Can Law Enforcement in the US use evidence acquired through an illegal act by someone else? There are reports on the internet this morning that a group of people were able to hack Parler and download around 70tb of data from the servers before AWS ceased hosting the platform. There are plenty of accusations being levelled at Parler's users in regards to using it to coordinate activity during the 6th January Capitol Riots. /r/ParlerWatch/ All Parler user data is being downloaded as we speak! Can law enforcement agencies in the USA use this data without violating any laws themselves? Would it be admissible in a court of law should charges be brought? Would this complicate legal proceedings should law enforcement seek a court order to seize the same data from the source (it is presumably still being held by AWS).
Yes: So long as law enforcement did not compel the hackers to hack the data and the data was recovered by Law Enforcement through their investigation of the Hacker's breeching the server's security. Evidence of a crime committed by a third party is admissiable if it came to light during an unrelated investigation. The party that did the hacking could still be liable for any crimes they committed in their retrieval of the data. There are occasions where someone who is committing a crime stumble upon evidence of a more serious crime and informs the police of the problem either because they would never want to be party to a serious crime, but also because it can help them get reduced sentancing to give up the greater evil. As an example, in &quot;Home Alone,&quot; when Kevin tricks Harry with the film clip of the gangster murdering Snakes with his Tommy Gun, Harry is freaking out telling this to Marv, but Marv realizes what's going to happen if they get caught: They've been robbing houses in the neighborhood and the police would likely pin the murder on them rather than assume two seperate crimes occured in the same block. Marv suggests they snoop around so they can see who walks out of the house and give the cops a face with a name. This leads them to discovering Kevin's ruses and the film's climax.
I'll preface this by saying I live in Australia where the lowest jurisdiction that can make an act a criminal offence is the state; local governments simply do not have that power here, Question 1: If I understand this right you have a law that you do not enforce that carries moderate sanctions and you are asking that a law that you do not enforce with greater sanctions will be a greater deterrent? Well ... no (see here). If you want to stop the behavior you have to enforce the sanctions that you have in a fair and impartial way. I would suggest that you make it very clear that starting in early September the laws will be enforced - that gives people fair warning. Then, each weekend in September you bring in enough police (State Troopers?) to enforce the law. Its not going to take many $250 fines to make people stop. Question 2: No comment. Question 3: No comment. Question 4: Sounds like a good way of getting the city sued for negligence; just because people are breaking the law does not make it legal to hurt them. If you are serious then fencing the entire area may be worthwhile but the area would still need to be policed.
In the general case, it seems unlikely, based on the wording (which is convoluted). In certain cases, if the president of Russia posts "My name is Vladimir Putin", that post is personal data. On the other hand, you might, based on my writing, conclude that I am from the US, and you might even conclude that I'm in Washington state, but that doesn't distinguish me from 7.5 million others, so on those grounds that is not personal data. Eventually, though, you might identify me specifically from other things that I may have said on SE. The definition depends on two parts. First, personal data is "information relating to an identified or identifiable natural person". Any "information" provided by a natural person is "related to" that person (as is any "information" that is about such a person). The second part defines "identifiable natural person", that is, who is an "identifiable person"? Every person can, in principle, be identified by reference to some label or description of fact about them, so every person is an identifiable person, under this definition. This means that every piece of text that refers to an individual (not even text which can identify the person) is "personal data". Obviously, any individual can be uniquely identified by some collection of identifiers; the problem is that the wording of the law does not explicitly say "using that supposed personal data". If I mention that I have a relative named Knudt, that would technically be personal data: I've given information that relates to a person, though you have no idea (and could not possibly figure out) who that person is. Another term that the regulation defines and uses in a few places is "pseudonymization", which is defined as the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person The point of interest here is that this says that "personal data" which cannot be attributed to an individual is, nevertheless, still personal data. I think the most important part of the regulation is art. 6, which defines lawfulness of processing, especially para 4., which allows consideration to be given to safeguards such as pseudonymization.
I will address only the legal issues. Prosecutors for very good public policy reasons are not required to prosecute every crime they have suspicions about. When exercising this discretion they consider: Is the act, in fact, criminal - many of the things you list, while reprehensible, unethical, and possibly immoral are not actually criminal. Do they have the resources (time, staff, money) to collect the evidence and run this case as opposed to the thousands of other crimes out there. There are always more crimes than can be prosecuted and these have to be prioritised in some way. Do they have enough evidence to gain a conviction beyond reasonable doubt. People can be fired or resign on suspicion, they can't be convicted on it.
Police officers are authorized to use force regardless of what they are wearing, to effect an arrest. One issue will be whether the defendants should know that they were under arrest, but there is no requirement to utter particular phrases when dealing with a combative lawbreaker. There will be an internal investigation at some level to determine whether the officers violated any department policy, and no doubt the video and testimony of those in the are would be relevant. There probably is some policy to the effect that you have to distinguish yourself from a street vigilante (you have to state your authority), though I can't find any specific online publicly-available department rules. There is no law that requires an officer to say that he is one, or to show his badge, before starting an arrest.
It is probably illegal under Indonesian law for you to launch a cyber-attack on a website that you believe violates Indonesian law, just as it is illegal for you to shoot a person for fraud. The Indonesian government reserves the right to judge guilt or innocence, and to mete out punishment, within Indonesia. It is definitely illegal under US law, also UK law and so on, to launch a cyber-attack on a website for some reason, so you can be prosecuted under the laws of that nation. You should then be concerned with the Law on Extradition (1979), noting that there might be a treaty but also Indonesian law allows extradition on the basis of the interest of Indonesia (as judged by government officials). Indonesian nationals do not enjoy immunity from extradition (as is the case in some countries). There is no extradition treaty between Indonesia and the US; there was one between the UK and Indonesia but I cannot determine whether it is still in force.
The law in every country where your service is available prevails. That means that if your servers are in Estonia, your file storage is in Lithuania, your company is in Switzerland, you are in France, you hold Thai citizenship, your users are in the USA and the signal transits through the U.K., Belgium, Germany, Canada and Poland then you are subject to the laws of each and every one of them. In addition, if China has reason to believe that the stored files contain matters relating to their citizens then they can take an interest. And so on and so forth ... A country has jurisdiction wherever it wants to have jurisdiction subject to the limits of and its ability to actually enforce its laws. What you are proposing is certainly illegal in many countries and you need to seek professional legal advice - not rely on strangers on the internet.
Intent would greatly factor into the case. As mentioned, possession of child pornography is illegal. There was a case, where a man had inadvertently downloaded such images. In the case, it was shown that there was sufficient evidence that it was accidental and without his knowledge. Presumably, if you by happenstance created an identical code through encryption/compiling, there would be a lack of evidence of intent or evidence of your intended use. For example, your stored password manager file happens to store data identical to an illegal image. The password manager output is provable and repeatable to show that it was simply circumstantial. If you have hundreds of such outputs that all "just happen to be illicit images" you would probably fall on the wrong side of reasonable doubt. As to whether you can keep the data, the programmers for the password manager would probably update their system to modify the output to avoid bad press. The general idea is that the "illegal number" is so incredibly specific that accidental cases are very unlikely to occur, and if it did, that there would be forensic evidence indicating intent and use.