Has it been Legally Confirmed that A Website is not Liable if passwords stolen from it are used on other sites? Security Experts the world around all agree that you should not reuse passwords across sites. This is simply a matter of best practice, and it protects you such that if your StackExchange password is stolen, they can't use that to access your bank account. The general feeling I get from my security friends is that this &quot;advice&quot; is legally bulletproof, and that if their website is hacked, and plaintext passwords are stolen, they don't have to worry about someone suing them because the password that was stolen from their website was also used on that person's banking page. After all, &quot;It's the user's fault for reusing a password!&quot; Has this belief actually been upheld in court yet? Or is this a firestorm waiting to happen when Amazon turns out to be the victim and they sue some smaller organization for every penny it has?
united-states The argument you are making, restated in legal terms, is roughly as follows: Users have a duty to not reuse passwords. When a user reuses a password, and their password is subsequently stolen and used to fraudulently access the plaintiff's system, that password reuse becomes the proximate cause of the plaintiff's business injury. Therefore, our storage of plaintext passwords cannot be the proximate cause, and so we cannot be liable. This argument is mostly wrong. Leaving aside the fact that you're going to have a tough time convincing a jury of #1, a tort may have more than one proximate cause. Both the password reuse and the plaintext storage were but-for causes of the injury (i.e. if either had not happened, then the injury would not have happened). The injury was foreseeable, because it is well known in the security industry that many users in fact do reuse their passwords, professional advice notwithstanding. In most US states, that's enough to establish proximate cause. In the minority of states using the &quot;direct causation&quot; test, you might be able to characterize the user's password reuse as an intervening cause, and thereby avoid liability. However, there are other elements of tort law which must be established aside from proximate cause, and so by itself this does not resolve the question of liability. Other defenses might be applicable; for example, the terms of service might contain an indemnification agreement, which (if upheld) would make the user(s) responsible. The defendant might also argue that there is no duty of care, that it was not breached, or that the injury was or should have been de minimis (i.e. that the plaintiff should have taken greater care to prevent damages arising from account hijacking).
There are three main aspects to this: Its their website, and their terms of service. They can enforce those terms, or change them (in some appropriate manner). You have no recourse if they remove you, block you, or delete your account, for example. That's the measure that you would probably have, virtually every time. To claim damages, or litigate beyond just website access control, requires a legal claim. But there's a catch there. To claim damages, they need to show actual damage, which they wish to be compensated for. If you misused their website but no actual harm can be shown, the total damage claimable is zero, whether or not you followed their rules. Merely entering dishonest information isn't by itself harm. So they would have to show they suffered damage/harm because of that, which is directly attributable to your behaviour, was foreseeably harmful etc, or similar. They also need to consider legal costs, and ability to enforce, especially if you are in a different country. If for some reason the computer use was also illegal, then a criminal act could be committed and they could notify law enforcement. For example suppose you did this in the little known country of Honestania, where the law says that to prevent trolling and online abuse, anything posted on social media under any but your own legal name is a crime. Or suppose you'd been banned from the system and ignoring/evading such a ban was criminal computer use or criminal trespass due to the forbidden/unauthorised access (which can happen in several places). But this is purely for completeness; I guess you'd know if you were taking it further, into criminal computer use.
Given a large database of email addresses that you can't prove have given consent to receive email, the only legal thing to do with it, is to (securely) delete it. (I am going to switch your question about a larger company to a bank: in the UK, big pharma is forbidden from advertising to individuals.) In principle the rules are the same for a huge bank and everything down to a self-employed plumber. In practice the plumber will be told "don't do that again" rather than fined. This case was treated under the Data Protection Act, which has a maximum fine of £500,000&nbsp;&ndash; so a big bank would probably have been fined more, but not necessarily much more. Under GDPR, fines are related to turnover, so the fine would be a lot bigger for a large bank. The incident is a year old now. Details here.
The CEO wants to "fool" users You are essentially admitting that the company you are working for is about to deceit its customers and asking whether that is legal. The relevant set of laws is rather sparse and does not give direct answers in regards to oAuth tokens or other details of that level (which is probably making your CEO think he can "handle" the arising questions). Probably the most relevant bit of legislation that applies here is The Federal Trade Commission Act (15 U.S.C. §§41-58) which prohibits unfair or deceptive practices and has been applied to online privacy and data security policies. I am pretty sure that, in practice, if the users take your company to court, it will be held liable because: users are allowing us to read their CRM data and once we get the data, the data become ours, and we can do whatever we want with it. Is this true? While the users are still allowing you to read their data it is completely up to the Terms/EULA what you can do with it. However, once you have made the users think that they have withdrawn your access (e.g. they "deleted" oAuth tokens), you are no longer authorized to read the current data (although the Terms may still allow you to use the old data you obtained when you had access). Silently continuing to access their data without their knowledge/approval is definitely a deceit. The CEO wants us to download all of their emails and store them in our database There would be nothing wrong with that if it was in the Terms. But if it is not, that would be a blatant (and easily punishable) breach of privacy. Note that you may also be held personally liable for this wrongdoing (if/when proved so). "Just doing your job" claim will not work.
Probably not. Overview You haven't specified a jurisdiction. I will talk about Australia because that's what I'm familiar with. In Australia the most relevant area of law would be tort, specifically negligence. The university would be liable to pay damages if a court found that it owed a duty of care to your friend, that it breached that duty, and that your friend suffered injury ('injury' including loss of property as well as mental suffering) as a result of that breach. Also potentially relevant would be contract law, if your friend and the university had entered into some kind of agreement relating to his security, or equity, if the university had somehow acted to lead your friend to rely, to his detriment, on the university protecting him (promissory estoppel: Walton Stores v Maher). However, I think this is unlikely unless, for some reason, the university had put up signs saying 'Please come onto our land and we will be responsible for your security'. Negligence You have stated that 'it is their responsibility to make sure all students are safe on campus.' It is not clear whether you mean to state that as a fact or whether you are suggesting it as a possible hypothetical basis of liability. I am not aware of a case that establishes the proposition that universities do have such a duty. The judgments in Modbury Triangle Shopping Centre v Anzil (2000) 205 CLR 254 discuss the liability of the occupier of land (such as the university in your example) for injuries inflicted by criminals upon people present on land (such as your friend in your example). In that case, the defendant ran a shopping centre. The plaintiff worked at a shop in the shopping centre. At the end of the plaintiff's shift at 10.30pm, it was dark outside because the shopping centre switched the lights in the car park off at 10pm. The plaintiff was mugged in the shopping centre car park on his way out to his car. The key question there was whether the defendant shopping centre was under a duty to keep the lights on for workers leaving work (along with the question of how the failure to illuminate the area led to the attack i.e. whether the plaintiff still have been mugged if the lights were on). Therefore the question that we are presently interested in, about an occupier's responsibility to protect visitors, is only dealt with as a side issue in that case. But the principle is pretty well-established that, generally, you are not responsible to protect another person from the criminal acts of a third person. The common law has a strong presumption against imposing liability for 'omissions' as distinct from acts, which is another way of saying that the courts don't want people being liable to run out into the street and help people. See paragraphs 27 and 28 and thereabouts in Modbury Triangle. Particular relationships may exist which create such a duty. One is in relation to school children; the school is responsible for taking such care of the child as a parent would. The relevant features of this the school-child relationship include the child's vulnerability as a child and the way the school controls their movements and enviroment during the school day. I presume that your friend is not a child and the university does not control his or her movements. Therefore a court is likely to be looking at the general principle that the university is not responsible for protecting people from the criminal acts of strangers, and then looking (and probably not finding) any special feature of the relationship between your friend and the university that creates an aspect of vulnerability, reliance or control that makes it reasonable to impose a duty of care. Some people think that there is a general principle that if something bad happens to them, some identifiable person with cash must be responsible for paying compensation, whether that is an insurer, the government or a nearby corporation. The common law has not picked up that principle. The common law would slate the responsibility home primarily to the mugger. Sue them. What does the university have to do with it? Conceivably the university might also be liable along with the mugger, but the fact that an injury occurred and nobody else can in practice be held responsible does not in itself make the university liable. As mentioned by Pat W., there may be some other feature that creates a duty, such as if the university had made some change to the environment that allowed made the attack to occur when it wouldn't otherwise have e.g. moving your friend's dormitory so that the only entrance was through a dark alley, or if the attack occurred inside a university building where the university controlled entry (even then not sure that would get your friend over the line).
A simple EULA does not absolve you from legal responsibility. The law that you need to be acquainted with, if you are dealing with the US (i.e. might be sued in the US), is the Digital Millennium Copyright Act, in particular Title II, the Online Copyright Infringement Liability Limitation Act which states the "safe harbor" provisions. Aspects of DMCA safe harbor are covered in many Law SE questions. In essence, you have to provide a way for rights holders to complain that someone has infringed their copyright on there site, and you have to take down allegedly infringing material: and there are a number of legal formalities to attend to in doing this. The main point is that you can't just ignore the problem and hope it goes away, and you can't just say it is not your responsibility, which is what a simple EULA does. To be protected, you need a "designated agent" where complainers can contact you. You provide the information online (as well as stating the DMCA policy, which can be in the EULA), and also register that information with the Copyright office (online). The complaint has to be in writing, and most of the burden is on the author of the complaint, but you still have to be sure that the complaint is legally conforming. The complaint has to say what was infringed (e.g. the URL), the identity of the protected content (title of the book, for instance), and provide the complainer's signature and contact information. It also requires the complainer to say that they have a good faith belief that the material is illegally copied (no permission, and not otherwise allowed by law), and a perjury statement that the foregoing is accurate and authorized by the copyright holder. When you have a conforming notice, you must "expeditiously" remove / disable the infringing material (there is no definition of "expeditious"), notify the user, then wait for a proper counter-claim (same general form as the take-down claim but where the user denies the posting the material was illegal. If you get a counter-claim, you notify the alleged copyright owner and wait for them to file suit in 10 days. If they don't do that, you restore the material. Here is a sample complaint, and a sample counter notice. Also, this document (look for the download tab) reorganizes the legal language so that requirements are put in logical order and not randomly scattered throughout the US Code.
Let’s say I go to a cash machine, ask for £100, and the machine gives me £10,000. I use my banking app and see that £100 left my account, not £10,000. At this point I haven’t done anything illegal. If I asked for another £100 and got £10,000 again, that might be illegal. But the extra £9,900 are not mine. They are the bank’s money. If I try to keep it, that is simply theft.
There are two processes that go on all the time, and are generally considered legal: Encryption algorithms are attacked by cryptographers and weaknesses identified. In most cases this results in a gradual reduction of the work required to break the algorithm by a few orders of magnitude at a time. The history of SHA-1 is a good example of this. People identify security holes in software and follow responsible disclosure rules. This means that they notify the vendor and give them an opportunity to fix the bug before going public. Note that this is merely considered good practice; immediate publication would be legal too. Your scenario sits at the intersection of these two processes: an attack (process 1) which completely destroys the security of many systems (process 2). Responsible disclosure occupies a legal grey area: someone who finds a bug might have had to exploit it to at least some degree to demonstrate it, and there have been cases where vendors have used police or courts to retaliate. However this wouldn't apply to your scenario. In America the First Amendment makes it unconstitutional to use the legal system to stop people saying true things (copyright excepted, and untrue things are often legal too). If your Wunderkind lives in America then a widely published factual description of their solution would therefore be legal. Legal problems only start if they provide the details in secret to people they should reasonably suspect of intending to use them for crime.