International Cybercrime Based in China. Who&#39;s Jurisdiction is it? Quick question... I got my crypto wallet hacked. I live in Canada. Offender lives in China. After the theft, he deposited the money into Huobi, whose HQ is also in China. I did some preliminary emails to Chinese law enforcement after getting nowhere with Canadian authorities. I got a reply from a Cybercrime group in China saying that this would fall under the jurisdiction of Canada, but I really don't believe that. Does anybody know the answer? Excerpts from Chinese Criminal Code would be preferred to back up statement.
China and Canada each have jurisdiction If the RCMP want to, they can investigate the case, lay charges and seek extradition of the perpetrator from China. It will be refused. Therefore, they have wisely decided not to investigate. If the Chinese authorities want to, they can investigate and lay charges in China against the perpetrator. However, that would potentially be embarrassing for China. Therefore, they have wisely decided not to investigate. So, either country could prosecute but neither is going to.
Since you don't say which country you're in, it's likely that you're interested in United States law. You are probably in the clear here, though you're getting close enough to the edge of breaking the law that I wouldn't be confident about not being prosecuted and/or convicted. The relevant laws in this case appear to be 18 USC 471, 18 USC 472, and perhaps 18 USC 514. All three of them begin "Whoever, with the intent to defraud...". It's questionable whether creating counterfeit money as a burglar decoy counts as defrauding the burglar.
A fundamental requirement of criminal culpability is intent. Based on the description this whole process is happening after a user has already had their phone seized. If a person was not aware of Signal's hidden files to damage the police's data forensics software, they will not have met the criminal intent requirement, either maliciously or under a criminal negligence theory. None of the prongs of CFAA are strict liability statutes (18 U.S. Code § 1030 &quot;Whoever having knowingly accessed a computer...&quot;), so that would not apply here. If we imagine a person that is aware of all the information from Signal about their app intentionally abusing Cellebrite's package and with intention to cause damage downloads Signal's malicious files to their phone, I think it's an open question whether or not they would be liable under the CFAA. Specifically, 18 U.S. Code § 1030(a)(5)(A) (emphasis mine) Whoever knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; An argument on this could go both ways. On the one hand, the owner of the phone could be found to not have substantially caused the information to be transmitted to a protected computer, as the police were the integral cause for that in executing their warrant. On the other hand, this sort of file could be considered a digital &quot;booby trap,&quot; and booby traps are illegal for essentially this reason, that they have a foreseeable effect of causing harm to people who are lawfully inside a building without the owner's permission. In this case, the owner's trap was sprung by law enforcement but still placed by the owner in order to damage them.
You wrote: As far as I believe, it is permitted under GDPR to record and store non-anonymized web server access logs, as these can be useful for security reasons. True, Recital 49 GDPR: The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems. You asked: My question is whether this anonymization process counts as processing personally identifiable data under GDPR? IP addresses are personal data in some cases, so yes, you're processing personal data. Then, these anonymized logs will be fed into an analytics tool to provide stats on unique visitors, page hits, etc. These are purposes considered compatible with initial purposes according to Article 5.1.(b): Personal data shall be (...) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for (...) statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’); As a matter of fact, you might be required to anonymize the data for those purposes, see Article 89.1: Processing for (...) statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner. If I were to anonymize the logs and continue to use them exclusively for security reasons, would that change anything? No, you would be processing data in a manner compatible with initial purposes (ensuring network and information security). Or does it not matter what I do with them once they are anonymized? Yes, it does. If you're not using them for &quot;archiving purposes in the public interest, scientific or historical research purposes or statistical purposes&quot; then you're using them for purposes incompatible with initial purposes. You would need to find new legal basis for processing. does this extra anonymization process on top then take it over the line meaning that consent and a privacy notice would be required? It depends on what you want to do with anonymized data. In your case, for security purposes or security and statistical purposes, you don't need the consent and there is no requirement for the privacy notice (but sure, it would be nice to publish one). For other purposes it might be different.
When a country makes criminal laws, these laws usually apply to anyone present in the country, and acting in the country. But the country is free to declare that some law might apply to its own citizens in a foreign country, or even foreign citizens in a foreign country. Assuming the laws about using marijuana say nothing about the country, that most likely means it only applies to using marjuana in the country itself. But if the US government decided that taking marijuana in Canada is illegal for US citizens, then nobody can stop them. In this case, Canada would not extradite you (unless Canadian law says that it is criminal for Canadians to use marijuana in another country), and Canadian police would likely not collect evidence. So even if illegal, it would be hard to convict you. PS. The "polygamy" case would be interesting, I think you would have to read the exact wording of the laws in every country. Some countries will say that you can't get married twice, and the attempt to get married a second time while already married is bigamy. In that kind of country you wouldn't have committed a crime within that country. Also, you would only be married to the first wife.
Maybe not. The ICO says that The right of access enables individuals to obtain their personal data rather than giving them a right to see copies of documents containing their personal data. It might be valid to interpret the DPA / UKGDPR in a way that the relevant personal data undergoing processing in their system is the existence of the letters, but that you are not entitled to a copy of the letters. This is in line with the purpose of the right to access, that you can check what data they are processing about you and whether it is correct. If that argument holds and the data subject insists on receiving a copy of the letters, it might be legitimate to charge them a fee for these copies. But in practice: The data controller might not make this argument and just hand over the copies. It is worth a try. A right to access founded in data protection might not be the only way to receive a copy of these materials. If the letters are relevant for legal proceedings, they could perhaps be requested during the disclosure process.
Do the exchanges need to check with each government to make sure the information is valid? Or is submitting documents enough? They need to understand the (usually very complicated) laws governing financial services and data protection in every jurisdiction where they operate. The specific requirements will vary from one jurisdiction to the next. The usual way of acquiring this understanding is to hire a lawyer (or several).
It might possibly be illegal. For criminal law, usually you need to obey the laws of three countries: The country you are a national of (by personality principle) The country from where you make the sale (by territoriality principle) The country that hosts the attacked interest (by territoriality principle) Then it depends on the jurisdiction (and other factors) whether the sale is legal or not. I'll use the example of my country, Czech Republic. There is a crime called "Unauthorized access to a computer system or data storage device". For example, you commit this crime by exploiting a vulnerability in a web application and copying the web owner's data on your computer. It is also codified that whoever wilfully facilitates the committing of a crime by providing the criminal with resources (such as the exploit) is considered to have also committed the crime. For this to apply, you must have known or expected that the exploit will be used to commit a crime. The courts would decide this.