Hacking a scammer: is this guy breaking the law by deleting phishing data? I just watched this video. In it the presenter hacks a phishing website using a SQL injection attack and then deletes the database of harvested emails and passwords. Assuming that he did this to a real scammer as opposed to a demo website he set up for the video, was he breaking the law? Edit: The presenter is American but computer crimes are generally held to happen in the jurisdictions of both the hacker and the computer, so I'm interested in other jurisdictions too.
You haven't specified a jurisdiction. In the United Kingdom† this is a clear violation of section 3 of The Computer Misuse Act 1990 (1) A person is guilty of an offence if— &nbsp; &nbsp; (a) he does any unauthorised act in relation to a computer; &nbsp; &nbsp; (b) at the time when he does the act he knows that it is unauthorised; and &nbsp; &nbsp; (c) either subsection (2) or subsection (3) below applies. (2) This subsection applies if the person intends by doing the act— &nbsp; &nbsp; (a) to impair the operation of any computer; &nbsp; &nbsp; (b) to prevent or hinder access to any program or data held in any computer; [F2or] &nbsp; &nbsp; (c) to impair the operation of any such program or the reliability of any such data; [F3or &nbsp; &nbsp; (d) to enable any of the things mentioned in paragraphs (a) to (c) above to be done.]] Deleting the data is unauthorized (3.1.a) The ethical hacker knows it is unauthorized (3.1.b) Deleting the data prevents access to the data (3.2.b and hence 3.1.c) † This is one of the few Acts that apply to the whole of the UK.
What's the worst that can happen? If you do nothing, it's a bit inconvenient. If you delete all that company's stuff, who knows what they could sue you for. I'm not saying they would be right, but being sued can be expensive, no matter whether you are wrong or right. Send a letter by registered mail, with a witness to the contents, that you are the only one with admin rights to these sites, and asking them how they would like to take over these sites, and informing them that you will delete anything on your personal email after a reasonable time if you don't hear from them. And since anything you do is work for you, you should expect some appropriate compensation. Deleting their property, even if it affects you, is risky.
I'm not aware of any cases on point, but as a rule legal fig-leaves don't play well in court. If the webmaster simply puts up a banner saying that EU residents are not permitted but takes no other action to exclude them, then that is going to be considered irrelevant. The webmaster is still very likely required to comply with the GDPR. On the other hand if the webmaster takes other steps to exclude EU residents, such as using a geolocation service to block connections known to be in the EU, validating email addresses and blocking those from EU domains, and ejecting anyone who mentions that their residence is in the EU, then that is more likely to be seen as a good-faith attempt to avoid being subject to the GDPR. It will also have the practical effect of greatly reducing the number of actual EU residents. All these controls can be evaded, but it would be much harder for any data subjects to claim that they acted in good faith or that the webmaster acted in bad faith. Note that validating an email address or logging an IP is itself processing of personal data, so anyone implementing such a system still can't ignore the GDPR completely, but it would greatly limit the scope and make it easy to delete any such data after a short time. (Note: the term &quot;EU resident&quot; above is an approximation of the territorial scope).
How did she access your bank account? If it was a joint account then it is as much hers as yours and she can treat it as her own. If it is yours alone, how did she get in? If you gave her the PIN/password then you gave her permission to access it. If you didn’t, treat her like any other hacker - notify your bank and the police.
GDPR is not a blanket ban on the handling of personal data. It is a set of guidelines when and how data may be processed and stored. Documenting the compliance with a deletion request is one of many purposes for which some data may be retained after a deletion request. Others would be past contractual obligations, legal documentation requirements, and even a balance of 'legitimate interests' of the processors and the data subjects. The processor might be able to argue that fraud/abuse prevention is such a legitimate interest. What if I want to create a service that does let users enter their friends' email addresses, and send those friends an email invitation to the service? Get a specialist lawyer on staff who can check your exact business processes. A web site like this cannot possibly give you a full explanation of the pitfalls.
There are only two arguments you can make: The match making website did something wrong. I don't see how you can make this argument unless you have some reason to suspect they actually did something wrong. Strict liability applies. I think this fails for two reasons. One is that no theory of strict liability that I know of would apply to this situation. The other is that this is precisely the kind of risk that a user of the site should be protecting themselves from because it is much easier to detect fraud when you have extensive contact with someone than when you just operate a matchmaking service. So absent some evidence they did something wrong, such as ignoring specific warning signs from this particular user, there is no way such a suit could succeed.
That's an old idea that has been tried several times before (such as the first, being Unvarnished: Website Lets You Review People (And Trash Them) | HuffPost, which no longer exists); and one of the latest incarnations is Peeple (mobile application - Wikipedia). There are lots of legal liabilities, including defamation and harassment/stalking, even with the Section 230 of the Communications Decency Act | Electronic Frontier Foundation which (mostly) protects the website owner from others' speech posted on the site (your mileage may vary due to jurisdiction). The only way such a site would survive is to do what Peeple and other sites have done: greatly limit the speech allowed, such as limiting to only positive reviews, giving the subject complete control over what does appear on their profile, only allowing "opt-in" profiles, verify identities, etc. You would have to implement full GDPR compliance; but various lawsuits will either shut you down before you get far enough to launch or soon after and force you to greatly limit the scope of the site. Most lawyers would advise you to find something else to do with your time and money.
This is a super complex question and no one really knows the answer yet. Orin Kerr is probably the leading scholar on this question, and he generally argues that forced decryption of one's own device is not a Fifth Amendment violation. As I understand it (and oversimplifying by a lot), one key piece of his position is that requiring you to put in your password is a statement about your knowledge of the password itself, not about the contents of the machine into which you are entering it. And because your knowledge of the password for your own devices is presumed, an exception for "foregone conclusions" would leave this compulsion unprotected by the Fifth Amendment. You can read one of his explanations here. The Eleventh Circuit disagreed with that approach, but a California judge recently reached a conclusion similar to Kerr's. This will probably by a question for SCOTUS before too long.