Is hacking and stealing punished more harshly than solely hacking? Which of the following crimes generally has a more severe punishment: Unauthorized bank account access (e.g. hacking in to view information), or Unauthorized account access and taking money from that account
The latter because there are two crimes involved (hacking and stealing) and you would get punished for both.
Wikipedia explains this well enough: Particular numbers can be trade secrets, and their reproduction and dissemination may be particularly proscribed, e.g., by the U.S. DCMA. As a coarse analogy: Your social security number is not "illegal." But if somebody entrusted with it shared it in violation of law or contract then their communication of the number in a context that allowed potential identity thieves to associate it with you would be illegal. To answer follow-up questions in the comments: Sure, "mere possession" of a number can land one in jail for all sorts of crimes, just like "mere possession" of stolen property can. For example, if you possess a bank account number, credit card number, or PIN, and you "conspire, confederate, or combine with another" person who actually commits fraud or theft using that number, then you can be convicted of the same crime. This is so common that a search for "conspiracy to commit wire fraud" or "credit card fraud" provides ample reading.
Are online stores supposed to state the true “order cost”/value of an order on the package/envelope for the customs? Yes Is it common practice to slash 10x off of the price for the customs to not add various fees? Common? Probably no. Uncommon? Also, probably no. Isn't that illegal? Yes Of course, they can claim it was a mistake if ever found out, but if they do it consistently, that seems difficult... Not to mention there must be electronic proof of how much each order actually cost the customer? Yes Look, robbing banks is illegal but people still rob banks. Similarly, ripping off HM Revenue &amp; Customs is illegal but people still do that too. In fact, far more people do that than rob banks.
Disclaimer: I was the person who originally had the debate with the OP which prompted this question. My answer is based on the UK jurisdiction. Short answer (TLDR) If the action is deliberate, then under UK law it is likely that a crime of theft has been committed. Under the statutory definition of theft, five elements need to be established: dishonesty, appropriation, property, belonging to another, and intention to permenantly deprive. The first four are easy to satisfy. To establish intention, it is not necessary that the money be spent. It is only necessary to establish that at the moment that the recipient realised the mistake, they intended not to return the money. Even if they do plan to eventually return the money, it can still amount to an intention to permenantly deprive. In A-G's Reference (No 1 of 1983), the Court of Appeal held that theft could be committed in a case where an employer had mistakenly paid £74.74 to an employee for hours they had not worked. The obligation to return the money arose at the moment the employee realised the mistake. Whether or not the money was spent was not an issue (it was not even raised). Full answer I'm starting from the assumption (stated in the question) that the action is deliberate, as opposed to the recipient simply not noticing they have received the money. If it was accident or unnoticed then it is unlikely a crime has been committed as the necessary intention will be lacking. By deliberate I mean the person notices the money being received, realises it was an error, knows who the sender was (or can reasonably find out), and does nothing to rectify it. If the action is deliberate then this is likely to amount to the crime of theft under the Theft Act 1968 ('TA 1968'). Note, whether or not the prosecution could actually prove the crime is a separate matter. The question is not asking how easy it is to prove the elements, only whether or not the crime has been committed. Statute Theft is defined as &quot;dishonestly appropriat[ing] property belonging to another with the intention of permanently depriving the other of it&quot; (Section 1(1) TA 1986). Your motivations for appropriating the property (including whether or not you spend it) are not a relevant factor: &quot;It is immaterial whether the appropriation is made with a view to gain, or is made for the thief’s own benefit.&quot; (Section 1(2) TA 1986). The important thing is whether or not the five elements of theft are present. These elements appear in the statutory definition of theft and are further elaborated in the Act: dishonesty (section 2 TA 1986), appropriation (section 3 TA 1986), property (section 4 TA 1986), belonging to another (section 5 TA 1986) and intention to permenantly deprive (section 6 TA 1986). Dishonesty: Defences include believing there is a legal right to deprive the other of the property, believing there was consent, or believing that the person to whom the property belongs cannot be reasonably discovered (section 2(1) TA 1986). None of these exceptions apply here, given the premise of the question. However if one of these beliefs were instead present, it is worth pointing out that &quot;belief&quot; is assessed using the subjective test (what the defendant genuinely believed), not the more common objective test (what a reasonable person would have believed in the circumstances) (R v Robinson. [1977] Crim LR 173). If none of the exceptions apply, then there is two-stage test for dishonesty: an objective test and a subjective test. However, if the objective test is passed then the subjective one is likely to as well: &quot;In most cases, where the actions are obviously dishonest by ordinary standards, there will be no doubt about it. It will be obvious that the defendant himself knew that he was acting dishonestly. It is dishonest for a defendant to act in a way which he knows ordinary people to consider to be dishonest, even if he asserts or genuinely believes that he is morally justified in acting as he did.&quot; (R v Ghosh, [1982] QB 1053). Appropriation: &quot;Any assumption by a person of the rights of an owner amounts to an appropriation, and this includes, where he has come by the property (innocently or not) without stealing it, any later assumption of a right to it by keeping or dealing with it as owner.&quot; (emphasis added) (section 3(1) TA 1986). That very clearly applies here. Property: &quot;'property' includes money [and] things in action&quot; (Section 4(1) TA 1986). A bank balance is not money but a &quot;thing in action&quot; (a debt from the Bank to the customer) (A-G's Reference (No 1 of 1983) [1984] 3 All ER 369). Belonging to another: &quot;Where a person gets property by another’s mistake, and is under an obligation to make restoration (in whole or in part) of the property or its proceeds or of the value thereof, then to the extent of that obligation the property or proceeds shall be regarded (as against him) as belonging to the person entitled to restoration, and an intention not to make restoration shall be regarded accordingly as an intention to deprive that person of the property or proceeds.&quot; (Section 5(4) TA 1986). Note that it is not necessary that the customer be under a contractual obligation to return the money to the bank. Such an obligation can arise anyway under the law of restitution. It also arises in the law of equity - a person who gives property by mistake retains an equitable interest in that property (Chase Manhattan Bank v Israel-British Bank [1981] Ch 105). This principle has specifically been applied to bank errors (R v Shadrockh-Cigari [1988] Crim LR 465). Intention to permenantly deprive: &quot;A person appropriating property belonging to another without meaning the other permanently to lose the thing itself is nevertheless to be regarded as having the intention of permanently depriving the other of it if his intention is to treat the thing as his own to dispose of regardless of the other’s rights; and a borrowing or lending of it may amount to so treating it if, but only if, the borrowing or lending is for a period and in circumstances making it equivalent to an outright taking or disposal.&quot; (Section 6(1) TA 1986). There are two important things to note here: firstly, an intention to take and then return an item can still amount to theft. Secondly, it is the intention at the time of the appropriation which matters. If the person intended to keep the money (in our case, by hoping it will never get asked for) at the time they became aware of the mistake then it doesn't what their later intention is after the event (e.g. they later decide to return the money because they have been asked for it). See also the reference to intention above in relation to &quot;belonging to another&quot;. Other relevant case law Hibbert McKiernan [1948] 1A, ER 860: Property can cease to belong to another if abandoned. However the threshold for this is very high. Property is not abandoned just because the owner has stopped looking for it. You are therefore unlikely to be helped by the fact that the bank does not attempt to recover the money. R v Scott [1987] Crim LR 235: The defendant stole a pair of curtains from a shop but planned to return them the next day (to claim a fraudulent refund). Held: intention to permenantly deprive was present at the moment they were taken from the shop since the defendant treated the item as theirs to dispose of (see statutory definition of intention above). It didn't matter that defendant intended to return the item, even within a short timespan. Now you may argue that on the face of it it appears that you don't treat the bank balance as yours to dispose of because you leave it untouched. But remember you are under an obligation to return it as soon as you notice the error, which you fail to do. A-G's Reference (No 1 of 1983) [1984] 3 All ER 369: the defendant (R), a police officer, was mistakenly paid by bank transfer £74.74 for overtime she had not worked. The police made no demand for repayment. Held by the Court of Appeal: (1) section 5(4) TA 1986 applicable, (2) the legal obligation to return the money commenced as soon as R became aware of it, (3) satisfactory proof that R had no intention of making restoration to the police would be proof of an intention permanently to deprive. Note that whether or not the money is spent is not a factor (nor was it examined in the case): it is the intention that matters. Judgment excerpts: 186: &quot;There was some evidence before the jury that she had decided to say nothing about this unsolicited windfall which had come her way, and had decided to take no action about it after she discovered the error. No demand for payment of the sum was made by the Receiver of the Metropolitan Police or anyone else.&quot; 189: &quot;there was a legal obligation upon the respondent to restore that value to the receiver when she found that the mistake had been made&quot; 189: &quot;once the prosecution succeed in proving that the respondent intended not to make restoration, that is notionally to be regarded as an intention to deprive the receiver of that property which notionally belongs to him.&quot; Other points raised in the question &quot;merely failing to inform the bank of its own mistake does not rise to the level of intent to deprive, and no crime is committed unless/until the customer takes further action (such as spending the money). Am I wrong?&quot; Yes. For most crimes (other than absolute or strict liability crimes), you need to establish two things: actus reus (an action) and mens rea (a state of mind). A failure to inform the bank is part of the actus reus (it is an action, not a state of mind). It therefore has nothing to do with intention. The intention is the reason why you carried out the action. In our case it is the part in bold here: &quot;they decline to mention this to the bank, hoping that the deposit will not be reversed&quot;. It is that hope which establishes intention. &quot;Even if it is technically illegal, as a practical matter I assume that no bank would pursue this over merely reclaiming the funds.&quot; It is not necessary for a civil entity to pursue a criminal conviction. That is handled generally by the Crown Prosecution Service or by other government agencies that are empowered to prosecute. The bank's co-operation is only needed if their evidence is required to prove the case. Even then, a witness can be compelled to assist the case against their will (section 2, Criminal Procedure (Attendance of Witnesses) Act 1965 and Part 17, Criminal Procedure Rules and Practice Directions 2020). Note that it is unlikely that a bank would refuse to cooperate. In any case, whether or not a crime will actually be prosecuted is not relevant to whether or not a crime has been committed (see my opening remarks about proving a case). &quot;Is there any precedent for someone being punished purely for failing to report a bank error?&quot; There are plenty of cases reported in the media involving convictions for failing to report and then spending money resulting from a bank error. See 1, 2, 3 for some examples. I was unable to find any precedents specifically relating to cases involving a bank error where the money was not spent. However, A-G's Reference above is essentially the same scenario, just involving an employer instead of a bank. In any case, the lack of an identical precedent does not mean that the courts would acquit a person in these circumstances. What matters is the statutory rules and whether or not the court would apply the existing precedents to the facts.
18 USC §1344: Whoever knowingly executes, or attempts to execute, a scheme or artifice (1) to defraud a financial institution; or (2) to obtain any of the moneys, funds, credits, assets, securities, or other property owned by, or under the custody or control of, a financial institution, by means of false or fraudulent pretenses, representation, or promises; shall be fined not more than $1,000,000 or imprisoned not more than 30 years, or both. Here are some example prosecutions: United States v. Wall, 37 F.3d 1443 (1994) United States v. Molinaro, 11 F.3d 853 (1993) United States v. Lilly, 983 F.2d 300 (1992)
In England and Wales, theft is defined by s1 Theft Act 1968: A person is guilty of theft if he dishonestly appropriates property belonging to another with the intention of permanently depriving the other of it It does not matter if the victim is not the rightful owner of the property, as the law only requires that the property belongs to another: the victim and owner can be two different people. As long as the other elements are present, the offence is committed. It's important when considering theft to look for dishonesty and intention to permanently deprive: borrowing something without permission with the intention to return it isn't theft, and nor is taking something by mistake. Theft is an 'either-way' offence (i.e. it can be tried summarily or by a jury), and in the latter case carries a maximum penalty of seven years in prison (s7 TA 1968).
A fundamental requirement of criminal culpability is intent. Based on the description this whole process is happening after a user has already had their phone seized. If a person was not aware of Signal's hidden files to damage the police's data forensics software, they will not have met the criminal intent requirement, either maliciously or under a criminal negligence theory. None of the prongs of CFAA are strict liability statutes (18 U.S. Code § 1030 &quot;Whoever having knowingly accessed a computer...&quot;), so that would not apply here. If we imagine a person that is aware of all the information from Signal about their app intentionally abusing Cellebrite's package and with intention to cause damage downloads Signal's malicious files to their phone, I think it's an open question whether or not they would be liable under the CFAA. Specifically, 18 U.S. Code § 1030(a)(5)(A) (emphasis mine) Whoever knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; An argument on this could go both ways. On the one hand, the owner of the phone could be found to not have substantially caused the information to be transmitted to a protected computer, as the police were the integral cause for that in executing their warrant. On the other hand, this sort of file could be considered a digital &quot;booby trap,&quot; and booby traps are illegal for essentially this reason, that they have a foreseeable effect of causing harm to people who are lawfully inside a building without the owner's permission. In this case, the owner's trap was sprung by law enforcement but still placed by the owner in order to damage them.
Yes you can sue for whatever damage has been suffered. However, good luck identifying someone from an email address - they are effectively anonymous. Your friend needs to change all of his passwords immediately. The hacker has probably used the day he had to change all the passwords he could think of. This may include your bank. The hacker almost certainly now has enough info to carry out an identity theft - make sure your friend protects his credit.