Is it legal to hijack online scammers accounts? If someone were to start phishing scammers, hijacking their accounts and handing them over to the FBI, is there any protection for said vigilante? I think there is some precedence for the necessity law but for the life of me I can't find any information online. You always hear about people taking the fight back to criminals but one thing commonly left out in these articles is the legality. So my direct question: Is there any certificate, law, license that one can get that protects their ability to hunt scammers, phish their accounts and hand over the information to the feds? Update Since this got migrated to law I will clarify some of the terms above. When I say phish someones account I mean tricking the scammer into handing over their credentials. Usually this is done with a fake login page that is tied to the hacker's [good guy in this case] database. When the scammer types in their credentials they are handing over their username and password willingly. I don't doubt this is legal. What I am asking is, if said hacker then uses these credentials to log into the scammers accounts, and changes all the passwords effectively locking the scammer out [hijacking]. Would the hacker be in violation of the computer fraud and abuse act, and therefore liable when they handed the accounts over to the FBI?
No, it is not. Just as it is illegal to steal from a thief, it is illegal to hack a hacker. Criminals are often considered a good target for crimes from a practical standpoint, but crimes against criminals are still prosecuted. As criminals are unlikely to report crimes against them to the authorities (particularly when doing so runs the risk of them being arrested for their crimes), targeting them does tend to result in a lower risk of being caught by the authorities, but if the crime is discovered, it will generally be prosecuted all the same. To that point, two Florida men have recently been arrested and are being prosecuted for stealing millions of dollars in Bitcoins from an illegal, darkweb drug marketplace in 2013, and there is always the more famous case of the two government agents who are in jail for stealing from the Silk Road. In your specific example, if all you did was hand over the information to the FBI, it's less likely that you'd be prosecuted than if you did so for personal gain, but you would be at risk of prosecution for engaging in vigilante computer hacking, yes. Also consider that if your actions happened to interfere with an ongoing investigation or result in the inability to prosecute (say, for the evidence you gathered being tainted and inadmissible by your involvement), you could be charged with crimes such as obstruction of justice or interfering with a police investigation as well.
In the US, "insider trading" includes both legal and illegal versions. When a corporate employee buys or sells shares of their company, they are insiders and they are trading (there is a requirement to report to the government). The illegal version involves breach of fiduciary duty or confidence. The relevant section of the federal regulations is 17 CFR 240.10b on "Manipulative and Deceptive Devices and Contrivances", and you will note that the section does not rely on the term "insider" in the law part, instead it directly characterizes what acts are illegal. Thus it would not matter, from a legal perspective, if someone considers you an insider. It is illegal to trade in securities using a “manipulative, deceptive, or other fraudulent device or contrivance”. This relates to what is commonly known as insider trading via rule 240.10b5-1, by defining as manipulative and deceptive trading on the basis of material nonpublic information about that security or issuer, in breach of a duty of trust or confidence that is owed directly, indirectly, or derivatively, to the issuer of that security or the shareholders of that issuer, or to any other person who is the source of the material nonpublic information (emphasis added to focus on the core requirements). Whether or not you have a "duty of trust or confidence" is determined by common law standards, that is, it depends on how courts have ruled on similar matters. For instance if the CEO of Apple tells you "Our computers explode and it's gonna be on the news tonight, the stock is gonna tank, but it would be illegal for you to act on that information", then it would be illegal, because you are aware that the CEO has a duty to not use that information (thus you "inherit" the duty). This also holds if he doesn't tell you that acting on the information, since it is expected that you know that the CEO of Apple could not legally act on that information (even if in fact you are unaware of the law -- ignorance of the law doesn't get you anywhere good). However, if you are unaware and could not know that the person making the factual disclosure is divulging information that he has a duty to shut up about, then you might not get prosecuted.
You can hire someone to locate the defendant with the information that you have, or you can apply to a court for permission to serve them with process via &quot;substituted service&quot; because their physical address can't be determined. But, in general, better business practice is to not enter into contracts with people with whom you have more than a name that might be false, and an email address, unless you have some means of non-judicial enforcement of your agreement (like the practical ability to shut down access to an internet subscription). If you don't even know if someone's name is real and have done nothing to confirm that then you also have no assurances that they have any assets from which you could collect if you won a breach of contract lawsuit. If you deal with large numbers of people in low value contracts, it may be worth treating the fact that some contracts are effectively unenforceable as a cost of doing business. But, if a contract is important, it was foolish from a business perspective to rely on a contract on that basis alone, even if it is legal to do so.
It is not a crime or a tort to accidentally sign in to an email provider with an incorrect email address, even if that address is actually held by some other person. Not attempting to enter a password or repeat the attempt makes it clear there was no intent to obtain unauthorized access, and the emails make that even more clear.
So I can block children under 13, but I can't tell them that? You can tell them after they fail, you cannot tell them on the asking screen. Then what is the correct way to block children under 13 to access my website and still comply with COPPA? I agree with you that it is odd that they recommend using a cookie but they do!* So you have a entry page with a simple question, "Please indicate your age" and then block based on the response. That's it. Note that the rule is neutral. This means that you do not need to disguise your purpose or try to trick people into entering their correct age. *I think that what is happening here is that any parent who wants to complain to their legislator can be met with the response, "If your kid is so sneaky that they are using different computers to lie about their age what do you want us to do about it?" The fact is, this scheme keeps innocent kids from seeing stuff they shouldn't; the sneaky ones are going to find a way.
How come this is viable? Because it’s legal. What if people use their service to commit crimes? What if people use a Ford in a bank holdup? Or a Glock in a murder? Or the US Postal Service in a Nigerian letter scam? If the goods or services are legal and not provided for an obviously illegal purpose, nothing happens.
This is a super complex question and no one really knows the answer yet. Orin Kerr is probably the leading scholar on this question, and he generally argues that forced decryption of one's own device is not a Fifth Amendment violation. As I understand it (and oversimplifying by a lot), one key piece of his position is that requiring you to put in your password is a statement about your knowledge of the password itself, not about the contents of the machine into which you are entering it. And because your knowledge of the password for your own devices is presumed, an exception for "foregone conclusions" would leave this compulsion unprotected by the Fifth Amendment. You can read one of his explanations here. The Eleventh Circuit disagreed with that approach, but a California judge recently reached a conclusion similar to Kerr's. This will probably by a question for SCOTUS before too long.
Selling online is unclear. However, selling in the mail, the court has held that, based on 18 U.S.C.A. S1341 (Frauds and swindles): Therein the weight of authority is that astrologers, conjurers, fakirs, magicians, mediums, and all variety of pretenders to supernatural power, and who assume to sell the same for money, are amenable to the criminal law of false pretenses. United States v. Calwer, 282 F. 1007 (D. Minn. 1923). In prosecution for devising a scheme and artifice to defraud and using the mails in connection therewith, which scheme consisted of representations by defendant that he was gifted with supernatural powers, evidence was sufficient to sustain a conviction. Crane v. U.S., C.C.A.9 (Cal.) 1919, 259 F. 480, 170 C.C.A. 456 Notwithstanding constitutional provision as to religious freedom, it was an offense to pretend to believe in supernatural powers for the purpose of procuring money and to use the mails in pursuance of such purpose. New v. U.S., C.C.A.9 (Cal.) 1917, 245 F. 710, 158 C.C.A. 112, certiorari denied 38 S.Ct. 334, 246 U.S. 665, 62 L.Ed. 928. These are mostly lower court cases (the last has a cert. denial from the Supreme Court, meaning the Supreme Court effectively upheld the lower court's decision without making it the law of the land), and both were from nearly 100 years ago. It is reasonable to assume that one would still incur liability for facilitating &quot;Frauds and swindles&quot; over the internet.