Personal device subject to forfeit? I have an employer-issued computer and a google-based email account. I use both the computer and the email account solely for work purposes. I am permitted to bring the computer home with me, provided it is used only for work purposes. This hasn't been a problem, and I understand that it's their device (not mine) and so I follow the rules. I understand that if they wanted to, they could inspect it at any time, etc. That's all fine. But I was quite alarmed today when I was told that if I did any of the following things... Check my work email at home using my home computer, Check my work email anywhere using my own smartphone, Connect my own smartphone (I own it, I pay for the contract, and it's not issued by work) for any purpose - be it work or otherwise - to the employer-provided internet network (including making a phone call using the wifi)... ...my personal device could be taken from me and its entire contents searched for relevant data were there some sort of a lawsuit or subpoena. I asked many clarification questions, such as why the home computer could be taken even though all the email contents are stored on a server elsewhere, etc. and was told in no uncertain terms that my use of their network forfeits any right I might have to expect privacy on my devices. They confirmed that, even though I only check their web-based gmail account my entire hard drive on my home computer could be taken if there was cause. I'm not in the know about legal issues, but want to fully understand my rights. Also, assuming that they are in fact correct, can I mitigate this at all? I use my home computer for a side business and it would be financially devastating if it were to disappear unexpectedly. The jurisdiction is Vermont, USA. I'm employed in the public sector, not a private business. NB - I'm new to the tags on this site, so please advise if I've mis-tagged this post.
If there's a reason to believe that your machine has data that would be relevant to a lawsuit, then yes, it is subject to inspection under Fed. R. Civ. P. 34: A party may serve on any other party a request ... to produce and permit the requesting party or its representative to inspect, copy, test, or sample the following items in the responding party's possession, custody, or control: ... any designated documents or electronically stored information—including writings, drawings, graphs, charts, photographs, sound recordings, images, and other data or data compilations—stored in any medium from which information can be obtained either directly or, if necessary, after translation by the responding party into a reasonably usable form. So if there's a lawsuit where there becomes a question about what you downloaded from the network, then it's quite plausible that your device could be demanded or subpoenaed. But that's not the same thing as &quot;forfeiting&quot; your device. The normal procedure in such a case would be that the agency's lawyers would notify you of the demand, and you would take your device to an ESI expert, who would make a digital image of the device's hard drive. The parties would then fight about what portions of that image they are allowed to access, but you would have your device again while that was going on.
Suppose I obtain the ability to access someone else's cryptocurrency. This sounds like fraud e.g. I overheard them saying the password to their wallet out loud or I am a custodian of their assets. Nope, STILL fraud, possibly even Computer Misuse aka hacking... and because you use internet: it's Wire Fraud I now borrow those assets, keep them for some period of time, and then return them, without the owner's consent. hmmm, let's take california... Luckjy you, it is not embezzlement because you were not entrusted with the cryptocurrency, you gave yourself access. 503. Embezzlement is the fraudulent appropriation of property by a person to whom it has been intrusted. No it is plainly... theft under California law: 484. (a) Every person who shall feloniously steal, take, carry, lead, or drive away the personal property of another, or who shall fraudulently appropriate property which has been entrusted to him or her, or who shall knowingly and designedly, by any false or fraudulent representation or pretense, defraud any other person of money, labor or real or personal property, or who causes or procures others to report falsely of his or her wealth or mercantile character and by thus imposing upon any person, obtains credit and thereby fraudulently gets or obtains possession of money, or property or obtains the labor or service of another, is guilty of theft. In determining the value of the property obtained, for the purposes of this section, the reasonable and fair market value shall be the test, and in determining the value of services received the contract price shall be the test. If there be no contract price, the reasonable and going wage for the service rendered shall govern. For the purposes of this section, any false or fraudulent representation or pretense made shall be treated as continuing, so as to cover any money, property or service received as a result thereof, and the complaint, information or indictment may charge that the crime was committed on any date during the particular period in question. The hiring of any additional employee or employees without advising each of them of every labor claim due and unpaid and every judgment that the employer has been unable to meet shall be prima facie evidence of intent to defraud. Giving it back doesn't matter. The person taking the crypto for any amount of time without being entitled to them is committing theft. You see, California doesn't interest that you just want to borrow. They don't even require Mens Rea for the mere taking - only for fraudulent pretense there is an intent question. In fact, it might even be automatically Grand Theft: 484d. As used in this section and Sections 484e to 484j, inclusive:[...] (2) “Access card” means any card, plate, code, account number, or other means of account access that can be used, alone or in conjunction with another access card, to obtain money, goods, services, or any other thing of value, or that can be used to initiate a transfer of funds, other than a transfer originated solely by a paper instrument. 484e. (a) Every person who, with intent to defraud, sells, transfers, or conveys, an access card, without the cardholder’s or issuer’s consent, is guilty of grand theft. YIKES! and now, intent to defraud comes in, but that is actually minimal: that just means taking without being allowed to by the owner in many cases.
Congrats, you've done well to minimize your processing of personal data. But I think you're still processing personal data, and are subject to the GDPR. Serving a website necessarily involves processing an IP address. This IP address will typically be personal data. While you are not storing the IP address, the GDPR's definition of “processing” extends beyond storage and pretty much covers doing anything with that IP address. As far as I know this is not an entirely settled matter, but it's better to err on the side of caution and to assume that you are in fact performing a processing activity. Even a static web page can easily lead to additional relevant processing of personal data, for example if the HTML embeds resources from third party domains. Since your website is clearly targeted at the public, it does not fall under the GDPR's exception for “purely personal or household” purposes. So I think you do need a (minimal) privacy notice that contains at least the items mentioned in Art 13 GDPR. The main reason why some people try to avoid posting a privacy notice is because it must disclose your identity and contact details. But in Germany, that information has to be provided anyway due to the Impressumspflicht. As part of your GDPR compliance obligations, you must protect how data is processed by others on your behalf. A hosting provider will typically act as your data processor. For this to be legal, you need a contract / data processing agreement that fulfills the conditions in Art 28 GDPR. This contract binds the data processor to only use the data as instructed by you, and not for their own purposes. European hosting providers sometimes include the necessary terms in their terms of service / AGB, but you should check to make sure. Netcup expects you to accept their data processing amendment in your account settings. In the hypothetical case that you were not processing any personal data at all, the GDPR would not apply and it wouldn't require you to post a privacy notice. Other laws might still have information obligations, notably the German TMG and TTDSG.
Most of the question has nothing to do with the law, it's about technical how-to or how-does, which should be asked in Information Security SE. There are two possible legal questions: is it legal to break into a computer system and take a database of passwords, and it is legal to acquire such a database obtained by someone else. As should be known in the US, per 18 USC 1030, breaking into a computer is illegal in the US. Given that, it is extremely unlikely that Google illegally breaks into other computer systems to obtain passwords. The aforementioned law criminalizes accessing computers without authorization, not (just) &quot;taking&quot; stuff from computers without authorization. The law does not criminalize receipt of illegally obtained material. Passwords are not protected by copyright. If Google were to induce someone to break into a computer system to get passwords, that would be legally actionable, however there is no law penalizing innocent receipt of illegally-obtained passwords (insofar as they are not protected by copyright). It is not illegal to access the dark web, at least in the US (probably it is illegal in Saudi Arabia). Using stuff gotten from the dark web can easily be illegal (e.g. logging in to someone's bank account, or forging a passport). There are many services which monitor the dark web and report breaches, which is totally legal.
It's illegal. 18 USC 1030, the Computer Fraud and Abuse Act, makes it illegal to, for instance, &quot;intentionally access a protected computer without authorization, and as a result of such conduct, cause damage and loss.&quot; A &quot;protected computer&quot; is defined to include any computer &quot;which is used in or affecting interstate or foreign commerce or communication&quot;. This effectively includes every computer in the world that's connected to the Internet (see US v. Trotter, 478 F.3d 918 (8th Cir. 2007). To the best of my knowledge, Congress has not added any exceptions for Russia or any other specific country. It's also likely to be forbidden by the laws of your state. You did not specify a state, but taking Colorado as an example, the following are crimes under C.R.S. 18-5.5-102: (a) Accesses a computer, computer network, or computer system or any part thereof without authorization; exceeds authorized access to a computer, computer network, or computer system or any part thereof; or uses a computer, computer network, or computer system or any part thereof without authorization or in excess of authorized access; or [...] (e) Without authorization or in excess of authorized access alters, damages, interrupts, or causes the interruption or impairment of the proper functioning of, or causes any damage to, any computer, computer network, computer system, computer software, program, application, documentation, or data contained in such computer, computer network, or computer system or any part thereof; or (f) Causes the transmission of a computer program, software, information, code, data, or command by means of a computer, computer network, or computer system or any part thereof with the intent to cause damage to or to cause the interruption or impairment of the proper functioning of or that actually causes damage to or the interruption or impairment of the proper functioning of any computer, computer network, computer system, or part thereof [...] Note that this applies to any target computer, and the prosecution would not have to prove that the computer was used in, or affected, interstate or foreign commerce or communication. Other states most likely have similar laws.
You don't say what jurisdiction's patent laws you're interested in, and priority dates can differ in different schemes. I'm answering as to U.S. law only. In the United States, under the current hybrid "first-inventor-to-file" system, the priority date--the date that determines who "wins" if there are multiple claims to a specific invention--is, with some exceptions that I won't go into, the date of your first application. In other words, the date that the PTO got it in the mail. Once your application is submitted, it is--again, with some limitations I won't get into--prior art for the purposes of any later-submitted application. They can't get another application later, grant it first, and then deny your application based on the later-submitted application. Your application date would still win out. Could someone in the USPTO slip your application out of the stack, fudge the dates, and convince some other company to submit a similar application to get priority over you? Not as a practical matter, no. The USPTO isn't one guy in a room; it's a large organization, and the person who opens the mail, types in your application details, and sends you a receipt, isn't the same guy who knows whether your invention is any good or not. And, frankly, very few patentable inventions are going to be worth someone risking their job and/or jail time over--especially when there would be significant evidence of the misconduct--for example, your patent agent's files. So what are the chances that the examiner on your patent: 1) Is a nefarious character who has lived a life of public service long enough and wants to go rogue; 2) Has a friend in the mailroom who is also an expert in the field of your invention; and 3) Has a conduct in industry who is willing to break the law for the rights to your invention? Slim to none. And if you have an invention that is really so revolutionary that it's going to be worth so many people risking so much to steal it, odds are there will be other evidence that you were the inventor.
It is any law protecting me from the people that distrubute a video of me falling the stairs and shared without my permision? No. Your permission is not necessary for distributing or watching that video. The recording was from your workplace, where your entitlement to privacy is quite limited unlike few settings such as (1) your attorney's office in the course of obtaining legal advice for which the disclosure was needed, or (2) your home. Even if such an entitlement existed, your decision to share that recording with the person who was with you generally constitutes a waiver of your right to privacy regarding that incident. The waiver would apply even if California had some legislation akin to the EU's GDPR. Your description nowhere indicates that that person had a statutory or equitable duty of confidentiality. It is also highly doubtful that you would wish to block the distribution of the video if people instead of mocking you expressed something pleasant or encouraging to you. people who I don't even know their names come to me to comment about the video and joke about not falling again. That is not unlawful in and of itself. Since the matter does not involve a protected category such as sex, race, religion, or disability, pursuing a claim of hostile work environment would be quite a stretch. It would also be futile because any relief would not cover outsiders who watch the video and feel like joking about it. The notion of harassment entails a pattern of conduct (meaning that a person engages twice or more in that conduct) that causes a reasonable person to feel annoyed or concerned for his safety. Even if someone engages makes a few jokes that cause you to get annoyed, any petition for restraining orders seems unlikely to succeed. Sooner rather than later, the jokes will get old and people will move on.
The legal system is set up to alleviate the problem or conundrum of intimidation by perpetrators. In the US criminal system, the State is the plaintiff, not the individual. In the extant described situation, very likely all you would have to do is sign an affidavit that the recovered phone is your phone, and that it was removed from your possession by unknown means on or about a certain date. From your description given here you don't know if it was stolen...you appear to have perhaps dropped it or left it somewhere, and someone picked it up/found it. Clearly it didn't belong to them, but this is more like "recovered lost property" rather than "received stolen property." The craigslist poster might be entirely un-chargeable with a crime, though they might have to give up the phone to you.