Is it legal to sell zero-day exploits? Can someone who discovered a zero-day exploit in a program sell the information, and does the applicable jurisdiction depend on his location, the buyer location, the location of the developed of the product that the exploit targets, or something else?
It might possibly be illegal. For criminal law, usually you need to obey the laws of three countries: The country you are a national of (by personality principle) The country from where you make the sale (by territoriality principle) The country that hosts the attacked interest (by territoriality principle) Then it depends on the jurisdiction (and other factors) whether the sale is legal or not. I'll use the example of my country, Czech Republic. There is a crime called "Unauthorized access to a computer system or data storage device". For example, you commit this crime by exploiting a vulnerability in a web application and copying the web owner's data on your computer. It is also codified that whoever wilfully facilitates the committing of a crime by providing the criminal with resources (such as the exploit) is considered to have also committed the crime. For this to apply, you must have known or expected that the exploit will be used to commit a crime. The courts would decide this.
There are a few ways that this could be illegal, but barring those, there is nothing per se illegal in doing what you describe. It could be a TOS/contact/licence violation to sniff the traffic: Use third-party software that intercepts, collects, reads, or "mines" information generated or stored by the Battle.net Client or the Game(s) The protocol could be protected by patent. (U.S. Patent 5,883,893) The use of the reverse engineered protocol could be illegal (fraudulently connecting to a company's server while posing as an authorized client).
There are vendors providing software to facilitate this sort of task. Avalara is perhaps the best known, but I don't have any experience with it and couldn't say whether it's actually any good or not. But the bottom line is that in a destination-based sourcing regime, sales taxes must be computed based on the address of the destination, not city or ZIP code associated with that address. As Avalara has noted, this is a giant hassle, but it's nonetheless the current state of the law. Of course, this assumes the seller has sufficient nexus with Louisiana to trigger a duty to collect sales taxes in the first place. From the question, it is not clear whether this is true.
You seem to have a solid understanding of the ePrivacy implications, but lack a fundamental insight: your organization does not have a right to achieve its mission or a right to disseminate unwanted marketing. But other people do have a right to not be subject to excessive marketing. Of course, reality is more complex, so it's probably not entirely impossible to do marketing. In your point 1, you note that some EU/EEA/UK countries distinguish ePrivacy protections between consumer and business subscribers. You can research the exact rules in the potential customer's country. This may allow you to email corporate/business accounts. I would strongly advise against messaging via Linkedin if there is a chance that the person is using that account for personal purposes like networking or hunting jobs, not just for conducting official company business. ePrivacy has markedly different rules for email marketing vs phone marketing. Whereas there are pretty strict rules for electronic messages and robocalls, manual cold calling can be OK from an ePrivacy perspective. However, many EU/EEA/UK countries have rules that go beyond ePrivacy, and may have a kind of do-not-call registry that you must respect. Of course manual calls take more effort than spamming emails, but recall the above point that you don't have a right to spam other people. Phone calls are probably the most appropriate approach when the company lists individuals' phone numbers on its website. This will at least give you a few seconds of attention with a real human, more than you can expect from an email that is likely to be caught by spam filters. Marketing via physical mail tends to have very lax rules. Note that every company/business that has a website will have to disclose its contact details including an address there, so this information is easy to acquire. However, chances are low that anyone would seriously engage with that marketing. You can consider alternatives to direct marketing, so that interested companies eventually come to you. Things like press releases, writing guest articles in industry publications, speaking at relevant conferences, working on search engine optimization, buying ads. On the GPDR aspects: GDPR and ePrivacy overlap, and it is necessary to comply with both sets of rules (GDPR likely applies here via Art 3(2)(a)). But where they potentially contradict each other, ePrivacy as the more specific law has precedence. For example, ePrivacy overrides the default GDPR legal basis rules when it comes to email marketing to existing customers (opt-out basis, no consent needed) or to using cookies (needs consent unless strictly necessary). Information that relates to corporations is not personal data, but information that relates to individual employees or to sole proprietors would typically be personal data. Since you are unlikely to obtain consent for using this data, you would need an alternative GDPR legal basis such as a &quot;legitimate interest&quot;. Relying on a legitimate interest requires that you conduct a balancing test, weighing your interests like marketing against the recipient's interests, rights, and freedoms. Core question in this context is whether the data subject can reasonably expect their personal data to be used like this, taking into account the nature of their relationship with you. Since there is no pre-existing relationship, claims of a legitimate interest are weak to start with. However, it may be possible to argue that when a company makes employee contact details available via its website (not LinkedIn!) then relevant marketing can be reasonably expected. I would rather not rely on such arguments, though.
Whoever "derived" the illegal derivative work most likely has copyright in his derivations, unless they are not worth copyright protections. Say I take the Harry Potter books and add a few chapters and try to sell it - that's copyright infringement of course, but I have the copyright on these additional chapters. However, I don't have the right to allow you to copy the derived work. And even if you have the right to copy the original work, you don't have the right to copy the derived work because it is a different work. I could extract my changes, and allow you to take them and do with them what you like. You could then create an illegally derived work yourself. I couldn't sue you, but the original copyright holder could. To the comments: One, a work and a derivative of the work are not the same, so even if you have the right to make a copy of a work, that doesn’t give you any right whatsoever to copy a derivative work - they are not the same work. Two, the copyright holder has the exclusive right to control copying and the creation of derivative works. If the copyright holder doesn’t want derivatives to exist, then creating them, copying them etc. is always copyright infringement.
In the US, "insider trading" includes both legal and illegal versions. When a corporate employee buys or sells shares of their company, they are insiders and they are trading (there is a requirement to report to the government). The illegal version involves breach of fiduciary duty or confidence. The relevant section of the federal regulations is 17 CFR 240.10b on "Manipulative and Deceptive Devices and Contrivances", and you will note that the section does not rely on the term "insider" in the law part, instead it directly characterizes what acts are illegal. Thus it would not matter, from a legal perspective, if someone considers you an insider. It is illegal to trade in securities using a “manipulative, deceptive, or other fraudulent device or contrivance”. This relates to what is commonly known as insider trading via rule 240.10b5-1, by defining as manipulative and deceptive trading on the basis of material nonpublic information about that security or issuer, in breach of a duty of trust or confidence that is owed directly, indirectly, or derivatively, to the issuer of that security or the shareholders of that issuer, or to any other person who is the source of the material nonpublic information (emphasis added to focus on the core requirements). Whether or not you have a "duty of trust or confidence" is determined by common law standards, that is, it depends on how courts have ruled on similar matters. For instance if the CEO of Apple tells you "Our computers explode and it's gonna be on the news tonight, the stock is gonna tank, but it would be illegal for you to act on that information", then it would be illegal, because you are aware that the CEO has a duty to not use that information (thus you "inherit" the duty). This also holds if he doesn't tell you that acting on the information, since it is expected that you know that the CEO of Apple could not legally act on that information (even if in fact you are unaware of the law -- ignorance of the law doesn't get you anywhere good). However, if you are unaware and could not know that the person making the factual disclosure is divulging information that he has a duty to shut up about, then you might not get prosecuted.
As you've presented them, I doubt the functions are protected by copyright in the first place. Originality is one of the threshold requirements for copyright protection, and it demands that the work in question be independently created by the author, and that it possess some minimal degree of creativity. If you're talking about programming at a level so basic that the function truly must be created in a particular way, there is no originality in simply following the instructions. And even if there's some wiggle room, but the language you used has likely been independently replicated by many programmers, that's still not original enough to be copyrightable. What you want to watch out for, though, is the possibility that they've been combined into an original arrangement that is protected. I don't know enough about how copyright law is applied to code to say where or how that line is drawn, but my instinct would be that it could be a fairly low threshold.
When you license your IP (like a song) you can specify the terms and conditions of its use by the licensee, including revenue shares from any derived work. However, if, as your comment suggests, you grant an "informal" license, and later decide that you want to "firm things up" with a license having different terms, that's a matter you would have to either negotiate or litigate with your counterparty. If you want a common reference point for negotiation of this sort of license, you might have a look at compulsory license terms.