Can the government force spammers to disclose how they got my e-mail address? My impression is that a large proportion of unsolicited email marketing (SPAM) originates because the recipient willingly provides their address in the course of a desired interaction with a second-party, but in the process unwittingly consents to having their personal information shamelessly exploited, sold and resold to an unlimited number of third-parties. A key factor is that the second-party can make a small profit at no cost (reputational or otherwise), because the SPAM recipients technically gave permission and have no means to determine which entities have exploited their personal info in undesired ways. The U.S. doesn't have very strong anti-SPAM laws. I suspect this is at least partially due to the fact that email marketing regulations would inherently confront issues of free speech, commerce, or others that could give marketers cause for action. So my question is this, could a state or the federal government pass a law requiring email marketers to specify the chain of custody of your personal info, such that a person could revoke permission to others in the chain and/or hold them reputationally responsible?
A Commerce Clause challenge would fail A Commerce Clause challenge seems like a sure loser. Under the Commerce Clause, Congress “has authority to regulate and protect the instrumentalities of interstate commerce,” Gonzales v. Raich, 545 U.S. 1, 16 (2005). Because “the Internet is an instrumentality and channel of interstate commerce” United States v. MacEwan, 445 F.3d 237, 245 (3d Cir. 2006), Congress has virtually boundless authority to regulate its use. Gibbons v. Ogden, 22 U.S. 1, 196 (1824) (“This power, like all others vested in Congress, is complete in itself, may be exercised to its utmost extent, and acknowledges no limitations, other than are prescribed in the constitution.”) A First Amendment challenge would probably fail But as you note, that authority is not boundless, as congressional enactments must still comport with the First Amendment. I would not be surprised by a First Amendment challenge to such a law, but I think it would fail. Commercial speech enjoys less protection than speech by individuals. For instance, although the government may not limit speech merely because it concerns unlawful activity (Brandenburg v. Ohio, 395 U.S. 444, (1969)) or because it is false (United States v. Alvarez, 132 S. Ct. 2537, (2012)). But commercial speech is essentially unprotected by the First Amendment unless it concerns lawful activity and is not misleading. Central Hudson Gas Elec. v. Public Serv. Comm'n, 447 U.S. 557, 563 (1980). And even then, the government has wide latitude to compel commercial speech, as opposed to restricting it: Because the extension of First Amendment protection to commercial speech is justified principally by the value to consumers of the information such speech provides ... appellant's constitutionally protected interest in not providing any particular factual information in his advertising is minimal. Thus, in virtually all our commercial speech decisions to date, we have emphasized that because disclosure requirements trench much more narrowly on an advertiser's interests than do flat prohibitions on speech, warnings or disclaimers might be appropriately required in order to dissipate the possibility of consumer confusion or deception.&quot; Zauderer v. Office of Disciplinary Counsel, 471 U.S. 626, 651 (1985). There are, of course, still limits on the government's authority to compel speech, and the Supreme Court has struck down compelled commercial disclosures that did not deal with &quot;purely factual and uncontroversial information&quot; and did not relate &quot;to the services that [speakers] provide.&quot; Nat'l Inst. of Family &amp; Life Advocates v. Becerra, 138 S. Ct. 2361, 2372 (2018) It's unclear whether a disclosure law must satisfy both parts of that test or only one. If it's only one, an e-mail chain of custody seems sufficiently factual and uncontroversial to survive a First Amendment challenge. If the law has to pass both tests, it would likely come down to the question of whether that chain of custody bears a significant enough relationship to the speaker's services. I can imagine arguments both ways. The states may not impose new limits on spam e-mails. Although the federal government could enforce this law, a state government could not. The CAN-SPAM Act of 2003 sets baseline rules for unsolicited commercial e-mail and permits the Federal Trade Commission to further regulate those messages. Although many people think those laws don't go far enough, the states are generally not permitted to enact any further regulations, because they are expressly pre-empted by 15 U.S.C. § 7707 (“This chapter supersedes any statute, regulation, or rule of a State or political subdivision of a State that expressly regulates the use of electronic mail to send commercial messages”). There are two exceptions to this pre-emption. One permits additional state regulations addressing deceptive communications, and another permits additional state regulations that only incidentally effect e-mail messages. The first option seems weak, but perhaps a state could enact a law requiring any commercial solicitation -- regardless of medium -- to require such a chain of custody. I'd imagine, though, that the most common alternate means of sending such messages (fax, USPS, text message) are also regulated by federal laws that likewise pre-empt state regulation, so I think this could be difficult to pull off as well. tl;dr: The federal government would likely be permitted to impose this law, but a state could not.
The right to free speech is a right that is guaranteed against the federal and state governments only. It is not a right that is secured against private individuals and corporations. It is also neither absolute nor unconditional, as there are a number of exceptions/limits. Alex Jones could not walk into your home and start "exercising free speech" and leave you with no recourse whatsoever to remove him from your home. If you don't consent to him being there, you may legally tell him to leave and have him removed by force if he fails to comply. Facebook etc. are the "homes" of the relevant corporations. They simply told Alex Jones to get out and go somewhere else. He retains his right to free speech; he simply never had a right to speak wherever he wanted. An always relevant XKCD.
Owing to the First Amendment, in the United States your recourse would be limited to civil action based on violations of terms of service (meaning that "the authorities" are not going to knock on their doors to tell them to behave). This is not "spam" (which could be regulated) as the term is generally understood. It is annoying, but probably does not constitute threatening or child porn. It might involve violation of an anti-impersonation law such as this one from Texas, if the offender uses the persona of a real person as opposed to a fictitious person). That law, moreover, does not criminalize simple annoying. Prosecution may be possible in the UK.
Illegal to write? No. Notwithstanding the First Amendment which would almost certainly make a law prohibiting it illegal, writing such things is an essential part of an IT security professional’s toolkit. You can’t protect against worms if you don’t know how they work. Illegal to distribute on an unauthorised computer? Absolutely. This would be a clear breach of the Computer Fraud and Abuse Act.
Think of a website that has gives no option for the users to delete what they have posted -but still the users can delete their account completely. That's easy - this is exactly how all StackExchange sites (including this one) work :-). See for example: How does deleting work? on meta.SE. Is it against the right to erasure mentioned here as a part of GDPR? No, it is not (otherwise StackExchange would be in rather big trouble). The "right to be forgotten" is subject to limitations. Most importantly, it only applies to personal data. Personal data is defined as (GDPR, art.4): any information relating to an identified or identifiable natural person (‘data subject’) If what you posted contains no personal information about you, it is not "relating to" you. The details are complicated (as usual, see e.g. The GDPR: What exactly is personal data?), but "personal data" is things about you (your name, your address, your sexual history, maybe even your IP address). On the other hand, if someone asks how to solve a programming problem, and you write an answer explaining what API to call, that answer is not personal data. In addition to that, even personal data may be retained if the data controller has a need to retain that information. This is also covered in article 4. For example, the controller may retain information "for the establishment, exercise or defence of legal claims" - otherwise you could buy something online without paying, and then ask the seller to forget about your purchases so they cannot collect the outstanding payment. So, in summary: A website will need to allow users to delete or hide personal data that they posted - such as their user profile information, or personal information in their posts. That does not mean they are allowed to delete entire posts - it is enough if personal information is redacted or anonymized. The website may be allowed to retain that information (hidden) if they can show legitimate interest - for example billing information, or posts that are the subject of a lawsuit. The StackExchange network, for example, covers this by allowing users to: disassociate posts from their account delete their account entirely (thus effectively disassociating all posts from personal information) asking a moderator for redaction of personal data
Does criticizing public figures constitute libel especially in a private group? It depends on the specifics, but a priori your description suggests that the defense of honest opinion would be applicable. This is regardless of whether the subject is a public figure and regardless of whether the statements were in private --albeit non-privileged-- communications. Case law surely provides guidelines or precedents on how the details and circumstances of the events would fare on the parties' legal position, but I am not knowledgeable of UK/English law. Does X have a counterclaim for illegally accessing the data? The matter seemingly depends on how the religious leader had or gained access to the data. Even if he gained access by stealing or hacking a device or account, X would not have standing to [counter-]sue unless the device or account belongs to X. Be mindful of the possibility that third party might have made the disclosure to the religious leader. In that case, actionability (if any) of the disclosure only encompasses the third party, not the religious leader. X's intent that his statements stay only among the participants does not necessarily imply that participants' disclosure elsewhere is unlawful.
In general this is protected by the first amendment. It is not in general a problem describing how one can one can do something illegal. But there are special cases to be careful with. You might want to do some research into the limits on free speech. It would be hard to provide an answer that fully covers all your different cases and you would need to be more specific about what illegal activity you want to describe. In describing how to do something illegal, you might accidentally share information that you are not allowed to share. When you post things online, this can be considered as publishing or exporting. Therefore certain export restrictions might apply. Also, It is illegal to publish bomb making manuals, with the knowledge or intent that this information be used to commit a federal crime of violence. See https://www.law.cornell.edu/uscode/text/18/842. There are restrictions on publishing material relating to cryptography without having an export license. Granted, this isn't necessarily related to publishing things that are illegal, but just to give an idea about how publishing/exporting knowledge can causes problems. See https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States ITAR (International Traffic in Arms Regulations) sets restrictions on what you can publish about arms. What you publish can't be “directed to inciting or producing imminent lawless action.” See for example https://en.wikipedia.org/wiki/Brandenburg_v._Ohio. One might imagine that you could get into trouble if someone interprets what you do as inciting or producing a lawless action. It might sound obvious, but you want to make sure that you have the right to share the information that you have. The information that you are providing might be copyrighted in some way.
united-states If there is more than 1 email account annoying you online, do you need to obtain separate court orders to identify each one, or is one order sufficient? A judge could order an email provider to unmask multiple accounts with one court order. Judges are not really restricted in the number of things they can do per order, as long as it's within their jurisdiction. What if one of the accounts you’re naming is determined to not be harassing? Then the judge would be unlikely to order that one unmasked. It wouldn't prevent the others from being unmasked, if the requirements for such an order to be issued were otherwise met.