Can it be illegal to press f12 in a web browser? There is a case in the news where a journalist identified a security issue in the web site of the Missouri Department of Elementary and Secondary Education that exposed 100,000 social security numbers. He did this by viewing the source of the page, using the f12 hotkey or right-click and selecting &quot;Inspect&quot; or &quot;View page source&quot; depending on your browser. When he made this discovery he disclosed the vulnerability to the DESE, and delayed publishing an article on the discovery until the department removed the vulnerability and worked to find if any other related sites and applications contained similar vulnerabilities. The response of the Missouri Governor Mike Parson was to accuse the reporter of hacking under Section 569.095, RSMo. While the County Prosecutor has announced no charges would be filed this has involved four months of harm to the individual and their family and the Governor maintains that Renaud had unlawfully hacked the school website. A somewhat similar case is the 2017 case of the Hungarian teenager who identified a bug in the Budapest Transport Authority (BKK) website that allowed anyone to set the price of a ticket. He demonstrated the flaw by buying a ticket, and told the BKK by email. He was arrested. He lived outside of Budapest and could not use the purchased BKK pass. There are four aspects that seem to me could give rise to legal risks, but I have no idea if any could reasonably give rise to successful charges in cases such as this: Use of developer tools on third party web sites The developer tools in modern browsers are very powerful tools. One illustration of this is to select the &quot;Debugger&quot;, and the &quot;Pause on any URL&quot;. This gives one a view of the activity of many web sites that is not intended by the developer, particularly those using the cloudflare tools. It also produces a human readable version of minified javascript, which is produced to be machine readable. This is not decompilation as javascript is not a compiled language, however functionally it is like applying a java decompiler to a java web start application for example. I think it has been claimed that the DMCA can criminalise decompilation, could such a law be used in this case? Decoding the data within the web site As I understand it the SSN's were encoded in Base64, whereas the rest of the website was another encoding (ascii?). This may have involved a separate tool to be identifiable as an SSN, but may well not as javascript includes the functionality (the function atob()) and many developers can do a rough job in their heads. Is it possible that one can commit a crime by inappropriately decoding strings in common formats, perhaps even in your head? Handling of potentially erroneously exposed PII If one comes across personally identifiable information (PII) on the internet I would assume there are things you can do that are illegal. I am not sure what they are, but I do know that the accepted way to handle security issues in software is to inform the organisation responsible and wait an appropriate time before publishing the issue. This is roughly what the reporter did in this case, but are there any specific legal measures that one can take in such situations to ensure one is not breaking any laws? Fraudulently gaining something If one actually exploited a software error to get a material benefit, such as cheap transport, it seems that one could be committing fraud. If one makes a purchase to demonstrate a flaw and tell the organisation about it without making use of the purchase can this be illegal, or does one need to intend to actually gain a benefit? Any jurisdiction would be interesting, particularly any that has actual case law of such actions being found to be illegal.
The law is really bad at protecting whistleblowers From my understanding of US law, this is not unauthorised access to a computer: the reporter made a legitimate request to a remote computer, that computer provided data,the reporter accessed the supplied data on their own computer. However, pointing out the failures of people in power is fraught even if it is not illegal. It is certainly within the Governor’s power to authorise an investigation of the reporter. On the face of the law, it seems reasonable to suspect that what was done might be a violation so there is nothing legally wrong with initiating an investigation. I suspect that such a broad interpretation of the law would fall foul of the First Amendment which may partly explain why it wasn’t prosecuted: the government doesn’t want to find out. Similarly they can issue press releases, which, due to the First Amendment, don’t have to be true, just not defamatory. Saying it’s a possible violation is true and not defamatory. Saying the reporter was an evil person who is only doing this for political purposes is a statement of opinion and not defamatory. It’s a fact of the world that people with power can use that power in ways that are malicious, unethical, and unfair but not necessarily illegal.
I don't think the issue is that it is a violation of a law, but rather that it is a violation of the terms of service you agree to when you sign up for the site - which is a breach of contract. You can be sued for breach of contract, if the site can prove any damages based on your breach. So if you use a bot to make money on a site, in violation of the site's license agreement, then I believe the site could indeed sue you to get the money back. Also, the phrasing of your question ("creating a robot") raises a separate issue. It is not actually creating the bot that is illegal, but using it where not allowed can be a violation of contract. Suppose person A makes a poker bot, just as a programming exercise, and doesn't use it. But then suppose person B uses the robot created by person A on a site that forbids it. Although this could be a gray area, I do not believe the site would have any recourse against person A (even though they probably would against person B).
One way in which it holds legal water is that if you use the website in violation of the terms, then you may forfeit your right to take civil action against the company. Analogous language especially regarding the age of the user may protect the site against actions by third party governmental entities (COPPA-like laws), though nothing patently obvious springs to mind (insofar as this deals with firearms and there is also an age 21 restriction both on the web site and in terms of US firearms law, this is not a totally crazy idea). The citation of 18 USC 1030 non-probatively points to an issue which may be disposed of by SCOTUS in US v. van Buren, that knowingly violating the terms of service is a crime (a proposition rejected by lower courts, see US v. Valle). Facebook v. Power Ventures in particular clarifies how &quot;being put on notice&quot; may make such unauthorized access indeed &quot;unauthorized access&quot; in the statutorily-relevant sense. This does not prevent a legally-authorized law enforcement investigation, pursuant to para (f), but if the &quot;violation of TOS = unauthorized access&quot; theory is upheld, it limits how LEOs can legally access the website (and the limitations extend past LEOs). It is a separate and potentially interesting question whether there actually are any legal limits on the investigative powers of the government – if any law enforcement officer has the liberty to investigate anyone they want, with no supervision or requirement of justification, then this would be a rather gaping loophole in their legal strategy. Web pages involve massive copying of copyright-protected data, and the function of terms of use is in part to conditionally grant access to that copyright-protected content. When a person copies protected material from someone's web page having been explicitly denied permission to copy, they run the risk of an infringement lawsuit.
What you're talking about is called black-box reverse engineering. It can be done, and as long as you are meticulous in your record keeping the fact that it has been done should be an appropriate defence against copyright infringement. But that doesn't help against patent claims - while in copyright cases the fact that code has or has not been directly copied is critical, in patent cases it its irrelevant: if you use a patented method, it's a violation. You therefore will need to be careful about any patents that may have been issued to the original author, as well as avoiding copying.
It is probably illegal under Indonesian law for you to launch a cyber-attack on a website that you believe violates Indonesian law, just as it is illegal for you to shoot a person for fraud. The Indonesian government reserves the right to judge guilt or innocence, and to mete out punishment, within Indonesia. It is definitely illegal under US law, also UK law and so on, to launch a cyber-attack on a website for some reason, so you can be prosecuted under the laws of that nation. You should then be concerned with the Law on Extradition (1979), noting that there might be a treaty but also Indonesian law allows extradition on the basis of the interest of Indonesia (as judged by government officials). Indonesian nationals do not enjoy immunity from extradition (as is the case in some countries). There is no extradition treaty between Indonesia and the US; there was one between the UK and Indonesia but I cannot determine whether it is still in force.
It is reasonable to interpret the statement in their Github repository README.md as a "public domain" license for anything contained there. However, their "usage guidelines" backpedals a bit ("generally are not copyrighted", the misleading implication that content used commercially is subject to restrictions that educational and personal uses are not subject to). Although it is true that works "created by the US government" are not protected by copyright, not everything associated with a government agency is created by the US government. An agency might have a policy that they will not post material that is not copyright-free, there is no practical means of knowing if an item is an actual government work, versus a government-supported or government-hosted work (where copyright is held by someone else). If you trust their implication that all of those items in the repository are indeed government works, then they are free of copyright. I don't know any reason to not believe them, although sometimes the government is wrong and they end up liable big-time for infringement. However... NASA Open Source Agreement Version 1.3 (another copy on a NASA web page) on first glance seems to contradict the "government work" theory. Here, they claim to grant certain rights to users and also impose impose restrictions (including obligatory registration). This does not make any sense for a work that is in the public domain. The license is legally defective in that it fails to fill in relevant blanks (agency name, title of work, URL for obligatory registration). Also notice that the license is only for software. The scope of that license therefore has to be something narrower – it applies only to software, and presumably software that is not "a government work". I have no idea what software NASA could legally give away and is not a government work which is therefore not protected by copyright.
In my opinion, you are totally free to publish the information. There are two areas of law that can be cosidered - private and public law. In the private law area, you can be liable for revealing trade secrets, but only if you agreed to keep them by a contract. Trade secrets do not exist by themselves (there are minor exceptions, eg. in competition law, but those do not concern us), they must be protected by contracts. Another private limitations, like libel laws, won't apply here. This is not uncommon, but not in cars - you can find clauses like these in software license agreements. Then there is the public area. Is there any regulation, any policy of the state, that prevents you from publishing it? I am not aware you whole legal code of your state, but I doubt there is. It would be a harsh limitation of freedom of speech. Even if the modification could lead to illegal effect (like, modifying toy weapon to kill by rising its power...) it would be only illegal under very rare circumstances. To conclude it - freedom of speech can be limited only if there is sufficient public interest to do so, and I don't see any.
This could be a violation of 18 USC 1030 (and a crime). A number of things go into requirements for conviction under this law. First, it has to be a computer, which is defined as an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but such term does not include an automated typewriter or typesetter, a portable hand held calculator, or other similar device Any printer that I have encountered in the past 40 years counts as &quot;a computer&quot;. Second, (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—...(C) information from any protected computer; It is highly likely that the person printing has to receive some information from the printer, and respond accordingly so you have your &quot;obtains information&quot; element. Maybe not useful information, but information nevertheless. It also has to be a protected computer, (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States Well, a computer connected to the internet is a protected computer, see US v. Trotter, 478 F.3d 918. Also, the access must be &quot;without authorization or exceeds authorized access&quot;. The law doesn't explain with &quot;without authorization&quot; means, but the latter is defined as to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter If the law were stated in terms of &quot;prohibited access&quot;, meaning &quot;express denial of permission&quot;, and if the computer owner had set the computer to &quot;prohibited access&quot; by default (password protected), there would be no issue -- accessing the computer is prohibited. &quot;Unauthorized&quot; can also mean &quot;has not been explicitly authorized&quot;, i.e. lacking any indication one way or the other. Every computer access is initially unauthorized, until authorization is granted; and re-trying a login after mis-typing a user name (and being denied access) is not a violation of this law. There does not appear to be case law that addresses the status of computers just left open to the public, and whether using a computer that is so exposed constitutes &quot;unauthorized access&quot;. Also, it is not clear that the defendant in this case has &quot;obtained information&quot;, since with printing, information flows into the computer. There is also a clause about recklessly causing damage, but I don't see what damage would result (&quot;damage&quot; is defined as &quot;any impairment to the integrity or availability of data, a program, a system, or information&quot;), and how printing would be &quot;reckless&quot;. It seems somewhat unlikely that this would be deemed to be a crime, though if you experiment, you could be on the cutting edge of new case law.