Does legality of an computerized action depend on user location or computer location? Now of days it's quite easy to have a computer in a completely different part of the world from where I'm located that I'm working on. This makes me wonder how 'criminality' is defined if the laws of my home country differ from the country the computer is in. I'm wondering at what point the location of a server/computer decide the laws that apply to it and at what point it's the location of the user that matters. To give some examples, not so much expecting answers to all of the below so much as explaining my confusion of distinction in case it informs an answer. For example, lets say I choose to view material that is not legal for me to view in my home state (copyright material I haven't payed for, some type of outlawed pornography, some sort of state secret I'm not suppose to see etc), but which is legal to view in the country in which some server I connect to is located. I'm pretty sure I've committed a crime, even if the computer providing the data is illegal, but is this only because the data was copied to my computer? If I use some VNC technology that shows me the screen of another computer located outside of the US to view this data without any of it stored or cached on my computer, am I still committing a crime (I think so?) On the other hand I see servers located outside of the US doing things that would be illegal in the US, online gambling, 'spamming' people, selling things without paying US taxes etc. Can I connect to a server for any reason and still be legal? If amazon want's to have a server in some country X and pay that countries taxes instead of US taxes can someone from the US still connect to that server to do anything at all with it without suddenly being guilty of violating a law because that server isn't abiding by US law? If it's the location of the user that matters then does that mean I can use a computer outside the US to do something that is illegal in that country? If I'm in the US and using a cloud computer hosted in say the UK and for some reason I end up doing something with that computer that is 100% legal in the US but isn't legal in UK (maybe some data is allowed to view here that isn't there?) have I broken the law in UK? If I happen to travel to UK at some later date could a zealous prosecute arrest me because of the location of my computer? (I realize this last question is probably comes down to "it depends on the country", but generally speaking for countries that practice common law is there a consensus that most countries agree on?)
The general answer is "yes." Who ever said that only one set of laws applied? Jurisdiction isn't a matter of "one country's laws matter here, let's find out which one it is." All jurisdiction means is that your laws apply to the conduct, not that no one else's can as well. Broadly, there are a few sources of jurisdiction that are generally considered legitimate (to at least some degree) in international law: Territoriality: You have jurisdiction over actions performed in your territory. You also have jurisdiction over crimes where just one part of the crime happens in your jurisdiction (e.g. standing in country A and shooting someone in country B), or even if it just has a significant effect in your territory. Nationality: You have jurisdiction over crimes committed by your citizens anywhere in the world, regardless of whether or not they were breaking the law of wherever they were. Passive personality: You have jurisdiction over crimes committed against your citizens anywhere in the world. Protective: You have jurisdiction over crimes directly harming core state interests, like counterfeiting your passports or sabotaging your warship. Universal: A handful of crimes (like piracy or genocide) are so serious that every country in the world can exercise jurisdiction. If you catch a pirate, you can punish them. These are accepted to different degrees. Passive personality and protective jurisdiction tend to be iffier; territorial jurisdiction is unquestioned (although if it's just based on effects in your territory, it becomes a bit iffier as well). But any of them can be a basis for jurisdiction. If multiple countries have jurisdiction, whoever actually has the offender decides who will try them (jurisdiction to make an arrest is limited to the country in which the arrest is made). So: If you're located in a country, you have to comply with their laws, and they can regulate just about whatever they want, including what you're doing to foreign computers. The foreign country can also generally regulate what you're doing, because part of what you're doing is happening on their territory. Even if both you and the computer are in a foreign country, you may have to answer to the courts of your country of citizenship. Depending on what exactly you're doing, the protective principle may come into play. For instance, if you hack into a computer on a foreign military base, the foreign country could prosecute you for endangering their security. If you're coordinating a genocide, universality applies and anyone can prosecute you. If you hack the computer of a foreigner, passive personality may apply, although this tends to be controversial.
If you are charged under the laws of Estonia (or Australia or Thailand or the UK) then the laws of the USA have no relevance whatsoever. It makes no difference if you are a US citizen, if the alleged crime happened in the USA or was perpetrated against the USA. If nation X has jurisdiction then you are tried under the laws of nation X. That is what sovereignty means. As to your specific example, Facebook does business in Estonia, therefore they are subject to Estonian law, as a US corporation they are also subject to US law and the law of every other jurisdiction they operate in (see why they need big legal departments?). If a legitimate Estonian warrant was served on them to disclose metadata or anything else then they are legally obliged to do so or be in contempt of court. Oh, and by the way, the first amendment right to free speech does not give you a right to anonymous free speech.
It is probably illegal, just not pursued. In the case of something like bank robbery, you'd have a victim that filed a police report. A murder would need to be discovered somehow - either a missing person report or a dead body. If the porn shoot happened somewhere that a member of the public saw it and subsequently filed a police report, the video could be used as evidence. Absent a report, the police simply have no reason to look into it (unless the police catches them in the act, but we probably don't see those videos posted online). Why would these public offenses go unreported? Perhaps nobody sees it. Perhaps the bystanders in the video are paid extras. Maybe they're filming in what appears to be public but is actually private property. Perhaps they have a permit to use a public space for this purpose. Perhaps they just got lucky. Again, there might be some confirmation bias here - you're not going to see as many videos of folks they catch breaking the law, since they will either be interrupted and stopped or (maybe) have their videos ordered taken down.
I infer from the use of the past tense &quot;worked&quot; that you no longer work for the company in question. Also, from the fact that you are wondering whether there might be negative consequences, I infer that you do not have permission to use the systems in question. The specific consequences will depend on where the company and its computers are located, as well as on the nature of the systems you log in to and on what you do with those systems, but it's certainly possible to receive a penalty of several years' imprisonment. The fact that you created the system in question makes no difference.
The conditions for lawfulness of processing are spelled out in Article 6 of the GDPR. As for it being legal for website operators to log the IP-addresses of visitors, this is covered by the following paragraph (also pointed out by phoog in a comment). The paragraph says it is legal to process personal data if processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. (my emphasis) You are not the only web site that logs IP addresses for the purpose of security. Every web site I've ever worked on - from those controlled by large corporations to tiny NGOs - do this. This security practice will not be impacted by the GDPR (if it were, I am sure we would have heard about it by now). there is the EU cookie law too If your website are going to be accessible to European citizens and not only accessible by your friends and familiy, you have to comply with the EU cookie directive of 2002 (a exemption for "personal websites" does not exist).
This answer is limited to United States law. The situation in other countries is definitely different. Under United States law, the owner of a lawfully made copy of a copyrighted work has, as a right of the physical possession of that work, the right to the work's ordinary use. Licenses grant you additional rights such as the right to make derivative works, the right to make copies beyond what's needed for ordinary use, and so on. A pure license doesn't ask for anything in return, it just gives you new rights. Those rights may be conditional, but the conditions are just things you have to do to get new rights. They're not conditions imposed on any existing rights you had. A contract is an agreement between two parties. Both parties must agree to a contract for the contract to be enforceable. Contracts can take away rights you otherwise have. You don't need a license or contract to use a copyrighted work if you lawfully possess a copy of that work. Say you download a copy of a work covered by the GPL. You can refuse to accept the GPL license and you can still use that work. Why? Because no law prohibits you from doing so and there is no civil cause of action for using a lawful copy of a work under US law. But now say you want to give a copy of that work to your friend. This is illegal under US law because 17 USC 106 restrict that right to the copyright holder and there's no applicable exception since that's not part of the ordinary use. For a work covered by the GPL, the license offers to give you that right, a right you wouldn't otherwise have. It imposes conditions on you that are specifically in exchange for the grant of the new right. If you do accept the GPL, it functions as a contract. You got in exchange a right you didn't have before and if you don't comply with the GPL's terms, you don't have the copyright holder's permission to exercise those rights which is required under the law. By contrast, a click-through or EULA takes effect when you agree to it and such agreement is a condition for using the software. That's a pure contract and usually doesn't give you any rights you wouldn't have in the absence of such an agreement other than the use of the software.
Yes, this violates the GDPR if the user is in Europe. Data which is tied to a personal device can be tied to the person who owns it. From "What Is Personal Data" by the UK Information Commissioner's Office (ICO) (emphasis added): Personal data is information that relates to an identified or identifiable individual. What identifies an individual could be as simple as a name or a number or could include other identifiers such as an IP address or a cookie identifier, or other factors. If it is possible to identify an individual directly from the information you are processing, then that information may be personal data. If you cannot directly identify an individual from that information, then you need to consider whether the individual is still identifiable. You should take into account the information you are processing together with all the means reasonably likely to be used by either you or any other person to identify that individual. The bit about "all means reasonably likely" in the last bullet includes the kind of de-anonymisation tactics described in the NYT article. There are 6 lawful bases for data processing in the GDPR, and all processing must fall under at least one of them. (a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose. (b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract. (c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations). (d) Vital interests: the processing is necessary to protect someone’s life. (e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. (f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.) Selling data isn't covered by any of the others, so consent must be obtained. Permission must be clear and positive, and you cannot predicate delivery of a service on the processing of data that isn't necessary for that service. So for instance you cannot say "You can use this service as long as we are allowed to collect and sell your data" because selling the data isn't necessary to the provision of the service. From "Consent" by the ICO: Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent. Explicit consent requires a very clear and specific statement of consent. Keep your consent requests separate from other terms and conditions. Be specific and ‘granular’ so that you get separate consent for separate things. Vague or blanket consent is not enough. [...] Avoid making consent to processing a precondition of a service. This applies to any processing of data about individuals within the EU, so just being an American company doesn't get you a free pass to ignore the GDPR if your app gets used by Europeans. The "Legitimate interests" basis is more problematic, in that the company collecting the data has to conduct a vague "balancing test" to determine if this basis applies. For direct marketing the ICO has written this, which says that direct marketing may be a legitimate interest, especially if you can show that the user has expressed interest in such adverts. For instance a location service which promises to tell you about nearby special offers would fall into this category. Against this, the impact on the user's privacy has to be considered, and location data is "special category data" because it can reveal medical information (e.g. hospital attendance) or religious affiliation (e.g. which church you go to). So unless the relationship between the recorded location data and the service is very direct its not going to pass the balancing test. The company would also need to distinguish between knowing the current location and keeping a record of historical locations; the two need separate justification. And of course nothing about this covers the sale of the data; this is considering a company which sells advertising space in it's app, not one that sells the data itself.
The purpose of the button is not to put liability on you, but to shield the website from liability. The website does not want you looking up information about drugs, deciding that a particular drug is right for you, causing yourself harm and then blaming the website. You may have acted unlawfully but you would have no liability because no injury (financial or otherwise) has been caused to the website. Clicking the button is an assertion that one is a medical professional. This is a false statement, so the website could sue you for the tort of deceit, but there is no injury, which is one of the elements of deceit. The website would not even get nominal damages. The button may also constitute a contract. In exchange for access to a website, you warrant that you are a medical professional. You are not, which is a breach of the contract. However, the damages are nil. Conceivably, if you passed the information on to someone else who misused it, there may be some injury to the website, and then you would have to compensate the website for that injury under one or both of the heads of liability described above. In terms of criminal liability, it is rarely an offence to make a false statement to a private body without some other aggravating element. For example, in Australia, it is an offence to make a false statement for financial gain, or to make a false statement to a government official (regardless of whether there is financial gain etc). But simply making a false statement is not by itself a crime. You may breach a computer law. The United States Computer Fraud and Abuse Act is pretty broad. Obtaining information from a computer without authority is an offence: 18 USC s 1030(a)(2)(C). The only exception is if the web server is in the same state as you and somehow nobody from outside the state can access it: see definition of 'protected computer' in 18 USC s 1030(e)(2).