Is bypassing Content Security Policy illegal? In HTTP protocol, there is so called Content Security Policy (CSP) that (among other things) allows the creator of a site to disallow browsers to put the site framed inside another site. All mainstream browsers abide this &quot;command&quot; of the creator of a site. Is bypassing CSP (it can be done through a specifically crafted proxy server that removes or changes CSP) illegal (in the US and in Europe)? Note that changing HTTP headers by proxies is a common practice. I have an argument that it is legal: If I put another site inside my frame (plus buttons like Forward/Backward), then I just create a new WWW browser (running inside another browser) and creating browsers is not disallowed. Is this a valid argument?
No. CSP is a suggestion to browsers to implement some security checks. Bypassing CSP is no more illegal than using a browser that doesn't support it.
Criminal liability is triggered by guilty knowledge. The people who run OnlyFans may know in general terms that it is probable that some illegal images exist on their servers, but so does everyone who allows the public to upload stuff. If that was illegal then the senior management of Google and Facebook would be liable to arrest on the same grounds and the Internet as we know it could not exist. Once the company becomes aware of a specific file that contains such material they need to remove it. If they fail to do so then they become liable. OnlyFans has been doing this: [OnlyFans] provides templates for each successive warning - explaining why material has been removed, and that failure to comply with terms of service may result in the closure of the account. [emphasis added] The site operators also become liable if they have a general policy of tolerating illegal material. This is a grey area; a prosecution would have to prove that the toleration was an active policy rather than merely ineffective moderation. There doesn't seem to be any evidence to support such a claim. Permitting an account to continue after deleting an offending file is not toleration of the offending file. The BBC report does not allege that the OnlyFans policy of multiple warnings has been applied to cases of underage content; rather it talks about cases of incest, bestiality and exploitation of vulnerable adults (such as homeless people), and only where the accounts were particularly popular. The linked articles do report cases where accounts have been set up advertising content by minors, but they were shut down as soon as the company was notified of them. The second article also quotes its source as saying that lots of such accounts get closed down all the time; there doesn't seem to be any evidence of toleration of that material specifically. So in conclusion it seems from the available evidence that OnlyFans have been complying with the law. It is telling that the BBC article specifically does not say that they have done anything illegal. If the BBC had found unambiguous evidence of illegal conduct by OnlyFans management then they would certainly have highlighted this.
Your code is considered free speech (Bernstein v. United States) and you have allowed the use of the code via the MIT license. Since the application of your code is very generic and is not specifically targeting anyone. You probably are not criminally liable. This is simply writing a "Proof of Concept" for security testing purposes. That same way Metasploit, Nessus, and Nmap have actual exploit code but are considered tools of the trade. Now if you go around using your spyware on non consenting victims. You might get a visit from some people with guns and badges that have 3 letters on them.
Yes, you could do this be means of the EULA, provided you are not in the EU yourself. You only have to comply with the GDPR if you are offering a product or service to people that are in the EU. If you are making it clear that whatever you offer is not available to Europeans, you make your site exempt from the GDPR.
You're probably making an “international transfer” here, but that doesn't mean it is illegal. The GDPR has a very broad concept of “personal data” and of “processing”. Per Art 4(2), ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction Which I would summarize as: pretty much anything you do with the personal data counts as “processing”. So yes, your non-EU servers would be processing the personal data in HTTP requests, even when those servers aren't directly storing the personal data. Chapter V of the GDPR applies to Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country […] Per this definition, the question whether an international transfer occurred is inextricably linked with the question whether the data is being processed in the destination country. The generally accepted interpretation here is that mere transfer through a country does not constitute processing. For example, if your requests happen to take a network route through other countries, that wasn't an international transfer. But your HTTP server is definitely doing processing, even if it doesn't store the data persistently. If the HTTP server is in a non-EU country, then you have to consider how this transfer of data is protected. You're supposed to uphold the high GDPR data protection standards regardless of where the processing occurs. Some countries have been granted an EU adequacy decision, meaning that their data protection laws are sufficiently similar to EU laws and no extra bureaucracy is needed for that transfer. The transfer still needs to be noted in your privacy notice (compare Art 13(1)(f)). In other cases, you may be able to rely on “standard contractual clauses” (SCCs), which are pre-formulated contracts provided by the EU that translate relevant GDPR aspects into a private contract between the data exporter and data importer. However, you as a data controller must make sure that the data importer is legally able to enter into that contract. For example, the terms of these SCCs are incompatible with US national security laws, meaning that US companies might not be able to enter into the SCCs. There are a couple of other ways to authorize international transfers, but they are mostly relevant for multinational groups of companies, or in exceptional situations. In any case, other GPDR requirements like the need to have a suitable contract with your data processors remain unaffected. Also unaffected is the obligation to implement appropriate technical and organizational measures to ensure the compliance and security of your processing activities (e.g. see Art 24 and Art 32 of the GDPR). For example, this may imply the need to implement suitable encryption. In the wake of the Schrems II ruling that struck down the EU–US “Privacy Shield” adequacy decision, the EDPB published recommendations on extra compliance measures that could allow SCCs to remain valid for EU–US data transfers. But it's not easy to defend data processing activities when potential adversaries include literally the NSA, and measures such as end-to-end encryption (E2EE) are incompatible with cloud services that are more interesting than backup storage. Practically speaking, I would reconsider an architecture that would allow failover of EU data processing operations to non-EU locations, unless those target countries are covered by an adequacy decision. If you need a high availability setup for EU activities, it may be more appropriate to maintain multiple deployments within the EU.
The purpose of the button is not to put liability on you, but to shield the website from liability. The website does not want you looking up information about drugs, deciding that a particular drug is right for you, causing yourself harm and then blaming the website. You may have acted unlawfully but you would have no liability because no injury (financial or otherwise) has been caused to the website. Clicking the button is an assertion that one is a medical professional. This is a false statement, so the website could sue you for the tort of deceit, but there is no injury, which is one of the elements of deceit. The website would not even get nominal damages. The button may also constitute a contract. In exchange for access to a website, you warrant that you are a medical professional. You are not, which is a breach of the contract. However, the damages are nil. Conceivably, if you passed the information on to someone else who misused it, there may be some injury to the website, and then you would have to compensate the website for that injury under one or both of the heads of liability described above. In terms of criminal liability, it is rarely an offence to make a false statement to a private body without some other aggravating element. For example, in Australia, it is an offence to make a false statement for financial gain, or to make a false statement to a government official (regardless of whether there is financial gain etc). But simply making a false statement is not by itself a crime. You may breach a computer law. The United States Computer Fraud and Abuse Act is pretty broad. Obtaining information from a computer without authority is an offence: 18 USC s 1030(a)(2)(C). The only exception is if the web server is in the same state as you and somehow nobody from outside the state can access it: see definition of 'protected computer' in 18 USC s 1030(e)(2).
Yes, you can. An excellent example is this very website - at the bottom of this page you will find a series of links in the footer, one of which is &quot;Terms of Service&quot;. I think you will agree that most people using the Law SE are making no money from it or paying no money to use it and yet the terms of service sets out in black and white what a user of this site can do, and what the repercussions can be if they breach the ToS, so it serves a purpose as an excellent example for your question.
It's not illegal to say things in your profile. SE requires you to license your content to them on a non-exclusive basis pursuant to CC BY-SA 4.0. &quot;Non-exclusive&quot; means that you can also license the material to others on some other basis, e.g. CC0. In that case, a person who uses your material can rely on the other license that you granted. If SE wanted to, it could prohibit putting licenses in a user profile, in which case you would have to promulgate your more generous license elsewhere.