What&#39;s the legality of someone running their own anti-Russian cyber-offensive? I'm in the United States and my friend was considering creating a website or websites to obtain information and finances from Russians who are supporting the anti-Ukrainian war effort. My friend wants to make an illegitimate website where Russians can &quot;donate money&quot; to &quot;support russia, etc&quot;. He wants to pay taxes on the income and donate half the income to a veterans charity. He also wants to forward all information to the FBI. Would my friend be prosecuted in the United States for this? I tried to research this but I couldn't find any clear answers and I would assume that the answer is &quot;yes, but probably not&quot;, but maybe someone has some actual information, precedent, etc.
This is wire fraud and punishable by up to 20 years in prison. Whoever, having devised or intending to devise any scheme or artifice to defraud, or for obtaining money or property by means of false or fraudulent pretenses, representations, or promises, transmits or causes to be transmitted by means of wire, radio, or television communication in interstate or foreign commerce, any writings, signs, signals, pictures, or sounds for the purpose of executing such scheme or artifice, shall be fined under this title or imprisoned not more than 20 years, or both. It is not relevant that the victims of this fraud are people who support a cause that the US government opposes. Nor is it relevant what your friend chooses to do with the ill-gotten money. It is still just as illegal. Whether your friend would be prosecuted would be at the discretion of federal prosecutors, and political motivations could come into play. That is beyond the scope of Law.SE to address. What is certain is that he could be prosecuted. Giving information to the FBI probably won't help, as from your description, the victims of this fraud aren't doing anything illegal. &quot;Donating money to support Russia&quot;, while vague, does not sound like it violates any of the current sanctions.
Disclaimer: Not a lawyer or even living in US. I try to write the answer under US law. Other countries law may differ. Make sure you consult a lawyer in your jurisdiction. Here is my understanding of the individual examples: You don't need permission legally, because you are only accessing your own account and your own information. You are the only one damaged by the intrusion and therefore, nobody can really file a lawsuit against you. This is often used by security researchers when the subjects are uncooperative. That being said, if it is an actual pentesting client, you may want to refrain from it regardless. You don't need a permission to modify hardware you own. This is completely legal and not considered an attack. It would qualify as an upgrade, such as replacing a component in your laptop. You are allowed to do that. You should have a permission here. This is an intentional penetration test and you should have permission to do this. The same as 3. This is an intentional penetration test and you should get a permission. Though if you logout immediately and don't mess with the interface, it may not be illegal on the basis that you did not cause any damage or steal any information, or it may be illegal under some circumstances. It may also be impossible to prove that you did not do anything while there.
Any answer is somewhat speculative, because there are no significant legal precedents. That said, you are probably not in breach of counterfeiting laws, as they typically protect physical currencies. However, due to the way that laws are written, their scope may be somewhat fuzzy in areas that were not foreseen, so you may find that a law unintentionally does cover your act. However, even if the act would fall under the law as written, jurisdiction remains an issue. Where would this counterfeiting happen, legally? Again, as this was not foreseen by lawmakers, it's possible that you may fall under foreign jurisdictions, e.g. because you spend the fake BitCoin and the the recipient lives in a country that assumes jurisdiction because their citizen was defrauded.
In the united-states, those actions would be fully protected by the First Amendment. Andy has a constitutional right to speak freely about essentially whatever he wants -- including Mary's criminal conduct -- unless his speech falls into one of several narrowly defined categories, none of which would apply in this case. And because Mary has already put this information out on the Internet, it is likely not sufficiently private to support an invasion-of-privacy claim. However, the unfortunate reality is that complainants, police, prosecutors, and judges frequently ignore First Amendment protections. Indeed, many states have laws against &quot;cyberstalking&quot; and &quot;telecommunications harassment&quot; that are incredibly broad, and that clearly apply to conduct protected by the First Amendment. For instance, Ohio's telecommunications harassment statute makes it a crime to send an e-mail &quot;with purpose to abuse, threaten, or harass another person.&quot; This means that many people who engage in First Amendment-protected speech end up getting prosecuted anyway. If they pay for a good lawyer who knows how to properly raise a First Amendment defense, they may escape any penalties. But because most defendants do not have those resources, and because many lawyers are unaware of the First Amendment implications of such prosecutions, most defendants in such situations likely end up being convicted despite behaving perfectly legally. In the united-kingdom, though, the situation is very different. Even if Mary is breaking the law, and even if Andy limits himself to strictly factual information about what's he's learned about her conduct, he may still be held civilly liable. Mary may also be able to pursue Andy criminally for harassment if his e-mail causes her substantial emotional distress, and civilly for &quot;harassment by publication.&quot; The fact that this information is already public is likely not going to go very far in changing the analysis. Andy's best course of action is therefore to play it safe by keeping his mouth shut. Doing so has both legal and nonlegal benefits: He avoids exposure to the hassles of defending himself from criminal charges and he gets some time to examine the resentment, jealousy, paranoia that makes him want to humiliate his &quot;friend.&quot;
The UN has a copy of the extradition treaty between the US and Brazil, the short version of it is that the treaty lays out in Article II an exhaustive list of crimes that are extraditable, skimming the list I don't see defamation (since of course in real life it's not a federal crime). As a general principle, Country A won't extradite someone to Country B if the conduct they are accused of in Country B is not a crime in Country A, if Country A does not think Country B would provide a fair trial, or if the person is convicted if the punishment likely to be imposed by Country B would be illegal under the laws of Country A (this comes up a lot with extradition from Europe to the US if a possible punishment for the crime is death). So in your hypothetical Brazil would probably be unwilling to extradite its own citizen for the crime the US accuses them of. I think another part of your question is whether the US or Brazil would have jurisdiction over this defamation. In theory, both could claim jurisdiction over it. In practice most criminal conduct is criminal relatively universally, especially among similarly geolocated countries, so the rest of this paragraph is assuming both countries did consider the defamation criminal and extraditable. As a matter of judicial effectiveness an Internet crime would probably be prosecuted in the country where the person resides. There would likely be a language barrier too, if the US court would have to employ a Portuguese translator. However, this is all largely a political question more than a legal one, if the US really wanted to make an example of this person in their own country the US could try to use political leverage to get Brazil to extradite them. The US could also wait until the person travelled abroad and petition the third country to imprison and extradite them. That's something that happens more commonly for citizens of a country that the US does not have an extradition treaty with.
...due to the international registration of multiple domains to generate ad revenue by recycling stories across sock puppet networks, giving the impression of multiple, independent companies. None of that is illegal on its face. Internet domains are freely registerable by anyone, anywhere (with the exception of some laws in some nations that restrict such Internet-related activity), and registered privately or publicly, and websites can be hosted anywhere. Writing articles and "spinning" and copying articles (even if that writing is sales gibberish in broken English) among the same copyright owner is legal, and using the same design and layout for a network of sites is legal. The formation of multiple, related companies and shell companies to give the impression that companies are separate and independent is legal (again, with the exception of some business and corporate laws in some nations that restrict such activity). These are all common business practices. Some business practices may appear to be unethical - trying to fool customers in order to make money and get clicks and sell ads. And what you may be feeling is that such activity is unethical. And that's OK. But feeling that they are unethical doesn't make the practices illegal. Many common activities that are considered to be unethical are illegal; but not all. Buyer beware. One way some of that activity may be illegal is if those articles are factually incorrect and promote quack medical treatments, are financial scams requiring payments, are gambling sites or promote other clearly illegal things. But then you get into the complexity of exactly how they are illegal, which jurisdictions are involved, and on and on.
Defamation laws do not distinguish between charitable organizations and others: however, in the US there are special considerations for "public figures" (they are not afforded as much protection). The medium does not matter -- texting, blogging, letter-writing, whatever. The defamatory statement need not have been received by a wide audience – it suffices that the message was received by one person other than the person being defamed. A single defamatory act is all it takes: there is no requirement of there being an established and repeated practice of defaming. One way to defend against a charge of defamation is to show that the statement is true. An alternative is to show that the statement is incapable of being proven true or false (e.g. calling someone a "jerk" doesn't assert a factual proposition). A careful scrutiny of the actual statement, performed by an attorney specializing in such matters, is really the only way to know whether words like "may", "possibly" would make a statement an expression of opinion rather than a statement of fact. A person suing for defamation would have to have suffered a loss, but there is a category of false statements, per se defamation, considered to be so injurious that damage need not be proven. That included allegations of criminal activity and allegations of professional incompetence, either of which could be applicable in the context you are describing. The First Amendment provides much protection against such suits, which may not exist in other countries. Because of this, a law was recently passed in the US, 28 USC 111, which says that domestic courts will not enforce a foreign defamation judgment that is inconsistent with the First Amendment. [Addendum] This part is crucial: "The only people I've expressed my concerns to, aside from the organization itself, is my parents and my wife's parents. However, they have shared with a few friends...". If you alleged illegal behavior to your parents, that's a problem. If you only said e.g. "I have concerns", that's not a problem. It would also matter in what way you tried "to disclose to a U.S. based organization details of the foreign organization they are supporting that indicate it might not be on the up and up".
Some people seem to believe that just because something happens 'in the internet' it is somehow outside normal jurisdictions. Wrong. In may be harder to investigate and prosecute crimes in the internet, but the laws apply all the same. There are some problems when it is unclear 'where in the world' something did happen -- in the jurisdiction of the perpetrator, the victim, or the service provider? But problems of jurisdiction apply e.g. to international fraud cases in the non-web-world as well. In many jurisdictions, the informed and voluntary consent makes some things legal which would otherwise be illegal. For instance, if two boxers get into the ring, it is understood that each of them did consent to be hit by the other. But usually two fighters could not legally agree to a fight to the death, because even if there are laws on assisted suicide, they do not apply to a fight. Insults, libel, and slander are not on the same level as homicide. There are jurisdictions where they are not prosecuted without the request of the victim. But an insult might also violate other laws, e.g. disturbing the peace. So don't bet on such an app unless you know for sure which jurisdictions are involved.