Legal implications of printing something remotely to tell the owner their printer is vulnerable? Commonly, wireless printers in homes and corporate settings can be configured incorrectly, exposing them to the internet. This can be a major security vulnerability, and can allow anyone to not only print stuff remotely on it, but sometimes even get full access to the network it's connected to. If somebody happens to find a vulnerable printer online, and no contact information associated with it, would it be legal to print a message on it to let the owners know that it's vulnerable, and possibly even how to fix it? Edit: Usually, these printers are configured not to have any sort of password, or anything really, preventing access from anyone on the internet. The printer also has to be manually set up to allow access from the internet, so could that technically be considered permission to access the device?
This could be a violation of 18 USC 1030 (and a crime). A number of things go into requirements for conviction under this law. First, it has to be a computer, which is defined as an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but such term does not include an automated typewriter or typesetter, a portable hand held calculator, or other similar device Any printer that I have encountered in the past 40 years counts as &quot;a computer&quot;. Second, (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—...(C) information from any protected computer; It is highly likely that the person printing has to receive some information from the printer, and respond accordingly so you have your &quot;obtains information&quot; element. Maybe not useful information, but information nevertheless. It also has to be a protected computer, (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States Well, a computer connected to the internet is a protected computer, see US v. Trotter, 478 F.3d 918. Also, the access must be &quot;without authorization or exceeds authorized access&quot;. The law doesn't explain with &quot;without authorization&quot; means, but the latter is defined as to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter If the law were stated in terms of &quot;prohibited access&quot;, meaning &quot;express denial of permission&quot;, and if the computer owner had set the computer to &quot;prohibited access&quot; by default (password protected), there would be no issue -- accessing the computer is prohibited. &quot;Unauthorized&quot; can also mean &quot;has not been explicitly authorized&quot;, i.e. lacking any indication one way or the other. Every computer access is initially unauthorized, until authorization is granted; and re-trying a login after mis-typing a user name (and being denied access) is not a violation of this law. There does not appear to be case law that addresses the status of computers just left open to the public, and whether using a computer that is so exposed constitutes &quot;unauthorized access&quot;. Also, it is not clear that the defendant in this case has &quot;obtained information&quot;, since with printing, information flows into the computer. There is also a clause about recklessly causing damage, but I don't see what damage would result (&quot;damage&quot; is defined as &quot;any impairment to the integrity or availability of data, a program, a system, or information&quot;), and how printing would be &quot;reckless&quot;. It seems somewhat unlikely that this would be deemed to be a crime, though if you experiment, you could be on the cutting edge of new case law.
There are some problems with this kind of vandalism, one of them clearly that the internet is international and vandalism can be performed from everywhere on servers everywhere in the world. And so it may be (both technically and legally) difficult to get hold of the vandal. Therefore, most wikis primarily focus on blocking offending accounts or their IPs and hope that this helps at least for a while. Only if it doesn't and the vandalism continues for extended time periods, legal measures are considered. Legally speaking though, vandalism is prohibited by many jurisdictions and of course by the terms of use of the wiki operators. For instance, the Swiss criminal code Art 147 explicitly puts &quot;abusing of data processing equipment&quot; under penalty and hence gives website operators a legal backup for setting up rules for the use of their services. Computer fraud Art. 147 1 Any person who with a view to his own or another's unlawful gain, by the incorrect, incomplete or unauthorised use of data, or in a similar way, influences the electronic or similar processing or transmission of data and as a result causes the transfer of financial assets, thus occasioning loss to another, or immediately thereafter conceals such a transfer shall be liable to a custodial sentence not exceeding five years or to a monetary penalty. 2 If the offender acts for commercial gain, he shall be liable to a custodial sentence not exceeding ten years or to a monetary penalty of not less than 90 daily penalty units. Technically, the law even requires prosecution ex officio, even though without a hint from the operator, the police won't start an investigation. I'm sure the US has a similar law. The problem is, as with all internet crimes, it's practical application, particularly because often website operator and offender are not living in the same country. Edit After reading the exact text again (it was unavailable yesterday) Art 147 is mostly about fraud performed by computers (classical &quot;hacking&quot;) but it shouldn't be difficult to argue that fighting and reverting vandalism requires significant (technical and personal) effort and hence the operator looses money. Additionally, there's Art 144bis which matches even better for the scenario here: Damage to data Art. 144bis Any person who without authority alters, deletes or renders unusable data that is stored or transmitted electronically or in some other similar way shall be liable on complaint to a custodial sentence not exceeding three years or to a monetary penalty. If the offender has caused major damage, a custodial sentence of from one to five years may be imposed. The offence is prosecuted ex officio. Any person who manufactures, imports, markets, advertises, offers or otherwise makes accessible programs that he knows or must assume will be used for the purposes described in paragraph 1 above, or provides instructions on the manufacture of such programs shall be liable to a custodial sentence not exceeding three years or to a monetary penalty. If the offender acts for commercial gain, a custodial sentence of from one to five years may be imposed.
What are exactly the legal consequences of "All rights reserved"? Almost none. You have to explicitly grant copyright rights. You don't even need the Copyright notice for them to apply. My "almost" is because the notice makes it harder for somebody to argue "they didn't realize". Do I still need an additional SW License Agreement or is the Copyright notice above + a Disclaimer of liability sufficient? If this is free software (I know you said it isn't), do yourself (and everyone else) a favour by picking a license you like. Preferably either GPL or MIT (depending on your taste). There are far too many free licenses already. Please don't add another. (It also makes it much easier for any user of your software: "Oh yeah, GPL v2. We understand that. We can use it." as opposed to "What are the implications of using this one??" As this is not free software, I think you need a paid-for lawyer (who understands IPR in your juridiction.) Edit: In principle, I believe you don't need anything. The code is copyright, so the customer can't do anything with it (without explicit permissions that you haven't granted). However if the customer doesn't realize that or thinks you won't mind, you then have to go to court to enforce your rights (and probably end up with a disgruntled customer). A short, clear, license will make it clear to the customer what they are allowed to do, and save all that aggravation.
Written down computer code is subject to copyright. If you do not have the permission of the owner to copy it you are breaching their copyright unless your use constitutes fair use/dealing.
You wrote: As far as I believe, it is permitted under GDPR to record and store non-anonymized web server access logs, as these can be useful for security reasons. True, Recital 49 GDPR: The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems. You asked: My question is whether this anonymization process counts as processing personally identifiable data under GDPR? IP addresses are personal data in some cases, so yes, you're processing personal data. Then, these anonymized logs will be fed into an analytics tool to provide stats on unique visitors, page hits, etc. These are purposes considered compatible with initial purposes according to Article 5.1.(b): Personal data shall be (...) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for (...) statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’); As a matter of fact, you might be required to anonymize the data for those purposes, see Article 89.1: Processing for (...) statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner. If I were to anonymize the logs and continue to use them exclusively for security reasons, would that change anything? No, you would be processing data in a manner compatible with initial purposes (ensuring network and information security). Or does it not matter what I do with them once they are anonymized? Yes, it does. If you're not using them for &quot;archiving purposes in the public interest, scientific or historical research purposes or statistical purposes&quot; then you're using them for purposes incompatible with initial purposes. You would need to find new legal basis for processing. does this extra anonymization process on top then take it over the line meaning that consent and a privacy notice would be required? It depends on what you want to do with anonymized data. In your case, for security purposes or security and statistical purposes, you don't need the consent and there is no requirement for the privacy notice (but sure, it would be nice to publish one). For other purposes it might be different.
Yes, it's illegal. 18 USC 1030 (a) (5) (A) [Whoever] knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer [shall be punished as provided in subsection (c) of this section]. &quot;Damage&quot; is defined at (e)(8) to mean &quot;any impairment to the integrity or availability of data, a program, a system, or information&quot;. Your proposed attack would certainly cause impairment to the availability of the Stack Exchange system and the data and information which it hosts. Whatever else you may think about the Stack Exchange terms of service, they certainly do not authorize any user or moderator to &quot;destroy the site&quot; in any sense such as you describe. It's not necessary for the TOS to explicitly say &quot;you may not do X&quot;; it's enough that they don't say that you may do it. To use a firewall analogy, it's &quot;default deny&quot;. &quot;Protected computer&quot; is defined in (e)(2) to mean, essentially, any computer that is used in or affects interstate commerce. Which means practically every computer that has ever accessed the Internet, and certainly includes Stack Exchange servers. So your proposed attack would include all the elements of a violation of this section. Such a violation is punishable by up to five years' imprisonment if it causes a loss of more than $5000 (see (4)(A)(i)(I)), which if such an attack were successful, it certainly would. Greater penalties are possible in certain circumstances. Even if the loss does not exceed $5000, or if the attack is merely attempted but without success, it is still punishable by one year imprisonment or a fine ((4)(G)(i)). There is nothing in the terms of service saying you will go to federal jail for destroying stack exchange. Irrelevant. It is not up to Stack Exchange Inc. or its TOS to determine who does or doesn't go to federal prison. Rather, it is up to Congress to determine what conduct deserves such punishment (as they did in 1984 by enacting this law), up to federal law enforcement and prosecutors to investigate and make a case against an alleged violator, and up to the federal courts to determine if the accused is guilty and how they should be punished.
How to send a document restricting its spread? In theory you could have the company sign a Non-Disclosure Agreement (NDA) prior to sharing the details of your project. However, your chances of enforcing the NDA seem negligible except maybe for George White's suggestion about a patent application. It is otherwise in your best interest to think of another way of showcasing your skills set. Assuming that the company signs your NDA, you have no realistic way to prevent the company from misappropriating (i.e., stealing) your idea(s). You will have no access to the company's systems to ensure that it has deleted all copies and records that could result in unauthorized disclosure. Even if you find out that the company misappropriated your information, it could be too late because the statute of limitations expired, and/or too costly --not just in terms of money-- to bring court proceedings for misappropriation.
I presume you are addressing the various wiretapping laws. In all of those channels, one would have a reasonable expectation of privacy, in contrast to using CB radio or a megaphone. However the context of using the instrument affects that expectation, for example if your phone is on speaker you do not have a reasonable expectation that those around you cannot hear your conversation, when there are others around you. Also, there is no expectation of privacy surrounding employers monitoring employee emails for valid business purposes – but the federal government can't intercept your emails (without a warrant) just because you are using business email. The expectation of privacy is really about the surrounding circumstance, not the instrument you use.