Is it legal to make encryption breaking technology public? Much of our critical infrastructure relies on encryption as the bedrock of its security. Encryption, however, is a practically a &quot;very hard&quot; mathematical problem that will take eternity to solve with current technology. Let us say someone using the Ballmer's peak to their advantage (lol) develops an algorithm that allows us to solve that incredibly hard math problem in minutes. Is it legal for them to open-source this algorithm and also publicize about how it can help break encryption (they never talk about stealing)? I get that someone using the algorithm to break into someone else's system is a crime, same as robbing something from a house for which you can now make the keys. But open-sourcing such a critical solution will empower bad actors and nation states to hack other's systems regardless. Is our boy-genius developer legally (not ethically) obligated to do anything if they make such a discovery?
There are two processes that go on all the time, and are generally considered legal: Encryption algorithms are attacked by cryptographers and weaknesses identified. In most cases this results in a gradual reduction of the work required to break the algorithm by a few orders of magnitude at a time. The history of SHA-1 is a good example of this. People identify security holes in software and follow responsible disclosure rules. This means that they notify the vendor and give them an opportunity to fix the bug before going public. Note that this is merely considered good practice; immediate publication would be legal too. Your scenario sits at the intersection of these two processes: an attack (process 1) which completely destroys the security of many systems (process 2). Responsible disclosure occupies a legal grey area: someone who finds a bug might have had to exploit it to at least some degree to demonstrate it, and there have been cases where vendors have used police or courts to retaliate. However this wouldn't apply to your scenario. In America the First Amendment makes it unconstitutional to use the legal system to stop people saying true things (copyright excepted, and untrue things are often legal too). If your Wunderkind lives in America then a widely published factual description of their solution would therefore be legal. Legal problems only start if they provide the details in secret to people they should reasonably suspect of intending to use them for crime.
A proof can be protected by copyright. The underlying facts of math cannot. But if one has copied details of the order of the proof, or of the selection of theorems to use, and if several other choices would have been possible, then the new proof may constitute a trivially modified copy, or a derivative work, and in either case making of it might be copyright infringement. However, making and distributing a copy, even with no changes at all, for purposes of comment and criticism, might be fair use in the US, fair dealing in the UK or some other parts of the Commonwealth, or fall under an exception to copyright in other countries (these generally vary significantly by country). This is usually a very fact-driven question.
If law enforcement is actually requesting an encryption key, talk to a real lawyer. To answer your first question, the answer is &quot;the government probably can't demand the password, but might be able to demand the data.&quot; Some courts have ruled that the Fifth Amendment can prevent courts from forcing someone to decrypt data for the government, because the act of decrypting the data conveys information (see United States v. Doe from the 11th Circuit). Other courts have ruled that there are situations where that is not the case (US v. Fricosu, In re Boucher). Boucher is particularly interesting because the government first asked for the password itself, and then (when that subpoena was quashed by the magistrate) narrowed its request to the decrypted data on appeal. In the magistrate's opinion, we see Also, the government concedes that it cannot compel Boucher to disclose the password to the grand jury because the disclosure would be testimonial. It is not generically a violation of the Fifth Amendment to compel production of documents (the 11th Circuit, quoting the Supreme Court, considered this a &quot;settled proposition&quot;). The issue is that the act of producing the documents can be considered testimony -- by producing the documents, the person is showing that they know the documents exist, where they are, how to read them, etc. Possession of the key to decrypt a file links you to that file, because keys are generally kept secret. In the 11th Circuit case, the court found that the government didn't know for a fact that a) Doe could decrypt the files, and b) what files existed on the encrypted drive. In the cases where forced decryption was allowed, the government had seen enough to independently show that the files existed, were authentic, and that the defendant had actual control/possession over them. The 11th Circuit asked for a bit more (the location), based on a standard that is in effect in some circuits but not others. In any event, courts seem to generally consider this to take a court order to force production of anything; the police can't just order you to do it.
Using Tor is not illegal. Nor is hiding your IP address, which is - among other things - what Tor does. Going to .onion links is not illegal. What you find and interact with at those .onion sites may be illegal. See Law StackExchange Is it legal to host a directory of .onion urls? Running a Tor Relay is not illegal. That could change. Running an Exit Relay could expose your IP address as the Relay, so that could lead investigators of illegal activity to you. Read https://www.torproject.org/eff/tor-legal-faq.html.en As always, check your state laws http://statelaws.findlaw.com/criminal-laws/computer-crimes.html And do your own research with the links above and at https://en.wikipedia.org/wiki/Tor_(anonymity_network) and at https://www.torproject.org/
Per the comment, the applicable license term seems to be Licensee agrees to maintain in confidence the source code version of the Licensed Software by using at least the same physical and other security measures as Licensee uses for its own confidential technical information and documentation, but in no case less than reasonable measures. So if your own code is on a physically unconnected thumbprint-secured blah blah blah computer deep in a mountain, with files encrypted, so must theirs be. If yours is stored in &quot;the cloud&quot; with decent password protection, theirs must be as well. This seems to describe your Github use (I don't have any knowledge of the degree of hackability of private Github repositories). The legal judgment as to whether this is &quot;reasonably secure&quot; is based on whether a prudent person would know that it is practical to gain unauthorized access. Protecting a file with the password &quot;password&quot; would probably be found to be unreasonably insecure.
can it be construed as a violation of 66F clause 2 if we try to circumvent the rate limit even though the information is on public domain? No, unless the element of intent to threaten [...] or strike terror can be proved. I'm assuming that by &quot;clause 2&quot; you mean the excerpt you posted. Although circumventing the limit of API calls sounds in &quot;exceeding authorised access&quot; and might even lead to DOS, it does not imply an intent to threaten the security/sovereignty/etc. or strike terror. The statute is premised on such intent. The fact that the information(packets) is(are) on public domain is irrelevant. For instance, an intent to strike terror and/or actually causing a DOS can involve [targeting] a public domain.
This sounds a bit far-fetched. There are laws against circumventing copy protection measures (DRM) but not against aimbotting (to the best of my knowledge). Thus, you cannot reasonably believe that a click-assist functionality would be used to break laws. It could definitely be used to break private contracts such as an EULA, but you are not a party to that contract and are not bound by its terms. Of course, when you use such click-assist tech in an online game, you might be breaking your contract with the game vendor or server provider. But this doesn't imply that a click-assist would be forbidden outside of that context. Note that assistive technologies sometimes have exceptions from laws, e.g. a permission to circumvent DRM if necessary for accessibility. In the US, the Librarian of Congress adopts exceptions for a duration of three years. While none of the current exceptions match your specific scenario involving video-games, it can be permissible to break DRM on e-books or videos for certain accessibility enhancements.
Yes The relevant legal concepts are copyright, contract law and the Computer Fraud and Abuse Act. You are liable to be sued by the people affected for damages and/or be prosecuted by the government for the felony under either or both laws. Let's start here: "I bought a game". No, you didn't; you bought a licence to use the software in accordance with the terms of service (licence) that you freely agreed to. All modern ToS will not allow you to reverse engineer the software. If you breach those terms of service then you have broken a contract - that is what allows them to sue you. They will no doubt argue that the prevalence of cheat routines developed by people like you reduce the number of people willing to play the game - say 100,000 users x $10/month * 12 months = $12,000,000. They will also ask the court to impose punitive damages to discourage this sort of thing. Which brings us to the copyright violation. You are allowed to copy their software provided you comply with the ToS. But you didn't. Therefore you are in breach of the Copyright Act and subject to additional civil and criminal sanctions. Finally, your "cheats" access their servers in a way that the ToS doesn't authorize. This puts you in breach of the CFFA - breaking this carries serious jail time penalties. Not to mention that in the US, a criminal conviction will preclude you from many jobs, including, naturally, any with access to company computer systems. Putting aside the illegalities, cheats are unethical and ruin the game experience for hundreds of thousands of people who don't use cheats. You are a criminal - stop being one!