Is it illegal to bypass user agreement window? I have a download page with many files. If a user clicks on the download button of a file, then a window with user agreements shows, and you can only download the file by pressing the I agree button, then I send the word allowed to the server so that it knows the user accepted the agreements. Then the server initiates the download, otherwise I send notAllowed and nothing will happen (simplified). However, It is easy for users to bypass this agreement window and just send allowed to the server without even seeing the user agreement window. (for more technical details click here) Questions: Is this considered as a cyber crime if they do it intentionally? Are they automatically accepting the user agreements if they initiate the download this way?
Your question has two distinct aspects which have to be considered separately: criminal law and civil law. I will give an opinion on both aspects, but first I have to give you a word of warning: This case is not clear in the sense that the law can be immediately apply. For a full answer you need the services of a practicing lawyer who does the necessary research. I have a degree in German Law and I have had some practice in IT law, so I know what I am talking about, but I am currently not practicing it and I have done no research for this case. So please, pretty please, don't base any important decision on my opinion. It is a mere guidance, not more. Criminal Law The German Criminal Code (StGB) specifies two cyber crimes explicitly: Computer Fraud (Computerbetrug, § 263a StGB), which you violate when you gain some illegal monetary advantage using a computer, for example a hacker using your stolen credit card data to transfer funds to his account. Computer Sabotage (Computersabotage, § 303b StGB), which applies when you cause damage with a computer, for example a hacker attacking the power grid. The second option clearly does not apply here, but the first one could. That would depend on the answer to a couple of questions, most importantly if a user would gain some monetary advantage at your expense and if that advantage would be illegal. The first of these questions (advantage at your expense) already does not have a clear and universal answer. As it is quite common with fraud, this criminal law question has a civil law aspect (more on that on part two of the answer). The two ways how this could create an advantage to an attacker world be... A contract would not be enacted between you and the attacker, but he would take advantage of you believing in the contract's validity. This option would though probably not apply here, judging from the (spoiler alert) civil law part of the question. A valid contract would be created, but the terms and conditions would not apply and that would cause an illegal financial advantage for the attacker at your cost. Since the base contract would still be in effect and that comes with the obligation to pay, that advantage would have to be in the terms and conditions not applying. You can construct such a case, but that would depend on the terms in question, so there can not be an answer here. There is though a good chance that the terms would still apply (see below), so there will probably be no damage. The other aspect is if this advantage would be through illegal use of the system, which is an interesting question in your case, since the link is publicly accessible. But, then again you can also fake a POST, so you can argue that it is always possible to make the terms not appear. An aspect to be considered though, is that merely attempting computer fraud is already an offense. An attacker who thinks he can gain a monetary advantage from such an attack could be still punished, even if it is not even possible to commit the crime due to the circumstances (this by itself is an interesting question in criminal law). The bigger danger that I see is that your solution makes it easy for an attacker to make their own site and then use your public link to book on your site (in a man in the middle attack). That would clearly be an offense, but it would be the attacker's not your client's. But since your success depends on the trustworthiness of your site, I would recommend to look for a safer solution (such as POST with https). To summarize that part: There is a possibility that accessing the site in the described way is a crime, but I would say it is rather not due to the lack of damage. It is though possible that an attacker still commits a crime by attempting such an attack. You should in any case make your site safer to make it harder to commit MITM attacks. Civil Law The civil law side is whether the terms can be accepted in the described way. This is a case for the law of general terms and conditions (Allgemeine Geschäftsbedingungen or AGB). In a few words, for AGB to apply, the have to be notified to the client and he has to accept them. If your site is used how it is supposed to be, both conditions are met. In the (invalid) way you have described, the first condition is in question. Since the user knows that using the described URL means accepting the terms, I would consider the second condition to be satisfied. So how can the terms apply if the user has not seen them? In case you provide no shortcut to the accepted link and you also prevent that it can be found in another way (e.g. through a search engine), the direct link would be equivalent to someone signing terms and conditions without reading them, although he has had a chance to do so. That would still make the terms apply, because the client would have been given the chance to read them, which is the only thing the seller needs to do. So chances are that your terms would still apply (thus negating the financial advantage necessary for a crime). However, AGB law is a complex subject that is generally handled by specialists. Any opinion of someone who is not such a specialist has to be handled with care. That includes my opinion.
People running web servers are generally liable for contributory culpability, when some user breaks the law by putting the material on the server. There are legal mechanisms for relieving the server guy from this burden. The best-known mechanism is "DMCA takedown", where you publish contact information so that an offended person can serve up a proper legal claim that you are distributing material that they own copyright to. If you follow the rules, you may enjoy "safe harbor" protection against contributory liability: one of the requirements is that you have to take infringing material down. The specific requirements can depend on the nature of the liability and jurisdiction, but generally involves a "hands off" involvement where the person has no knowledge of what's going on on his server. So just disclaiming responsibility does not work. There are other more serious violations, such as distribution of child porn or transmission of top secret information. Jurisdiction is not totally central to internet questions, and I could sue you (the server guy) in US courts, or (depending on the offense: copyright infringement of a particular item) in UK courts. Nailing this down specifically to Sweden is harder, but recall that The Pirate Bay had a whopping judgment against them.
The section you quote as clearly saying a thing is not clearly saying the thing. However: you cannot pass on or resell any license keys seems to say a thing clearly. However, one could argue that it's the sharer of the account who is in the wrong, and not the person receiving and passing on the account. I'd say that that piece of the agreement, combined with this: must not... let other people get access to anything we've made in a way that is unfair or unreasonable says that, yes, they are out of bounds.
Forget about copyright or EULAs. In the UK this would be illegal under the Computer Misuse Act (1998) and you could be jailed for up to a year - specifically Unauthorised access to computer material. (1)A person is guilty of an offence if— (a)he causes a computer to perform any function with intent to secure access to any program or data held in any computer, or to enable any such access to be secured; (b)the access he intends to secure, or to enable to be secured, is unauthorised; and (c)he knows at the time when he causes the computer to perform the function that that is the case. This law has been applied even to simply altering parameters in a GET request to a website, so it is incredibly broad. Other jurisdictions have similar wording, so be aware!
The website owner brings in an expert programmer who testifies that the user cannot have gotten to a certain part of the site (or download, etc.) without having clicked to accept the terms of service, and that this document they're holding is a true and correct copy of the terms of service as of that date. That's evidence in favor of the site, and an adverse party has to have stronger evidence in order to overcome it. If the person didn't save a copy of the terms themselves, they'll have a hard time on this. Then the other party's attorney tries to discredit the programmer by asking questions like "how do you know there are no bugs in the software which could have allowed somebody to reach this without agreeing to the terms of service" etc. Apparently, some sites don't require users to click indicating agreement. If the company has significantly changed the site, terms of service, etc. since the time the user registered, and doesn't keep any copies of old versions around, and admits this, they'll have a hard time enforcing an agreement (as they can't produce a copy of it). If the user kept a copy, the user might be able to present that. It's up to the finder of fact to decide what to believe and how much weight to give the various witnesses' testimony.
You can have agreements that are not contracts As such, there are not legally enforceable as contracts but may be enforceable under non-contract law. Examples of such non-contractual agreements include social agreements, statutory duties, memorandums of understanding, agreements to distribute cocaine etc. However, that’s not what you have here “No contract” agreements for things like internet or phone services are contracts - the “no contract” terminology is advertising fluff to indicate that the contracts are one-off or short term and don’t lock the customer into a long-term contract. The term “contract” is being used in a generally understood way as meaning a long-term binding commitment not in a strict legal way where virtually every commercial transaction is a contract
There are not enough facts to draw a conclusion First, it’s not clear that the document you signed amounts to a contract. For example, what consideration did the school give you in return for the permission you gave them? Providing you with an education doesn’t count - they were legally obliged to do that already. If it is a contract then whether and how it can be revoked would depend on the terms of that contract witch I’m guessing you don’t have a copy of. Notwithstanding, as a minor, you have the right to void the contract until a reasonable time after you turn 18. Even if it is now many years since that happened, it might be reasonable since you only just discovered the website. If it isn’t a contract, then it would be revocable at any time. Practicalities Make a fuss and they may take the photos down even if they are not obliged to. They presumably have plenty of photos of kids who aren’t you and aren’t complaining and if you make it so it’s easier to change the website than to deal with you, thy’ll change the website. I suspect their inertia is because they once paid a web developer to create the site, it has never since been updated, they don’t know how to do it, and they don’t want to have to pay someone to find out. Otherwise, why would they have photos of ex-students rather than current students? If so, an offer by you to cover the costs, might solve your problem.
Such use might well be illegal, and subject the user to tort liability, or possibly even criminal liability. Parties For this discussion let us call the person or company that developed and wants to protect the information D, the person or company that downloaded and wants to use the information U, and the person who placed the information on the server P. Trade Secret One possible source of liability is if D considers the information to be a trade-secret. The law on trade secrets varies to some extent in different countries, although there is a general similarity. Since no jurisdiction is specified in the question, I am going to look at the united-states law. Definition The LII page on &quot;Trade Secrets defines a trade secret under the US Uniform Trade Secrets Act (&quot;UTSA&quot;) as: &quot;information, including a formula, pattern, compilation, program, device, method, technique, or process that: Derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from its disclosure or use; and Is the subject of efforts that are reasonable under the circumstances to maintain its secrecy. A similar definition is given by the USPTO page on &quot;trade secret policy&quot;. Prior to the USTA, and still in those US states that have not adopted the USTA, trade secrets were/are protected under the common law. The LII page lists the common law factors, as given by the Restatement of Torts (1939) § 757, comment b: The extent to which the information is known outside the claimant's business The extent to which it is known by employees and others involved in the business The extent of measures taken by the claimant to guard the secrecy of the information The value of the information to the business and its competitors The amount of effort or money expended by the business in developing the information The ease or difficulty with which the information could be properly acquired or duplicated by others These factors may apply in other common-law countries. In either case, one must consider how the would-be user came to acquire the information, and thus how it came to be on the server from which it was downloaded. One must also consider whether it was the subject of &quot;reasonable efforts&quot; to protect its secrecy, under the circumstances. Circumstances If P was violating an obligation of confidentiality, such as an NDA or a duty as part of an employment relationship, then the placement of the info on the server was improper. In such a case its acquisition by another, such as U might constitute misappropriation. The same would be true if a person under an obligation of confidentiality arranged for the server to be indexed by a search engine, when it should not have been. The case for misappropriation would be stronger if U knew that the information was considered confidential by D, and also if P had informed U about where to find the info, or what search terms would uncover it. If P was acting with the permission of D, and P or someone else at D simply failed to realize that the server was, or might become, indexed, then the question is whether the steps taken by D to keep the info secret were reasonable. If this a case of &quot;inadvertent disclosure resulting from the trade secret holder's failure to take reasonable protective measures&quot; then there is no misappropriation, and the actions of U are lawful. That will depend of a judgement of whether D's actions were reasonable in light of the value of the info and the overall circumstances. If the placement of the info on the server is considered to constitute &quot;general publication&quot; of the info, so that it is no longer secret in any meaningful sense, then D may have a claim against P, but not against U unless U acted in collaboration with P. Copyright Law The documents downloaded from the4 server are almost surely protected by copyright. Directly incorporating them into an open source project without permission from the copyright holder would be copyright infringement, and would subject U to a suit for infringement. However, copyright does not protect ideas, methods, or facts. If U learns a method or idea from the document, and uses that knowledge without directly copying or closely paraphrasing the document, there is no copyright infringement and no claim under copyright law. Patent Law The question does not mention any patents. It is possible that D has patented the method describe in the downloaded documents. If so, and if the patent is valid, any use by U would be patent infringement, and the question of how U learned the info becomes irrelevant. However, most software developments such as data structures are not patented, so this is a somewhat unlikely, albeit possible, case. Notre that if the information is covered by a patent is is by definition not secret, as all patents must be openly disclosed. But they may not be widely publicized, and if U does not make a patent search, U may not realize that the document includes patented technology. This possibility is largely incompatible with the trade secret possibility, althogh it is possible to use trade secrets in connection with patented tech. Conclusion In short whether U may lawfully use then info, or is subject to a tort claim by D, or even criminal action, depend on the details of the overall facts. U would do well to take legal advice on the matter before proceeding to use the info.