Has anyone been prosecuted for making/using malware? Has anyone been prosecuted under the Computer Misuse Act 1990 Section 3A for using or making malware in the UK? I have found example in the US, but none for the UK.
There is an excellent resource for looking at Computer Misuse Act cases: http://www.computerevidence.co.uk/Cases/CMA.htm There have been several cases where people have created DoS tools, botnet software, or credential stealing malware and used them. For example, web designer Simon Vallor created Gokar, Redesi, Admirer mass mailing viruses that infected 22,000 PCs worldwide. Defendant pleaded guilty, convicted and sentenced to two years jail. BBC news story
If you state, to a third person, that Joe has performed a criminal act then that is defamation and you can be sued. Unless it is true. However, if you are relying on the truth as a defence you will need to provide evidence that it is. At the moment you lack: a criminal conviction of Joe any physical evidence against Joe any personal knowledge that Joe has committed these acts. All you have, is second hand rumours that this has happened to 5 women, some of whom have reported it to you in person. This is called hearsay and it is not evidence. It may be true, it probably is true - you can't prove it's true and in court, that's all that matters. If you were sued your only possible defence is to call these women to give the evidence they are unwilling to give - are you willing to betray their confidence to that extent?
This is a developing area within the law. In the United States, 18 U.S.C. § 1030 (Computer Fraud and Abuse Act) governs. However, the law is broadly written. This means creative prosecutors can and do win federal criminal cases by arguing the law should apply. Whether violating a website's terms of service should be considered a federal crime subject to the Act has been a subject of hot debate. In United States v. Nosal, 676 F.3d 854 (9th Cir. 2012), the 9th Circuit decided violations of use should be considered breaches rather than crimes. However, the district court refused to dismiss some charges against Nosal when the case was returned, and a jury conviction resulted in a prison sentence. At least three different circuits have arrived at other interpretations of the CFAA. Draft legislation (H.R. 2454 and S. 1196) would limit the scope of the CFAA by excluding TOS violations, however, it hasn't been adopted as of this writing. That CAPTCHA breaking violates website terms of service isn't really in question. For example, see U.S. v. Lowson, 10-cr-114, U.S. District Court, District of New Jersey (Newark) in which the judge brought a criminal case to which two defendants plead guilty to wire fraud, one plead guilty to misdemeanor computer crimes, and a fourth went on the lam. But does for-profit CAPTCHA solving violate U.S. law? Given the state of the law, one could make a case either way. Given the industry's reputation, serious questions about intended use, and questionable labor practices, that's a significant risk.
In the UK, no offence is committed, however many public locations cite the Data Protection Act 1998 as a reason to stop people taking pictures. DPA does not mention this topic at all, and is a red herring (however informing the location of this is unlikely to help, I have discovered) In fact, in the UK, the only laws that appear to exist cover either specific locations and properties (eg military installations) or using photography to take pictures of individuals in areas where they have an expectation of privacy. The Photographer's Rights Guide published by digitalcameraworld in 2012 is still current as far as I can see. It has this specific guidance: Photographers Rights: Taking Pictures of People in Public Are you breaking any law when you’re taking pictures of people in public? Probably not, but the position under UK law is uncertain. There are currently no general privacy laws under UK law, but the UK courts must take into account the European Convention on Human Rights, which gives everyone the right to respect for their private and family life. As this is an area of law that has been developing rapidly over the last few years, it is hard to be certain what will constitute an infringement. The key issue is whether the place the image is taken is one where a person would have a reasonable expectation of privacy. For example, it has been suggested that the right of privacy of a child could be infringed by publishing a photo of them with their parents in a public street. It is therefore advisable to be careful when taking photos intended for publication, even where the subject matter is in a public place. Failure to obtain a model release for the use of an image will certainly make it harder to sell the picture to stock libraries. Photographing children The same laws apply to adult and child subjects, but a child does not have the legal capacity to consent and a parent or guardian must therefore do so on their behalf. Be aware that schools, leisure centres and places where children and adults gather usually have their own photography restrictions. Although decent photos of children (see our tips for better pictures of babies, children and teenagers) taken in a public place may be fine for non-commercial use, seek permission from the child’s parents or guardians and don’t shoot covertly with a long lens. For commercial images, you’ll need to get a model release signed by the parents. Also read the section on the powers of police and security guards.
Sure, you can make such a request, but its not likely to help you. Scammers are criminals and don't generally care about GDPR compliance. Scammers are criminals, and won't just publish their real world identity. Serving them with a lawsuit will be difficult, especially if they are from outside the EU. GDPR lets you sue data controllers, but it's not worth it. You can sue for compliance (e.g. to compel fulfillment of your access request), and you can sue for damages stemming from GDPR violations. Compared to the damages you have suffered, a lawsuit is very expensive.
Your code is considered free speech (Bernstein v. United States) and you have allowed the use of the code via the MIT license. Since the application of your code is very generic and is not specifically targeting anyone. You probably are not criminally liable. This is simply writing a "Proof of Concept" for security testing purposes. That same way Metasploit, Nessus, and Nmap have actual exploit code but are considered tools of the trade. Now if you go around using your spyware on non consenting victims. You might get a visit from some people with guns and badges that have 3 letters on them.
There is no law against a person creating and distributing such a poster, to the best of my knowledge. However such a poster pretty clearly implies that the person shown is guilty of a crime, or at least strongly suspected. If the store somehow made an error, pulling the image of a person who did not use the stolen card or there is some other error, the person pictured might well suffer a significant loss of reputation, and might sue for defamation. Damages could possibly be significant. Such suits have, I believe, happened when surveillance photos were posted but there later proved to have been an error. Mary might wish to double check how sure the store is that the photos are of the person who actually used the stolen card.
So-called AI software does not enjoy a special legal status (at present: one never knows what new law might be added). The question of whether any software can be distributed "safely" or "responsibly" is also not a legal issue. Nor is "true sentience" a relevant consideration, and nothing is guaranteed. When you distribute software of any kind, there is an implied warranty that the product is "fit", and if software kills you, you may be able to sue the creator for negligence. A software creator may then want to disclaim liability, by saying "WARNING: THIS PROGRAM MAY KILL YOU. OCP IS NOT LIABLE FOR ANY INJURIES ARISING FROM USE OF THIS PRODUCT". This may or may not actually remove liability. In the UK "liability for negligence occasioning death or personal injury cannot be excluded", so such a disclaimer will not prevent a suit against the manufacturer. In the US, the issue is determined at the level of the state – here is a summary of the law in the states. Probably the primary question would be whether such a disclaimer is an unconscionable term, and the second question is whether the act constituted gross negligence (not simply "negligence"). Mississippi exceptionally does not allow disclaimers, but even then, it does allow disclaiming liability when it comes to computer hardware and software. A software disclaimer is not inherently unconscionable, though perhaps some specific disclaimer would be found to be. Courts typically disfavor disclaimers in the case of gross negligence, and again determining what constitutes "gross negligence" is determined on a state by state basis. If the act shows "reckless indifference to the rights of others" and "failure to use even slight care or conduct that is so careless as to show com­plete disregard for the rights and safety of others", then the act might be grossly negligent.