Is it legal to create a fake google certificate and distribute it en masse? The question is exactly what the title says. I am a student attending a rather large high school in South Carolina. In order to block to youtube, proxies, games, etc., the school has disabled SSL and TLS (secure socket protocol for web security). These are standards for all web browsers (I get a warning on my MAC that there may be an attack on my computer if I even get on their wifi and open Safari), and what is even more scary (and angering) to me is that they have a fake google certificate which they do not inform people of in any way or agreement. I understand that I am a minor and am resigned that I can do nothing about it, but this must illegal. I cannot imagine what the consequences would be if I did the on a private server. The vulnerability is further irresponsible because it leaves people's private data being transferred over the school network (such as private e-mail, logins) unsecured and open to packet sniffing.
This is more than a comment (too long), but not a definitive answer (since I am unfamiliar with the laws regarding this kind of thing). Please forgive me. First, there are some technical misunderstandings. They are not disabling SSL/TLS. Instead, they are inserting themselves in between these connections so they can make sure you aren't accessing material you are not allowed to access. They may actually be required to do this by law. Here is how it works. Typically when you connect to, say Google.com, you are given a certificate from Google.com that has a trusted chain all the way up to some trusted root. That trusted root is explicitly trusted by your web browser manufacturer. In order to be able to inspect these sorts of connections, security appliances will actually replace the certificate provided by Google.com with one that the appliance provides. It has to pretend to be Google.com so your browser doesn't freak out. The problem is, this certificate is no longer has a trusted chain to something that the browser manufacturer trusts. It is provided by the security appliance. So often, the appliance will have a root certificate that the administrators of the system must install on every machine they control. Then the browsers on these machines will not complain that the certificate is invalid. Obviously, you are getting the error on your own machine because you have not allowed the administrator to install these certificates on your machine. Nor should you. You should definitely not allow your school's network administrator to install these certificates on your personal computer. You say that "leaves people's private data being transferred over the school network (such as private e-mail, logins) unsecured and open to packet sniffing". This is not true. Any HTTPS website you visit is encrypted between your computer and the security monitoring appliance using the pretend certificate I mentioned above. Typically then, the traffic is decrypted and inspected by the appliance. Then it is re-encrypted using the real certificate, before being pushed out onto the internet. So, only at the security appliance is data turned back into the clear, only to be protected again before going out to the internet. So, is this illegal? Well, I think you would agree that definitely on the computers that your school owns, they can do anything they want with them. The computers belong to them. Furthermore, the network belongs to them. Likely you signed an agreement (or agree to it each time you connect) that they are allowed to monitor your usage of their computers and their network. This includes when connecting your personal machine to their network.
it would violate law? It would be very dependent of what your jurisdiction is and what the software does. I would expect most software that would be lawful to install at your home would be lawful to install at your company, but there may be exceptions. To put an hyperbolic example, if you work at the CIA and you install some remote access software that allows you to access your workstation from a non-secure PC through non-secure methods, I am pretty sure that would be illegal, even if you had the best of intentions. A recent scenario taken from real life involves some members an organization who are required to use official e-mail servers for FOIA purposes setting up their own private mail servers. Of course, YMMV. can I purchase it for myself, and then use at workplace Even if the software is legal it does not mean that it is ok to use it at the workplace. Most business have rules about what software may be installed in the PCs, who may install it and how to manage it. Your software could introduce security vulnerabilities that your IT team may need to be aware of, or incompatibilities with other software. It may introduce legal liabilities (you install a "home edition" licence in a corporate environment where that licence is invalid). Your company may discipline you if you breaking those guidelines and install software without authorization, even if there is no harm for them for this action. On top of that, if your actions cause some damage to the company, it can sue you to get you to pay for those damages. Before taking any action you should inquiry about your company's IT policy and, if your company does not have one or if the policy is not clear about allowing you to install the software, ask the people in charge (preferably in writting).
Of course it's legal. Hyperlinking to an unaffiliated website in no way &quot;determine[s] the means and processing of data.&quot; The person who makes these determinations is the person running the website. If I link to Microsoft's website, that doesn't give me any control over how Microsoft processes data on the website.
Yes, their waiver has no legal basis and is invalid under the GDPR. They should have hired a better lawyer. GDPR rights cannot be waived (mrllp.com). The last bit should have been: Therefore, in consideration of my participation in any project, I understand that retaining my name and email address, as described above, does not require my consent and that the right of erasure, as spelled out in the GDRP Article 17 (1) b does not apply. The legal basis for our lawful processing of this personal data is Article 6 (1) f ("processing is necessary for the purposes of the legitimate interests pursued by the controller"). I.e. there is nothing in the GDPR that compels GitLab to erase this information, but their waiver is bogus. Keeping track of individual contributions in a software projects is necessary for a number of reasons, including security (if somebody contributes code that jeopardizes security, you want to audit everything that person has contributed).
First, read the definitions of defamation and libel be sure you understand them: Defamation | Wex Legal Dictionary | Cornell. Yes, posting to Twitter and Reddit is publishing, and people can post provably false facts on those services and defame someone in a civil law sense. But Section 230 of the Communications Decency Act (Electronic Frontier Foundation) mostly protects those services from defamation claims based on statements made by users of such a service. (Things are different if the case is criminal as a result of clear threats of violence, terrorism, etc.) ...what are the steps for them to exact damages in a civil court case? Find a lawyer, convince him/her to take the case, and file suit. if you don't know the person's real name, your lawyer will have to sue "John Doe" and point that out in the suit (and subpoenas) with the alleged Twitter handle or Reddit user name. How would a person compel Twitter/Reddit/etc to disclose the ISP information on their account? Read the various legal aspects of each service, i.e. Twitter Legal FAQs and User Agreement - Reddit and others. Your lawyer can explain that you can only try to compel them to disclose the IP and the ISP used with a subpoena during your lawsuit. How would a person compel an ISP to disclose the subscriber information (address, name) on the IP address? Since most ISPs protect their customer data, you will probably have to subpoena the ISP during your lawsuit. But your ability to do this can depend on if the ISP is a private company or a government entity, such as a university. State laws may come into play. Is obtaining the ISP subscriber's information enough to bring a lawsuit against them? Would they able to argue they didn't post the messages and bear no liability, even if it originated from their network? If it originated from an open wifi hotspot, would the proprietor bear responsibility at this point? Yes, you can sue an individual with such information; but there's no guarantee you'd win. Sure, because they can claim anything, such as someone else was using their computer or IP. No, owners of hotspots are generally not liable, and they protect themselves with TOS you agree to when you use the hotspot. Can the extensive legal costs of pursuing the case to it's conclusion be added to the damages sought easily? Legal costs can possibly be added, depending on jurisdiction. But seeking damages and actually winning them through a jury verdict are completely different things.
There are two processes that go on all the time, and are generally considered legal: Encryption algorithms are attacked by cryptographers and weaknesses identified. In most cases this results in a gradual reduction of the work required to break the algorithm by a few orders of magnitude at a time. The history of SHA-1 is a good example of this. People identify security holes in software and follow responsible disclosure rules. This means that they notify the vendor and give them an opportunity to fix the bug before going public. Note that this is merely considered good practice; immediate publication would be legal too. Your scenario sits at the intersection of these two processes: an attack (process 1) which completely destroys the security of many systems (process 2). Responsible disclosure occupies a legal grey area: someone who finds a bug might have had to exploit it to at least some degree to demonstrate it, and there have been cases where vendors have used police or courts to retaliate. However this wouldn't apply to your scenario. In America the First Amendment makes it unconstitutional to use the legal system to stop people saying true things (copyright excepted, and untrue things are often legal too). If your Wunderkind lives in America then a widely published factual description of their solution would therefore be legal. Legal problems only start if they provide the details in secret to people they should reasonably suspect of intending to use them for crime.
The CEO wants to "fool" users You are essentially admitting that the company you are working for is about to deceit its customers and asking whether that is legal. The relevant set of laws is rather sparse and does not give direct answers in regards to oAuth tokens or other details of that level (which is probably making your CEO think he can "handle" the arising questions). Probably the most relevant bit of legislation that applies here is The Federal Trade Commission Act (15 U.S.C. §§41-58) which prohibits unfair or deceptive practices and has been applied to online privacy and data security policies. I am pretty sure that, in practice, if the users take your company to court, it will be held liable because: users are allowing us to read their CRM data and once we get the data, the data become ours, and we can do whatever we want with it. Is this true? While the users are still allowing you to read their data it is completely up to the Terms/EULA what you can do with it. However, once you have made the users think that they have withdrawn your access (e.g. they "deleted" oAuth tokens), you are no longer authorized to read the current data (although the Terms may still allow you to use the old data you obtained when you had access). Silently continuing to access their data without their knowledge/approval is definitely a deceit. The CEO wants us to download all of their emails and store them in our database There would be nothing wrong with that if it was in the Terms. But if it is not, that would be a blatant (and easily punishable) breach of privacy. Note that you may also be held personally liable for this wrongdoing (if/when proved so). "Just doing your job" claim will not work.
This appears to be very clear to me: "NPR does not allow other websites to post our content..." I cannot think of a more clear way to say "Do not reproduce our content on your site." Since you asked about licensing the right to reproduce their content, and they flatly ignored your request, I think it is safe to assume that they are not interested in licensing that right to you, even for a fee. This is also consistent with their "NPR does not allow [any] other websites to post..." language. It is always the copyright holder's right to refuse to offer any particular person (or all persons generally) a license, no matter what payment they might offer. (With the exception of statutory licenses, which in the U.S. exist only for recording covers of musical works.) They have also ignored your request to recompense them for infringement already performed. If in the future they decide to take legal action against you for your past infringement (hugely unlikely that such a hassle would be worthwhile for NPR) or seek any out of court settlement (again, quite unlikely they will care enough), I'm sure they will let you know. As they've said in their email, you are welcome to link to NPR's content. You are, of course, not welcome to spread misinformation or lies about NPR by claiming something like, "Look at this wonderful article that NPR wrote purely for us, at our personal request," or "NPR thinks that In Home Teaching Agency XXX is a great company, so we built a curriculum around their content," when NPR has never said any such thing. Any legal issue around linking would probably be a trademark offense, by wrongfully suggesting that NPR endorses you, or by misrepresenting yourself as an agent of NPR. If you don't do either of things, and just say, "Here's an article on [subject X] published by NPR," you're probably fine. If you want to be very thorough, you could include a disclaimer on your site like, "In Home Teaching Agency XXX is not a licencee or partner of NPR. Links to NPR articles are included for educational purposes only," or similar. This seems pretty excessive to me, since a reasonable person won't assume that linking to an article from a major news source suggests a partnership, but I suppose it couldn't hurt to include such a disclaimer.