&quot;Impersonating&quot; a government agent for an Alternate Reality Game Say I'm creating an alternate reality game where I want players to be contacted by an FBI agent through email. Ideally, in order for players to remain immersed, the email would appear to be actual communication from a real FBI agent. Since players have to provide an email address beforehand, and they do so in the context of the ARG, they should be aware that these emails are not actual FBI communication, but there's a real risk that players either sign up other people who are unaware or that players sign up and forget about it before receiving anything. My question is two-fold: is it legal to impersonate a government agent if most reasonable parties don't actually believe me to be a government agent? And if not, what precautions should I take to ensure no one thinks the emails are legit, hopefully without hurting immersion? (I'm based in the United States, but the game could be played by any English speaker, so I tagged the question with international - let me know if I should change that)
18 USC §912 provides that: Whoever falsely assumes or pretends to be an officer or employee acting under the authority of the United States or any department, agency or officer thereof, and acts as such, or in such pretended character demands or obtains any money, paper, document, or thing of value, shall be fined under this title or imprisoned not more than three years, or both. I do not think that in the context of a movie, play or game the person portraying an FBI agent or other LEO is "acting as such", and surely this does not involved obtaining "any money, paper, document, or thing of value". The Wikipedia article on Police_impersonation says: Dressing up as a police officer in costume (e.g. for Halloween), or pretending to be a police officer for the entertainment purposes or a harmless prank toward an acquaintance is generally not considered a crime, provided that those involved recognize the imposter is not a real police officer, and the imposter is not trying to deceive those involved into thinking they are. Nevertheless, replica police uniforms sold in the UK must not be identical to the uniforms currently used by the police, and traders have been jailed in the past for selling on genuine uniforms. Many films and TV shows have portrayed FBI agents, in some cases actual agents by their real names. This goes back as far as the 1935 moviw G-Men starring James Cagney. Many examples are listed in the Wikipedia article Federal Bureau of Investigation portrayal in media, and many of them used realistic badges and depictions. They were not treated as criminal impersonations, even when the FBI or its officials strongly disapproved of particular movies. The somewhat similar US federal law 10 USC 772 prohibits wearing military uniform by persons who are not authorized, but paragraph (f) provides that it is permitted: While portraying a member of the Army, Navy, Air Force, or Marine Corps, an actor in a theatrical or motion-picture production may wear the uniform of that armed force if the portrayal does not tend to discredit that armed force. A Vietnam-War-era court case held the restriction "if the portrayal does not tend to discredit that armed force" to be an unconstitutional restriction of speech, and held that unauthorized wearing of a uniform was only punishable if there was charged a proved an "intent to deceive". I would expect a similar limitation of 18 USC §912. That said, if the email was such that a reasonable person might well be deceived into believing that it really came for an actual FBI agent or other government employee, there might be a problem. The suggestions on that point in the answer by user hszmv seem reasonable to me. An imaginary "Confederal Department of Interrogation" say, keeps things firmly in an alternate reality.
Does a situation like this constitute breach of contract and/or a violation of advertising laws? No. There is not enough information that would lead to a finding of either. It is unclear how customers would be allegedly affected (if at all) by the release of a product at a different store, let alone where the goods or services at issue are digital and require no physical presence at a venue or premise. Except for very specific factual circumstances, a change of sales venue would hardly be cognizable as deceptive or unfair practice. Also, prior to purchasing or reserving a game, there is no contract between the public and the developer/supplier. Potential customers typically are not entitled to a specific performance by the developer. Even if [Phoenix Point] supporters' decision were provably based on the prospect of release at Steam, your description nowhere reflects that there was a mutually conscious exchange (or promise of an exchange) of considerations involving the parties' support of a game and the counterparty's release of the game at a specific venue. Absent that meeting of the minds, either party's reliance or expectation on the other is irrelevant. Generally speaking, the sole cruciality of either party's motives does not create legal obligations.
One does not lose legal rights by becoming a government official, so POTUS retains the right to sue for defamation, hold copyright, sue for trespass or breach of contract, and so on. The standards for defamation change when one becomes a "public figure" (you have to show "actual malice"), but this is much broader than being a government official. Anything that is a "work of the US government" is not protected by copyright, so presidential decrees, as government works, are not protected by copyright. I do not know of any state where one legally loses publicity rights as a function of being famous, or being an elected official. California Civil Code §3344 spells out the right of publicity in that state, which says that anyone who knowingly uses another's name, voice, signature, photograph, or likeness, in any manner, on or in products, merchandise, or goods, or for purposes of advertising or selling, or soliciting purchases of, products, merchandise, goods or services, without such person's prior consent can get sued. However, there is a "fair use" escape clause: For purposes of this section, a use of a name, voice, signature, photograph, or likeness in connection with any news, public affairs, or sports broadcast or account, or any political campaign, shall not constitute a use for which consent is required under subdivision (a). The law doesn't say exactly what constitutes a "political campaign" or "public affairs broadcast or account", but since politicians get caricatured in the papers all the time, with no requirement for consent, it is highly likely that the use you point to would be found to be part of a "political campaign" or "public affairs account". Additionally, under the First Amendment, you can criticize a government official, and that right is not limited to just critical words. It is obvious that the things on sale are basically criticism of POTUS, and you can't use the law to suppress such criticism. Accordingly, one could also criticize Tom Cruise (not a government official) using his likeness on such an object. However, one cannot exploit his image to sell perfume.
Congrats, you've done well to minimize your processing of personal data. But I think you're still processing personal data, and are subject to the GDPR. Serving a website necessarily involves processing an IP address. This IP address will typically be personal data. While you are not storing the IP address, the GDPR's definition of “processing” extends beyond storage and pretty much covers doing anything with that IP address. As far as I know this is not an entirely settled matter, but it's better to err on the side of caution and to assume that you are in fact performing a processing activity. Even a static web page can easily lead to additional relevant processing of personal data, for example if the HTML embeds resources from third party domains. Since your website is clearly targeted at the public, it does not fall under the GDPR's exception for “purely personal or household” purposes. So I think you do need a (minimal) privacy notice that contains at least the items mentioned in Art 13 GDPR. The main reason why some people try to avoid posting a privacy notice is because it must disclose your identity and contact details. But in Germany, that information has to be provided anyway due to the Impressumspflicht. As part of your GDPR compliance obligations, you must protect how data is processed by others on your behalf. A hosting provider will typically act as your data processor. For this to be legal, you need a contract / data processing agreement that fulfills the conditions in Art 28 GDPR. This contract binds the data processor to only use the data as instructed by you, and not for their own purposes. European hosting providers sometimes include the necessary terms in their terms of service / AGB, but you should check to make sure. Netcup expects you to accept their data processing amendment in your account settings. In the hypothetical case that you were not processing any personal data at all, the GDPR would not apply and it wouldn't require you to post a privacy notice. Other laws might still have information obligations, notably the German TMG and TTDSG.
Your friend's relationship with the game company is one of contract. You don't say what the contract terms are, so it's impossible to say whether they were breached by your friend or the company. In any case, it is likely that the only remedy your friend could seek is damages, probably limited to whatever outstanding portion of the subscription they have not had the benefit of. It seems unlikely that it will be a large enough amount to be worth pursuing. As a private company the game provider can choose to contract with who they wish, or not as the case may be (unless they can be shown to be discriminating against protected characteristics).
Disclaimer: Not a lawyer or even living in US. I try to write the answer under US law. Other countries law may differ. Make sure you consult a lawyer in your jurisdiction. Here is my understanding of the individual examples: You don't need permission legally, because you are only accessing your own account and your own information. You are the only one damaged by the intrusion and therefore, nobody can really file a lawsuit against you. This is often used by security researchers when the subjects are uncooperative. That being said, if it is an actual pentesting client, you may want to refrain from it regardless. You don't need a permission to modify hardware you own. This is completely legal and not considered an attack. It would qualify as an upgrade, such as replacing a component in your laptop. You are allowed to do that. You should have a permission here. This is an intentional penetration test and you should have permission to do this. The same as 3. This is an intentional penetration test and you should get a permission. Though if you logout immediately and don't mess with the interface, it may not be illegal on the basis that you did not cause any damage or steal any information, or it may be illegal under some circumstances. It may also be impossible to prove that you did not do anything while there.
In the UK and USA (and I imagine other jurisdictions) there have been laws that explicitly provide for orders obliging entities to (A) provide access or information and (B) keep the order secret. For example, in the USA the Stored Communications Act, Fair Credit Reporting Act and Right to Financial Privacy Act authorise the FBI to issue National Security Letters (Wikipedia, EFF, EPIC, Lawfare). These are an administrative subpoena, without prior approval from a judge, for meta-information (e.g. phone numbers dialed or email recipients addressed but not the content) of communications relevant to national security investigations. They typically contain a non-disclosure requirement prohibiting the recipient of the NSL from disclosing its existence or the FBI's demands. There have been challenges on First Amendment grounds to the non-disclosure aspect but, so far as I'm aware, they have all ultimately failed. Some of their non-disclosure requirements may eventually expire under other laws. In response, so-called 'warrant canaries' (Wikipedia) have been developed (and gone a bit further than the original idea) - these are intended to allow entities to relatively passively warn of such an order having been received if not the detail of the order. However, they can be legally risky in that they might be seen by a court as trying to circumvent the non-disclosure requirement and therefore breaking it.
Like many US legal questions, there is a Congressional Research Service report about this. It is not generally a violation of US law to do things in another country where the only connection with the US is that the offender is a US citizen. However, there are a number of general situations where the US has jurisdiction over federal crimes if either the victim or offender is a US citizen: if a place isn't within the jurisdiction of any country (e.g. Antarctica); a place used by a US government entity (like an embassy or airbase); crimes by American soldiers and those employed by or accompanying the military; etc. These are considered to be within the special maritime and territorial jurisdiction of the US. Other laws apply if they say so. For instance, any US national committing war crimes inside or outside the US can be punished under US law; ditto for treason. The Foreign Corrupt Practices Act makes it illegal for a US national to bribe a foreign official anywhere outside the US for business reasons (if it's inside the US, there are more requirements). For instance, you aren't allowed to pay kickbacks to a foreign government's acquisition officer to buy your product. The CRS report has more (it doesn't include the FCPA, but that appears to be an oversight). Note that extraterritorial jurisdiction doesn't just apply if the person is a US national. US laws can also confer it if the victim is a US national, if the offense has a significant US component, if it's directed towards the US, if it's in violation of international law and the offender later turns up in the US, etc. For your scenarios: Dual citizenship doesn't matter. A US citizen is a US citizen, and is required to obey all laws that apply to US citizens, unless those laws explicitly exempt dual citizens. A dual citizen isn't treated differently by the government; as far as the US government is concerned, their US citizenship is all that matters (except for certain specific purposes like security clearances). In Kawakita v. United States, a US-Japanese dual citizen was convicted of treason against the US for aiding Japan in WWII. Depends. Plenty of these laws have no requirement that anything related to the crime actually happen in the US; for sex tourism, the subsection about traveling in foreign commerce for the purposes of engaging in illicit sexual conduct is followed by a subsection about engaging in illicit sexual conduct in foreign places. "Travel with the purposes of X" or "with intent to X" means you must have intended to do X at the time you traveled, but most extraterritorial laws don't control travel with intent to X (they cover X directly). Depends on the law. Some laws (like child sex tourism) apply to any permanent resident of the US as well as any citizen. Some apply to anyone, because they're based on a conspiracy started in the US. Others apply just to US nationals; a noncitizen isn't bound by them (for instance, no one but a US national can be charged with treason against the US, for obvious reasons). Still others apply to anyone who later turns up in the US, even if that is literally the only connection between the US and the offense (this is basically reserved for crimes against international law, like genocide).