney since they wouldn't have a chance of winning monetary damages. But in all likelihood the website owner, upon seeing the lawsuit, would fix the problem before it gets to court, so I could see that having the desired effect. That is if you think it's worth the cost of filing the lawsuit in the first place. Perhaps you could save yourself the cost of an attorney and just threaten to sue if they don't fix the problem.
From my open-source research it seems that law enforcement did not use any coercive powers, such as a subpoena or warrant, in the following case but &quot;covertly&quot; uploaded a suspect's DNA profile in order to identify familial matches for further investigation. So it does show that (in California at least) evidence may be recovered from privately run genealogical databases without the suspect's knowledge or consent depending on which site is used. Joseph James DeAngelo, Jr. Known as The Golden State Killer, Original Night Stalker (amongst others) Thirty-two years after the ending of his killing spree, and 45 years after the beginning of his crimes, DeAngelo was finally arrested on April 25, 2018 ... DeAngelo had been identified four months earlier as the main suspect, when DNA from an ONS [Original Night Stalker] rape case was uploaded to the personal genomics website GEDmatch. With help from a genealogist, Paul Holes (a sheriff investigator who worked on the EAR-ONS cold cases) and an FBI lawyer constructed a family tree based on GEDmatch's results and eventually narrowed the list to DeAngelo. After a DNA sample was surreptitiously collected from the door handle of DeAngelo's car, it was matched with samples related to the Golden State Killer's crimes. Source However, according to the UK's Biometrics and Forensics Ethics Group (BFEG): This process of uploading DNA from a crime scene in the ‘Golden State killer’ case to GEDmatch violated the terms and conditions of use. These terms stated that the person submitting the DNA had to declare that; it was their own DNA; or they were the legal guardian of the DNA donor; or they were otherwise authorised. But I cannot see if this was ever challenged by DeAngelo's defence. The BFEG goes on to say that different sites and different jurisdictions have different requirements: 23andMe, AncestryDNA and MyHeritage do not allow law enforcement use of their databases without a warrant. FamilyTreeDNA offers an ‘opt-out from law enforcement matching’ possibility, and all European users are automatically opted out in line with the EU General Data Protection Regulation (GDPR). Contributors to GEDmatch, which allows law enforcement use of ‘public’ profiles with permission in serious cases, must actively opt in to law enforcement matching.
If you are charged under the laws of Estonia (or Australia or Thailand or the UK) then the laws of the USA have no relevance whatsoever. It makes no difference if you are a US citizen, if the alleged crime happened in the USA or was perpetrated against the USA. If nation X has jurisdiction then you are tried under the laws of nation X. That is what sovereignty means. As to your specific example, Facebook does business in Estonia, therefore they are subject to Estonian law, as a US corporation they are also subject to US law and the law of every other jurisdiction they operate in (see why they need big legal departments?). If a legitimate Estonian warrant was served on them to disclose metadata or anything else then they are legally obliged to do so or be in contempt of court. Oh, and by the way, the first amendment right to free speech does not give you a right to anonymous free speech.
Since you don't say which country you're in, it's likely that you're interested in United States law. You are probably in the clear here, though you're getting close enough to the edge of breaking the law that I wouldn't be confident about not being prosecuted and/or convicted. The relevant laws in this case appear to be 18 USC 471, 18 USC 472, and perhaps 18 USC 514. All three of them begin "Whoever, with the intent to defraud...". It's questionable whether creating counterfeit money as a burglar decoy counts as defrauding the burglar.
Copyright almost certainly exists in the images, since presumably someone took those pictures and so they would own the copyright of those images. However, that doesn't mean you don't own the film, you just that don't own the copyright. You can have it developed to see what's there without copying the images. Just tell the developer you only want the film developed and for no prints to be made. If there's child pornography you could end up in a lot of hot water. While you'd be innocent of any crime, if the developer reports the images to the police you'll have to convince them that you had no idea what was on the film. It's extremely unlikely that there's anything untoward on the film however. I'd note however that unless the film is only a couple years old then it's likely the pictures have faded significantly. If it's ten or more years old, there might not be anything recognizable.
It is probably illegal under Indonesian law for you to launch a cyber-attack on a website that you believe violates Indonesian law, just as it is illegal for you to shoot a person for fraud. The Indonesian government reserves the right to judge guilt or innocence, and to mete out punishment, within Indonesia. It is definitely illegal under US law, also UK law and so on, to launch a cyber-attack on a website for some reason, so you can be prosecuted under the laws of that nation. You should then be concerned with the Law on Extradition (1979), noting that there might be a treaty but also Indonesian law allows extradition on the basis of the interest of Indonesia (as judged by government officials). Indonesian nationals do not enjoy immunity from extradition (as is the case in some countries). There is no extradition treaty between Indonesia and the US; there was one between the UK and Indonesia but I cannot determine whether it is still in force.