Is it illegal to download data from a misconfigured server that is open to the public? Bob has a website that he hosts online and is open to the public. A portion of the site has &quot;members only&quot; data. However, Bob implemented his security protection of this sensitive data incorrectly. So when Alice clicks the link to view the protected data, instead of being prompted to login or sign up. She just gets access to the data. Has Alice broken the law if she unintentionally views/downloads the members only data?
The most apparent potential offences would be under 18 U.S.C. § 1030, but these require the mens rea of &quot;knowingly&quot; or &quot;intentionally&quot; doing things without authorization, or doing so &quot;with intent to defraud&quot;, etc. See also the Department of Justice's manual entry on this family of offences. Particularly relevant is this quote: As part of proving that the defendant acted knowingly or intentionally, the attorney for the government must be prepared to prove that the defendant was aware of the facts that made the defendant’s access unauthorized at the time of the defendant’s conduct. Given your stipulation that the person has unintentionally viewed or downloaded the material without authorization, this would not be a violation of 18 U.S.C. § 1030.
You are right that a visitor of a website does not expect to be tracked upon opening the website. But when using Google Analytics configured in the way explained in my other post, the visitor is not tracked. At least not in a way which violates the GDPR. You worry about the cookies. I also found this article which also does and suggests to either: change the _ga cookie to a session cookie, so it will be removed when the browser is closed. To do this, set the Cookie Expiration variable in your Google Analytics Settings to 0. completely disable cookies. (GA does not require cookies). To do this, set the storage field to none: ga('create', 'UA-XXXXX-Y', { 'storage': 'none' }); If you do not disable cookies, cookies can be used for tracking, which is more general defined in the GDPR as profiling. Profiling is defined in Art. 4 GDPR as: ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements; Art. 22(1) GDPR disallows profiling. Therefore in the settings menu from Google Analytics you have to disable data sharing and data collection. So data will only be used for the analytics function. But because you have configured to Anonymize your visitors IP Address, the part of the IP address used for this, is no longer considered personal data. This is because approx. 250 other users share the same part of the ip address which is stored, so data is not distinguishable between those 250 users. The anonymisation used by google is currently considered good enough. At least by the Dutch DPA. This might change if someone proves it is not good enough anonymized. Note that I am not a lawyer either, but I have read from multiple experts that analytics can be a "legitimate interest", the same way marketing can be a legitimate interest. This way configured the privacy impact is considered very low. It is also very important to note that a DPA consideres GA Google Analytics compliant. Even if a court would not agree in the future, you are acting in good faith if you follow those instructions, so you will probably not be fined. The DPA does currently not suggest to change the _ga cookie to a session cookie, or disable cookies completely. Note that the GDPR does not require doing anything to make it technical impossible to track someone. If a website has access to the data to track someone, but "promises" not to do that, that is fine. And rules regarding the usage of cookies in general, is not part of the GDPR, but (currently) part of the ePrivacy Directive. Only the way to ask for consent for storing cookies is defined in the GDPR.
Yes such a username would be personal data. It is information that relates to an identifiable person. In this context,a person isn't identifiable only if you can infer their real-world identity, but already if you can single out one person's records. Thus, your random IDs and any linked information would be personal data as well. Just because something is personal data doesn't mean that processing it is illegal. It just means you need a legal basis. That could be necessity for performing a contract with the data subject (like saving game progress), a legitimate interest, or consent. Taking into account GDPR principles like &quot;data protection by design and by default&quot;, it could be sensible to hide a players stats from the leaderboard until they give consent. On the other hand, you may have a legitimate interest to provide leaderboard data for ranking/comparison, especially if the leaderboard entries are pseudonymized. In any case, it should be clear to the users which information is visible to others.
If you aren’t the intended recipient of the password-protected file: StGB § 202a makes it illegal to access this file StGB § 202c makes it illegal to obtain (e.g., by brute forcing) the password for this file, if you intend to access the file that way (in the sense of § 202a) (this is the so-called hacker paragraph) If you are the intended recipient, this law doesn’t seem to apply, and it shouldn’t be illegal to brute-force the password.
Laws against such actions are not stated in terms of popular and fluid concepts like "computer virus", they are stated in terms of clear concepts like "unauthorized access". There are federal and state laws against this. This web site lists and links to all of the state laws on the matter. There is also a federal law: a detailed legal analysis by DOJ is given here. There are some limits to federal jurisdiction, for example "protected computers" include "computers used in or affecting interstate or foreign commerce or communication". The term "affecting interstate or foreign commerce or communication" is widely used in federal law, and can be used to prohibit growing feed for your own animals. Anything that you "send" clearly affects interstate commerce (the internet is internationally connected). 18 USC 1030(a) says Whoever ... (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains...(C) information from any protected computer Essentially, a computer connected to the outside world is protected. The key here is "without authorization". If you authorize MS to report back stuff about your computer, that is not unauthorized. It may not be possible to use their product without giving such authorization, in which case you can use a different product that doesn't require that you grant authorization. There is also the possibility that some software producer has technically violates the law because they think that it's okay for them to access the computer as long as they do no harm. Typically, people are not aware that they have granted software publishers access to their computer. The concept of "harm" is pretty much irrelevant to computer-crime criminal law. It would be relevant, though, if a plaintiff were to sue someone for sniffing around their computer: then you'd have to show that you were damaged.
There is no general prohibition against taking down material, even non-infringing material, which is posted by some person, but there is a risk to the service provider. Abstracting away from the specifics of github, a Provider has some agreement with the User whereby User rightfully makes Stuff available on Provider's site. Arbitrarily removing Stuff (in violation of the usage agreement) may cause damage to User, who may sue Provider, and Provider will avoid that if possible. DMCA protects Provider from copyright infringement suits by Victim, providing the proper DMCA procedure is followed, and it allows Provider to remove Stuff without fear of getting sued by User (17 USC 512(g)). This protection is not available if the takedown notice is not proper. (As a case in point, the entire series of Harry Potter books is still out there freely on the internet, because only the rights holder can demand a takedown, and the rights holder seems to not be concerned).
I believe the author has published it online. I agree. It is posted at his publisher's website. However, I am unsure if I'm allowed to read it. This answer assumes you are in jurisdiction whose copyright laws is based upon the Berne convention (i.e. the civilized world + USA). Assuming it was the author published it online, it is perfectly legal to read it. Technically, the author is performing his work by putting it online, and by reading it, you are just enjoying his performance. Also, if you are in a jurisdiction with an explicit exception from copyright for personal use, or where fair use allows making copies for personal use, it would also be legal to download it, or to print it on paper (but for personal use only). As for downloading and printing for non-personal use - that is not legal in Berne jurisdictions.
Your code is considered free speech (Bernstein v. United States) and you have allowed the use of the code via the MIT license. Since the application of your code is very generic and is not specifically targeting anyone. You probably are not criminally liable. This is simply writing a "Proof of Concept" for security testing purposes. That same way Metasploit, Nessus, and Nmap have actual exploit code but are considered tools of the trade. Now if you go around using your spyware on non consenting victims. You might get a visit from some people with guns and badges that have 3 letters on them.