Does a company have the right to perform MITM SSL stripping attack on their employees? Does a company have the right to sniff all the traffic on their network irrespective of whether it contains personal data of employees if they show a warning message which states "...are subject to having their activities on the system intercepted, monitored and recorded." Does US law states anything about this? Does company policy enforcement with such a warning override the right to not be subject to surveillance?
IANAL, and as @GeorgeBailey suggests, you should ask one. That said, some aspects of your question are directly addressable with what we know. Does US law states anything about this? Yes. Federally this falls under the Wiretap Act, 18 U.S.C. §2511. Workplace monitoring generally falls under either the "System Administrator Exception" or under Consent. In general, continuing past a banner constitutes consent. Does company policy enforcement with such a warning over ride the right to not be subject to surveillance? In general, yes. You don't need to use the companies network if you don't want to consent - and they don't need to hire you if you don't want to use their network. But it's their network, and their rules apply. There are some nuances, and courts have found that the wording of the notice has made a difference in some cases, but overall, if the systems are properly posted with banners, then the employer may capture communications. See the "Bannering and Consent" section of this article from cybertelecom.org, e.g.: Even if no clicking is required, a user who sees the banner before logging on to the network has received notice of the monitoring. By using the network in light of the notice, the user impliedly consents to monitoring pursuant to 18 U.S.C. § 2511(2)(c)-(d). Note that stored data is covered by different laws than communications. It's a nuance. Is it ethical to sniff all the data without giving any other warning than the logon banner? "Ethical" is a very different question than "Legal", and largely more subjective. Most employers require signed consent for monitoring as a condition of employment, and use banners thereafter. That is ethical by my definition, in that it meets or exceeds the requirements of the law, and does not mislead or use subterfuge. The tone of your question suggests you find it distasteful, and therefore probably it violates your personal code of ethics.
Your VPN scenario is why you have to show the banner to everyone. If you somehow knew beyond any doubt that someone was not in the EU, then you would not have to show a banner, but because you can't verify that, you should always show the banner. Doing so also protects against accidentally violating a similar law in another country; the GDPR is the best-known privacy law, but it is far from the only one. It's good practice to ask for people's permission before collecting their information anyway.
This would be illegal in Australia (Criminal Code Act 1995 part 10.7: any unauthorised impairment of electronic communication to or from a computer), the US (Computer Fraud and Abuse Act) and any other jurisdiction that I can think of. There is no exception allowing vigilante action in case a person has a reasonable belief that the material on a website is offensive or illegal. In general, the law does not allow immunization against criminal prosecution in case the victim of an attack is himself a criminal. Only the government has the right to punish criminals.
Art. 17 GDPR Right to erasure (‘right to be forgotten’) The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: Assuming private messages contain personal data, if at least one of the following points (a..f) applies, it would have to be deleted. (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; The original main purpose was probably Article 6(1)(b) (performance of a contract). If you delete your account, that would no longer apply. However, for the receiver of the private message, Article 6(1)(f) (legitimate interests pursued by a third party) would apply. The receiver might still want to read that message. So there is still a purpose to process this data. So point (a) does not apply. (Note that a Facebook private message can be considered a hosted version of SMS messages. A receiver does not expect SMS messages to be automatically deleted after they have reached the recipient's device. A receiver expects full control of the storage of SMS messages. I think a receiver expects the same for messages on facebook.) (b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; Data processing was not based on consent, so point (b) does not apply. (c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); Article 21(1) allows you to object to processing based on Article 6(1)(f), unless there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject. While I think processing is based on Article 6(1)(f), I also think there are legitimate grounds to refuse your objection. As explained before, the receiver might still want to read that message. The receiver was able before to read your message, so one can assume he/she has already knowledge of the personal data in the message. As it is a private message, no one else will be able to read that message. (At least Facebook will not allow it). So if the message is not deleted, the privacy implications for you are low. That's why I think the interests of the receiver will prevail. However, in the end, a judge will be the only person which can make such a consideration. So you would have to got to court to get a final decision about this. Article 21(2) is for direct marketing, that does not apply to this situation. So I think point (c) does also not apply. (d) the personal data have been unlawfully processed; (e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; These points do not apply. (f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1). This data processing was not based on consent, so even if you are a child below the age of 16 years, point (f) does not apply. Article 17(2) and Article 17(3) wont help you either. So in my opinion Facebook is right in this case.
You are granted the free trial as part of a trial, not to permanently use the program. When the user downloaded the trial version of the program, he probably had to accept T&amp;C granting a one-time only say 3‑month trial period. It is a mere breach of contract if you’re circumventing this, but you might still be liable to damages. Circumventing technological protection measures is forbidden, § 95a UrhG. However, these protection measures must be considered effective. Now, lawyers are usually no computer gurus, so they might arrive at completely different conclusions, but I guess/hope editing a plain text file, substituting a plaintext ISO 8601 date, will not be deemed “effective”. (I presume the same effect could be achieved by resetting the computer’s RTC.) Having said that, since you intend to “publish a guide […] detailing how to use this exploit” I suspect it might not be that trivial and thus, from a lawyer’s POV, be considered an “effective” technological protection measure. If it is considered an effective technological protection measure, you might be punishable via § 108b UrhG, but I’m not sure about that. The wording is terribly complex.
It's illegal. 18 USC 1030, the Computer Fraud and Abuse Act, makes it illegal to, for instance, &quot;intentionally access a protected computer without authorization, and as a result of such conduct, cause damage and loss.&quot; A &quot;protected computer&quot; is defined to include any computer &quot;which is used in or affecting interstate or foreign commerce or communication&quot;. This effectively includes every computer in the world that's connected to the Internet (see US v. Trotter, 478 F.3d 918 (8th Cir. 2007). To the best of my knowledge, Congress has not added any exceptions for Russia or any other specific country. It's also likely to be forbidden by the laws of your state. You did not specify a state, but taking Colorado as an example, the following are crimes under C.R.S. 18-5.5-102: (a) Accesses a computer, computer network, or computer system or any part thereof without authorization; exceeds authorized access to a computer, computer network, or computer system or any part thereof; or uses a computer, computer network, or computer system or any part thereof without authorization or in excess of authorized access; or [...] (e) Without authorization or in excess of authorized access alters, damages, interrupts, or causes the interruption or impairment of the proper functioning of, or causes any damage to, any computer, computer network, computer system, computer software, program, application, documentation, or data contained in such computer, computer network, or computer system or any part thereof; or (f) Causes the transmission of a computer program, software, information, code, data, or command by means of a computer, computer network, or computer system or any part thereof with the intent to cause damage to or to cause the interruption or impairment of the proper functioning of or that actually causes damage to or the interruption or impairment of the proper functioning of any computer, computer network, computer system, or part thereof [...] Note that this applies to any target computer, and the prosecution would not have to prove that the computer was used in, or affected, interstate or foreign commerce or communication. Other states most likely have similar laws.
Belgium enacted an implementing law, the Act of 30th July 2018 on the protection of natural persons with regard to the processing of personal data. This, along with the GDPR, are the key legislative references that relate to your question. On 5th September 2017 the ECHR judged that it "considers that States should ensure that, when an employer takes measures to monitor employees' communications, these measures are accompanied by adequate and sufficient safeguards against abuse". This case set a precedent relevant to employee monitoring in Belgium. This is most definitely a data protection or privacy law matter and the DPO should be consulted. If they have to do research, that shouldn't be your concern as that is their job. The company must support the DPO in what they need to do that job, as such is literally written into the GDPR. Furthermore, in this case it would, by my evaluation, be necessary to conduct a Data Protection Impact Assessment (DPIA) for the monitoring activity, and if one has been done, it should document the recommendations and requirements or what is already in place. You as an individual may also ask a question of the Data Protection Authority: (NL) https://www.gegevensbeschermingsautoriteit.be/verzoek-klacht-indienen (FR) https://www.autoriteprotectiondonnees.be/introduire-une-requete-une-plainte You might ask them about your position and liability as an employee, but I would be more concerned, if I were you, with verifying that your actions are above board rather than trying to cover your ass just in case they aren't. Do the right thing, even if that means questioning the direction you've been given. AD logons still identify the person logging on, and may include source IP, which is specifically listed in the GDPR as within the scope of 'personal data'. So while there may be a legitimate need to process such data, it needs to be gone about in the right way. Actions taken by an employee are taken by the organisation in terms of processing personal data, so whatever you are asked or ordered to do, will be done by the company. If you are being offered no legal justification for doing so, you might document the direction you are given and question it respectfully, pointing out that if found to be unlawful, it is the company that would be in trouble, all while knowing that should there be for example an unfair dismissal, you have a record of who asked you to do what, how you challenged or questioned it, and what was the outcome.
A creative prosecutor could probably come up with a raft of charges. But you could start with the federal wiretapping statute, 18 USC 2511, and the anti-hacking statute, 18 USC 1030. Here is an indictment brought in 2012 under the anti-hacking statute against someone who distributed and used this kind of software. Depending on the facts and the jurisdiction, this may also constitute the tort of intrusion on privacy or seclusion, a tort recognized by the Restatement (Second) and actionable in many jurisdictions. The most common test is whether the invasion would be "offensive to a reasonable person." And no, contrary to the commenter's view, a "click to accept" license is not a get out of (literal) jail free card here. Courts interpret adhesion contracts liberally to favor the signer, and outrageous terms hidden in small print are not guaranteed to be enforceable, especially if the software is clearly designed to trick people into installing it. The license terms might even hurt you, by providing evidence of your intent to use the software for perving rather than its ostensible use. This is not an exhaustive list, and there may be additional state-level statutes that apply. Bottom line: yes, this is clearly illegal, and the courts will be reluctant to let you trick people into getting away with it.