When is a permission required to attack a system? Never attack something you don't have a permission for! This is one of the golden rules of penetration testing, yet it's surprisingly unclear. What exactly counts as an attack, and when do I need permission? Let's consider some examples: Example 1 I want to log in on example.com, and accidentally type my password incorrectly, yet the website authenticates me successfully. Baffled, I try again, this time with a completely wrong password. Again, the website authenticates me successfully. It seems to me as if the back-end doesn't check the password at all! Would I have needed permission for this? Example 2 I buy myself a set of Bluetooth speakers. They come in a cheap "basic" and a more expensive "premium" variant. The only difference is that the more expensive ones have better sound quality. After opening the cheap ones up, I realize that they are built identically to the expensive ones, and just have a jumper on the circuit board that determines whether the speakers are "basic" or "premium". I change the jumper, and sure enough, the sound is better now. Realizing what I have done, I ask myself whether I needed permission from the vendor for this. Example 3 I use a website like TIO to execute some code. Out of curiosity, I try system("cat /etc/passwd") and sure enough, I get a file in the passwd format. I poke around the system a bit more to find the webroot and write a file into it. Again, I can open this file now. I could basically do anything on the web server, including modifying the website, visible to other users. Did I need permission from the website owners for this? Example 4 My 12 year old cousin shows me a browser game he likes to play. As a joke, I log in as admin'; -- and the admin interface revealed itself to me in all it's unescaped, unprepared glory. Did I need permission from the game's owners for this? As shown in these examples, I didn't do anything malicious, and the difference between legitimate use an an attempted "attack" is difficult to tell - at least on closer inspection. As such, is there a clear line when exactly permission is necessary? This question was originally asked in Security.SE. I am mostly interested in answers relevant to laws in the European Union.
Disclaimer: Not a lawyer or even living in US. I try to write the answer under US law. Other countries law may differ. Make sure you consult a lawyer in your jurisdiction. Here is my understanding of the individual examples: You don't need permission legally, because you are only accessing your own account and your own information. You are the only one damaged by the intrusion and therefore, nobody can really file a lawsuit against you. This is often used by security researchers when the subjects are uncooperative. That being said, if it is an actual pentesting client, you may want to refrain from it regardless. You don't need a permission to modify hardware you own. This is completely legal and not considered an attack. It would qualify as an upgrade, such as replacing a component in your laptop. You are allowed to do that. You should have a permission here. This is an intentional penetration test and you should have permission to do this. The same as 3. This is an intentional penetration test and you should get a permission. Though if you logout immediately and don't mess with the interface, it may not be illegal on the basis that you did not cause any damage or steal any information, or it may be illegal under some circumstances. It may also be impossible to prove that you did not do anything while there.
The Art 15 GDPR right to access is pretty absolute. There are only three grounds under which access to a copy of your data can be denied: Art 12(5): the request is “manifestly unfounded”, e.g. clearly just submitted for trolling Art 12(5): the request is “excessive”, e.g. if you repeat the same request very frequently Art 15(4): access to a copy would “adversely affect the rights and freedoms of others” Thus, I am confident that Twitch would respond to an access request with a copy of all your chat messages. Of course, the chat messages might be useless without context, but providing that context might infringe on the privacy rights of others (see Art 15(4)). There are two caveats to this right. The data need not be machine-readable, unless the more limited Art 20 right to data portability also applies. Twitch is under no explicit obligation to provide access in a self-service manner, e.g. through an app or web interface. It would probably in the best interest of Twitch to provide self-service means, but right now the Twitch privacy policy (permalink) asks you to exercise your rights by emailing privacy@twitch.tv. Alternatively, their privacy choices page contains an entry to “Obtain access to or a copy of certain personal data we hold about you”, which contains a barely-visible link to a web form where you can request chat data.
are there any safeguards you could take to preemptively block such behavior, such as a disclaimer inside the book cover that reads something like The safeguard you outline would be overridden as soon as the author enters any contract that requires assignment of copyright. (I would not delve in the differences between licensing and copyright assignment because that hypothetical author is dealing with a contract of adhesion which readily requires assignment; the author has no option to change the ToS to allow for licensing only) Under contract law, one of the essential prerequisites is that the conditions of a contract be entered knowingly and willfully. By deliberately clicking on a ToS page to move forward with the uploading a copyrighted work, the author is signaling his awareness and acceptance of the ToS. The fact that the author chose not to read the ToS is irrelevant and very unlikely to strike whatever entitlements the website owner formulated in the accepted ToS. For the same reason, the author's safeguard disclaimer does not bind the website owner: It cannot be said that the website owner was aware of that disclaimer at the time of the formation of contract between the author and the website owner. That is, the website owner did not knowingly and willfully accepted the author's safeguard. The website owner is not even expected to know about any safeguards which one of its potential user intends to establish. The length of a ToS document is also irrelevant because the website owner has the valid argument that "the user-author could have skimmed through the ToS or do a search (via Control-Find) of keywords such as 'copyright' or 'property', whence any allegation of 'inadvertent' assignment of copyright is untenable". Is there a way to protect your IP from inadvertently being licensed/stolen/assigned via TOS "agreements", without having to waste your life reading huge one-sided online "contracts" that are "subject to change without notice" anyway? Yes. That consists of not uploading one's works in such platforms. In contract law that would be expressed as "declining an exchange of considerations". There are many other alternatives for an author to promote his work without being required to assign copyright.
I don't think any appellate court has given an opinion on whether encryption creates a reasonable expectation of privacy. This is not surprising as only recently has it come to light that the government may have weakened encryption protocols and asked for backdoors in order to aid in decryption. However, Orin Kerr, professor of Law at George Washington University School of Law wrote this article in 2001. He argues that encryption does not create a reasonable expectation of privacy. He says: the Fourth Amendment regulates access, not understanding. Once you introduce your communication into third party systems (or the garbage :P), they may give it up to the government. If the government happens to be able to understand that communication, so be it. He shows how this conclusion is consistent with how the courts have ruled on "reassembly of shredded documents, recovery of deleted files, and the translation of foreign languages". Note that the reasonable expectation of privacy test is only one of the tests used to determine whether a search or seizure is reasonable. Another test is the "trespass" test which deems an interaction to be a search per se if there is a trespass on a person's personal effects. It was used before Katz and was reiterated recently in US v Jones (2012). Regardless, your question is still meaningful because the two tests are used alongside each other.
Only if you ask Valve for permission first, and they agree in writing. I'm not a lawyer, but when I was reading through the Subscriber license you linked, this stuck out to me: You are entitled to use the Content and Services for your own personal use, but you are not entitled to: (i) sell, grant a security interest in or transfer reproductions of the Content and Services to other parties in any way, nor to rent, lease or license the Content and Services to others without the prior written consent of Valve, except to the extent expressly permitted elsewhere in this Agreement (including any Subscription Terms or Rules of Use); (ii) host or provide matchmaking services for the Content and Services or emulate or redirect the communication protocols used by Valve in any network feature of the Content and Services, through protocol emulation, tunneling, modifying or adding components to the Content and Services, use of a utility program or any other techniques now known or hereafter developed, for any purpose including, but not limited to network play over the Internet, network play utilizing commercial or non-commercial gaming networks or as part of content aggregation networks, websites or services, without the prior written consent of Valve; or (iii) exploit the Content and Services or any of its parts for any commercial purpose, except as expressly permitted elsewhere in this Agreement (including any Subscription Terms or Rules of Use). The part that I've bolded is probably the part that makes this against the Terms of Service, since in order to post these sorts of automated messages to their service, you'd need to use a &quot;utility program&quot; to &quot;emulate or redirect the communication protocols used by Valve in any network feature of the Content and Services, through protocol emulation, tunneling, modifying or adding components to the Content and Services&quot;. I doubt that Valve would ever agree, since such a program could very easily be used to create spam bots that works bombard users with unsolicited advertisements, but maybe Valve would be willing to cut deals with AAA video game companies to let them deploy tools to automatically manage their store pages.
Yes, this violates the GDPR if the user is in Europe. Data which is tied to a personal device can be tied to the person who owns it. From "What Is Personal Data" by the UK Information Commissioner's Office (ICO) (emphasis added): Personal data is information that relates to an identified or identifiable individual. What identifies an individual could be as simple as a name or a number or could include other identifiers such as an IP address or a cookie identifier, or other factors. If it is possible to identify an individual directly from the information you are processing, then that information may be personal data. If you cannot directly identify an individual from that information, then you need to consider whether the individual is still identifiable. You should take into account the information you are processing together with all the means reasonably likely to be used by either you or any other person to identify that individual. The bit about "all means reasonably likely" in the last bullet includes the kind of de-anonymisation tactics described in the NYT article. There are 6 lawful bases for data processing in the GDPR, and all processing must fall under at least one of them. (a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose. (b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract. (c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations). (d) Vital interests: the processing is necessary to protect someone’s life. (e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. (f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.) Selling data isn't covered by any of the others, so consent must be obtained. Permission must be clear and positive, and you cannot predicate delivery of a service on the processing of data that isn't necessary for that service. So for instance you cannot say "You can use this service as long as we are allowed to collect and sell your data" because selling the data isn't necessary to the provision of the service. From "Consent" by the ICO: Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent. Explicit consent requires a very clear and specific statement of consent. Keep your consent requests separate from other terms and conditions. Be specific and ‘granular’ so that you get separate consent for separate things. Vague or blanket consent is not enough. [...] Avoid making consent to processing a precondition of a service. This applies to any processing of data about individuals within the EU, so just being an American company doesn't get you a free pass to ignore the GDPR if your app gets used by Europeans. The "Legitimate interests" basis is more problematic, in that the company collecting the data has to conduct a vague "balancing test" to determine if this basis applies. For direct marketing the ICO has written this, which says that direct marketing may be a legitimate interest, especially if you can show that the user has expressed interest in such adverts. For instance a location service which promises to tell you about nearby special offers would fall into this category. Against this, the impact on the user's privacy has to be considered, and location data is "special category data" because it can reveal medical information (e.g. hospital attendance) or religious affiliation (e.g. which church you go to). So unless the relationship between the recorded location data and the service is very direct its not going to pass the balancing test. The company would also need to distinguish between knowing the current location and keeping a record of historical locations; the two need separate justification. And of course nothing about this covers the sale of the data; this is considering a company which sells advertising space in it's app, not one that sells the data itself.
You do not have to. The burden of proof is on the prosecution to prove that you made the threat. Reasonable doubt exists in the circumstances that you describe, that there are no logs of who accessed what when and how. Your attorney may have to introduce expert witnesses who can explain how it is possible that text from your computer can end up on a web page, and they can testify that there are many ways that data can be entered into the database, only a few of which actually involve you.
Yes a company can be sued (since anyone can sue anyone). But in order to win a lawsuit, you have to have damages as a result of some action, AND you must prove that the action was done with intent to harm or was otherwise negligent. So following your website example, a lot of things would have to happen: The website would have to be hacked. If the passwords are encrypted instead of hashed (which still qualifies as "plain-text" once they email it to you), the hacker would have to figure out how to decrypt the passwords. (Which a good hacker could probably do.) The hacker would have to take those passwords and do something with them that causes damage to their owners. Even if all of those things happened, you would still also have to prove negligence on their part which would be pretty difficult to do because the flaw that was hacked would be the focus of negligence discussions moreso than what was stolen. That being said, if your goal is simply to get them to fix the problem, rather than receive monetary damages, then you could still sue for an action to be taken. You'd have to pay by the hour for the attorney since they wouldn't have a chance of winning monetary damages. But in all likelihood the website owner, upon seeing the lawsuit, would fix the problem before it gets to court, so I could see that having the desired effect. That is if you think it's worth the cost of filing the lawsuit in the first place. Perhaps you could save yourself the cost of an attorney and just threaten to sue if they don't fix the problem.