Computer Fraud and Abuse Act equivalent for citizens What equivalent do ordinary US citizens have in terms of digital protectionss, as the US government and its financial interests have as defined in the Computer Fraud and Abuse Act?
The US CFAA is by no means limited to &quot;the US government and its financial interests &quot;. It currently applies to any computer which is &quot;protected&quot;. 18 USC § 1030(e)(2) defines a &quot;protected computer&quot; as (in part): a computer ... (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States This covers any computer connected to the internet. 18 USC § 1030 (a)(2) (C) applies to anyone who obtains without authorization : information from any protected computer; Of course, nothing requires federal prosecutors to bring charges for all acts which technically violate this sub-section. If someone hacks another person's holiday card address list, I doubt if a CFAA prosecution would be brought, but it could be if the US Attorney thought fit.
Greendrake's answer says that a country can declare any jurisdiction it likes. This is true, but in practice it is the convention that a country should claim jurisdiction only over its territory and its citizens. The point about "citizens" is normally not pushed, as when you go to a foreign country you are normally subject to its laws rather than those of your home, but for instance there are laws against child sex tourism where the perpetrators can be prosecuted at home for offences committed abroad. However this basic principle gets more murky with long-distance communication such as the Internet. Someone in country X can, for example, provide a service to someone in country Y which is illegal in country Y. At this point the laws of country Y have been broken by someone sitting in country X. Y is not claiming extraterritorial jurisdiction; the crime occurred inside its own territory, but the criminal is currently resident in X. From a legal point of view this is the same as if both had been inside Y when the crime was committed, but then the perpetrator fled to X before they could be arrested. So in the Kim Dotcom case, Dotcom is alleged to have committed criminal copyright violations by supplying movie files to people in the US. In the Meng Wanzhou case, Meng is alleged to have made fraudulent statements to American banks to the effect that Huawei was complying with US sanctions law (otherwise those banks would not have been able to do business with Huawei). The accounts I've read don't say whether Meng was in the US for those meetings, but the fact that they were made to American banks in order to do business in America makes the precise location of the meeting irrelevant.
You are granted the free trial as part of a trial, not to permanently use the program. When the user downloaded the trial version of the program, he probably had to accept T&amp;C granting a one-time only say 3‑month trial period. It is a mere breach of contract if you’re circumventing this, but you might still be liable to damages. Circumventing technological protection measures is forbidden, § 95a UrhG. However, these protection measures must be considered effective. Now, lawyers are usually no computer gurus, so they might arrive at completely different conclusions, but I guess/hope editing a plain text file, substituting a plaintext ISO 8601 date, will not be deemed “effective”. (I presume the same effect could be achieved by resetting the computer’s RTC.) Having said that, since you intend to “publish a guide […] detailing how to use this exploit” I suspect it might not be that trivial and thus, from a lawyer’s POV, be considered an “effective” technological protection measure. If it is considered an effective technological protection measure, you might be punishable via § 108b UrhG, but I’m not sure about that. The wording is terribly complex.
Obviously you may end up voiding warranties, losing on-going support from the manufacturer, or there may be a contract you agreed to stating that you won't do it, but assuming none of that is relevant (e.g. a salvaged Tesla doesn't get support/warranty anyway) is there any law preventing you from modifying your property to remove the limits placed on it? This assumes away one of the biggest issues, which is doing this is almost certainly a breach of contract unless the contract term is void as against public policy (which it probably isn't). So, the manufacturer can sue you for money damages probably equal to the difference in value between the limited and unlimited hardware in the marketplace. The manufacturer might also be able to obtain an injunction against this practice, which could result in the incarceration of someone who knowingly violated this court order for contempt of court, once an injunction is secured from a court to enforce the contract. There is also an anti-hacking statute in the United States, whose plain language appears to prohibit taking actions that override a digital system's security features. Unlocking these hardware features would appear to violate this statute. This is part of the Digital Millennium Copyright Act (DMCA) and is codified at United States Code Title 17, Section 1201. As Wikipedia explains: 17 U.S.C. 1201 is often known as the DMCA anti-circumvention provisions. These provisions changed the remedies for the circumvention of copy-prevention systems (also called "technical protection measures") and required that all analog video recorders have support for a specific form of copy prevention created by Macrovision (now Rovi Corporation) built in, giving Macrovision an effective monopoly on the analog video-recording copy-prevention market. The section contains a number of specific limitations and exemptions, for such things as government research and reverse engineering in specified situations. Although, section 1201(c) of the title stated that the section does not change the underlying substantive copyright infringement rights, remedies, or defenses, it did not make those defenses available in circumvention actions. The section does not include a fair use exemption from criminality nor a scienter requirement, so criminal liability could attach to even unintended circumvention for legitimate purposes. The statute is quite lengthy and full of technical definitions and narrow exceptions and exceptions to exceptions to the general rule. These legal issues have mostly gained media attention in the context of farmers who seek to hack into the built in software of their farm machinery in order to repair it where the manufacturing companies have not cooperated. There have been legislative fixes proposed that would make these prohibition void as against public policy for some specific purposes like doing repairs. There have also been efforts to characterize this kind of business practice as an anti-trust violation. But, none of that legislation has passed in the United States, to the best of my knowledge and belief. But, I am not aware of any high profile legal precedent that has addressed this point but I wouldn't rule out the possibility that there is one. The closest case I could find on point (from the High Court in Australia) is Stevens v. Sony, which holds "that a device allowing PlayStations to play games with a different region code did not violate the anti-circumvention laws, because the mechanism in the PlayStation did not directly prevent the infringement of copyright." I am not personally familiar with non-U.S. law on this topic. Wikipedia reviews some of the applicable law in the E.U. and Australia. According to this Wikipedia entry, pursuant to European Directive 2001/29/EC of the European Parliament and of the council of May 22, 2001 on the harmonisation of certain aspects of copyright and related rights in the information society, E.U. member nations must adopt domestic anti-circumvention statutes that meet certain minimum E.U. standards set forth in the directive. Also according to the same Wikipedia entry: "Australia prohibits circumvention of "access control technical protection measures" in Section 116 of the Copyright Act." In Australia, "Penalties for violation of the anti-circumvention laws include an injunction, monetary damages, and destruction of enabling devices."
She could refer this to the Cyrpriot Commissioner for Personal Data Protection, but I would try contacting the company first and telling them to remove her Personal Data from the public website - or delete it completely. If they don't give a satisfactory response, mention the CPDP. This could lead to the data being removed within a few days, while an official complaint is likely to take longer. She may have grounds for legal action which would result in the company being compelled to take down the data (or to close the website), but if your friend is thinking in terms of compensation, what compensation would she seek? If she can demonstrate and quantify financial losses that occurred specifically because of this disclosure there might be a possibility, but I suspect that would be difficult to prove.
If it’s your pizza, yes The civil equivalent of theft is the tort of conversion, “consisting of &quot;taking with the intent of exercising over the chattel an ownership inconsistent with the real owner's right of possession&quot;. In England &amp; Wales, it is a tort of strict liability.”
Your code is considered free speech (Bernstein v. United States) and you have allowed the use of the code via the MIT license. Since the application of your code is very generic and is not specifically targeting anyone. You probably are not criminally liable. This is simply writing a "Proof of Concept" for security testing purposes. That same way Metasploit, Nessus, and Nmap have actual exploit code but are considered tools of the trade. Now if you go around using your spyware on non consenting victims. You might get a visit from some people with guns and badges that have 3 letters on them.
HIPAA applies to covered entities Which, broadly speaking are entities that provide health care in the USA regardless of where they might be based. The nationality of the patient is irrelevant.