Legal implications of unsecure bluetooth device I have recently learned about a high-tech premium bed base that incorporates Bluetooth speakers, plus massage actuators and other features controllable via a smartphone app. Like many insecure Bluetooth speakers, the ones in the bed base will pair with any Bluetooth device without any form of authentication, not even a pairing button. This basically allows anyone with a smartphone to: Walk within Bluetooth range of the device (for example from the street) Open their phone and notice the device advertising itself on Bluetooth Click on it to select it as audio output device Play any kind of audio file on it There is no microphone, so it is not possible to remotely record audio. This is not like insecure Bluetooth headsets which allow anyone within range to connect and use the microphone to record. Neither hacking nor password is necessary to perform this feat, as the device advertises itself as available for connection, and simply accepts all incoming pairing requests. It may even be possible to control the bed position and massage features remotely. Now I'm wondering what the legal implications are: For someone who does not own the device, yet connects to it (perhaps by mistake) and plays audio on it without the owner's consent, or manages to remotely control the motors... For the manufacturer: is it legal to even sell this? Can the buyers sue the manufacturer after the neighbor's kids decide to make the bed speakers play heavy metal at 4AM every night, rendering the bed base features unusable? For the owner: I know if someone hosts an insecure WiFi and someone else connects to it and uses it for nefarious purposes, the owner of the insecure WiFi can face consequences. In this case the device uses Bluetooth not WiFi, and it is not connected to the internet, so this should not apply... unless maybe? I'm definitely not planning to buy one of these (nor prank it) anyway, so I'm not focusing on any particular jurisdiction.
It is legal for a manufacturer to sell a device which is capable of being misused. For example, a wifi-capable router can be sold even if it is &quot;open&quot; by default. A Bluetooth device has a shorter range than wifi, but in principle can connect to any other device. An owner's legal liability is not different given wifi vs. Bluetooth. Whether or not there is criminal liability for a third person who connects to the device also does not specifically depend on whether the device uses Bluetooth technology, as opposed to some other technology. 18 USC 1030 is the general federal law prohibiting &quot;unauthorized access&quot;. In the case of a bed, two legal question arise: is it a &quot;computer&quot;, and is it &quot;protected&quot;? It is an electronic high speed data processing device which performs logical, arithmetic, storage and communications facilities, i.e. it is a computer (in the legal sense). It probably is not protected, because it is not &quot;used in or affecting interstate or foreign commerce or communication&quot;, that is, it is not connected to the internet (unless it is). State laws tend to be broader, not having the &quot;interstate commerce&quot; limitation, so accessing the bed would violate Washington's analog of the federal law. However, under Washington law, the access is probably not &quot;without authorization&quot;. That term is defined as knowingly circumvent technological access barriers to a data system in order to obtain information without the express or implied permission of the owner, where such technological access measures are specifically designed to exclude or prevent unauthorized individuals from obtaining such information, but does not include white hat security research or circumventing a technological measure that does not effectively control access to a computer. The term &quot;without the express or implied permission&quot; does not include access in violation of a duty, agreement, or contractual obligation, such as an acceptable use policy or terms of service agreement, with an internet service provider, internet website, or employer. The term &quot;circumvent technological access barriers&quot; may include unauthorized elevation of privileges, such as allowing a normal user to execute code as administrator, or allowing a remote person without any privileges to run code. One question is whether there is any technological access barrier that the user circumvents (I don't know if it is possible to circumvent &quot;hidden mode&quot;). Since the term &quot;may include ... allowing a remote person without any privileges to run code&quot;, and since playing music on speakers involves running code, then the remote user may be criminally liable. On the third hand, the language of that paragraph (&quot;technological access measures are specifically designed to exclude or prevent unauthorized individuals from obtaining such information, but does not include ... circumventing a technological measure that does not effectively control access to a computer&quot;) clearly indicates a legislative intent to address deliberately overcoming active access barriers and not accidentally connecting to an unprotected, open system. Plus, the law also says that you are accessing the computer &quot;in order to obtain information&quot;, but that is not the purpose of transmitting sound to speakers.
As for the subject matter (what can be protected), amplitude, frequency, harmonic pattern, duration etc. are all physical facts, and there is no protection for physical facts. The basic requirement is that the thing protected must be "creative". Once you have a creative composition (assuming it is a composition, where infringement is harder to establish), the question arises whether a particular other composition infringes, or is an independent creation deserving its own protection. Again, the law does not deal in technical acoustic properties, and "similarity" is dealt with in an essentially subjective manner. The find of fact, who is an ordinary observer, has to weight all of the evidence and decide whether there is substantial similarity (or striking similarity) which could be evidence of infringement (substantial similarity is not against the law, copyright infringement is). Both parties to the litigation will present testimony supporting their contention and refuting the others' contention. At some point, one side is likely to introduce expert testimony to the effect that there are only so many possible melodies, which if persuasive can overcome a feeling that two compositions are rather similar. The law only addresses the logic of that judgment, and not the scientific facts. For example, in the case of Testa v. Janssen, the legal premise is set doen that "proof of direct access is unnecessary where striking similarities between two works are present". HOw then do you know if there are striking similarities? To prove that similarities are striking, plaintiffs must demonstrate that "such similarities are of a kind that can only be explained by copying, rather than by coincidence, independent creation, or prior common source." Stratchborneo v. Arc Music Corp., 357 F. Supp. 1393, 1403 (S.D.N.Y.1973) citing a previous ruling on that point. Ultimately, the courts cannot not dictate a scientific procedure for making that determination.
That GDPR Disclaimer is no protection in some jurisdictions: the applicable laws to that situation in germany for example don't care about the GDPR: Cold calling, mailing, or e-mailing private people to advertise services all is handled by the same law: Without the consent it is expressly illegal under §7 of the law against unfair competition (Gesetz gegen unlauteren Wettbewerb UWG) and such cases are rather Slam-Dunk if the origin can be made out. The punishment can be a 300.000 € fine. The fact that to email someone you need their e-mail address and that e-mail addresses and private addresses are by default considered personally identifiable information is making it worse for the advertizer: Without either an exception (there is none available to cold-emailing) or special allowance of the person the data belongs to, you violate §4 of the federal data protection law (Bundesdatenschutzgesetzes BDSG) just by handling their e-mail address. That's a separate crime from the UWG one, adding up to another 300.000 € fine under §43 BDSG - or even up to 2 years in prison under §44 BDSG! Oh, and if the email does not contain a proper sender's address, that's another chance for a huge fine under the UWG... So, GDPR is your least trouble, if you violate the marketing laws of a country, or their own data privacy laws. A disclaimer means nothing as the act of sending the mail, even to an unintended addressee, is what is illegal and the law as written does not give a damn about 'I didn't want to advertise to that person' when in fact you sent them unwanted advertisements. Oh, and the very repository you suggest? It would violate the very same §4 BDSG and be illegal for processing private data if it was not actively asked to do that by the end user. As a result, that database is useless: It does kick back all people not in its database. Its database is incomplete because only few people give their address to that database as people not aware of the database never add their data on their own. So it regularly violates §4 BDSG with every German citizen's e-mail address it gets and kicks back, and claiming those addresses would be OK, it throws the company trying to check the database under the bus because they rely on data that is impossible to be reliable. tl;dr Don't do cold-(e)-mail marketing. You throw yourself into boiling oil with a lit torch in hand. further reading Other laws banning such behavior I had listed here, and I quote myself: The US has the CAN-SPAM-Act, which illegalizes sending unsocialised advertisements. You may NOT send a mail if any of the following is true: it has no opt-out the email was gained by 'harvesting' contains a header not matching the text contains less than one sentence the adressee does not have any relation to you In fact, you are liable for a 5-digit fine per infringing e-mail in the US. The FTC itself suggests to never buy e-mail lists - as E-mail harvesting or generating any possible e-mail adress itself is illegal.
These are some thoughts about the state of affairs in the US, I do not know how it works in the UK. In the US it seems to be a legal gray area. Gray enough that I do not think any lawyer could say for certain that the use of the data is legal. The data is stolen. If possessing stolen property is illegal then possessing this data is also likely illegal. Of course experts disagree, Stuart Karle, an adjunct media professor at Columbia University and former general counsel for the Wall Street Journal says: ...the documents have been published by the hackers, they are now public by virtue of being put on the Internet. But Barrett Brown was charged with trafficking in stolen authentication when he forwarded a link to some stolen emails. He signed a plea for acting as an accessory after the fact. He spent more than a year in jail while they sorted it out. In the US there is no law banning the download of hacked documents. In fact Bartnicki v. Vopper 532 US 514 (2001) stands for the rule that journalists can report on illegally obtained information. But contrast that with the Barret Brown prosecution! And decide where a data scientist fits. Also there is the question of whether an illegally recorded conversation is of the same "illegal" nature as hacked personal information.
GDPR seems quite clear that if you are recording calls, video and/or audio, you must get consent. Wrong. The GDPR requires that your have a legal basis for processing personal data. Consent is a legal basis but there are others. With respect to note taking, the GDPR only applies to “personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.” So, if they notes are not about an individual (and many B2B phone calls will not be) or are neither automated nor filed, the GDPR does not apply. If they are captured by the GDPR, you need to have a legal basis for the notes. Again, consent is one but it is not the only one.
In my opinion, you are totally free to publish the information. There are two areas of law that can be cosidered - private and public law. In the private law area, you can be liable for revealing trade secrets, but only if you agreed to keep them by a contract. Trade secrets do not exist by themselves (there are minor exceptions, eg. in competition law, but those do not concern us), they must be protected by contracts. Another private limitations, like libel laws, won't apply here. This is not uncommon, but not in cars - you can find clauses like these in software license agreements. Then there is the public area. Is there any regulation, any policy of the state, that prevents you from publishing it? I am not aware you whole legal code of your state, but I doubt there is. It would be a harsh limitation of freedom of speech. Even if the modification could lead to illegal effect (like, modifying toy weapon to kill by rising its power...) it would be only illegal under very rare circumstances. To conclude it - freedom of speech can be limited only if there is sufficient public interest to do so, and I don't see any.
The section you quote as clearly saying a thing is not clearly saying the thing. However: you cannot pass on or resell any license keys seems to say a thing clearly. However, one could argue that it's the sharer of the account who is in the wrong, and not the person receiving and passing on the account. I'd say that that piece of the agreement, combined with this: must not... let other people get access to anything we've made in a way that is unfair or unreasonable says that, yes, they are out of bounds.
It is hard to prove a negative, but no - there is not rule that an app cannot track a user while the app is in the background. Almost every GPS-function app on every smart phone does the very thing you are talking about.