I definitely believe it is illegal and was surprised that during his recent visit to the US that the FBI did not arrest him.
In an better world existence of such dataset would be unnecessary.
In the less ideal one you have to look at it's existence in a broader context.
- it provides a clearly beneficial service to owners of those email accounts bridging the gap in the legal systems (disclosure requirements)
- it's exposed in a way that keeps the risk of 3rd party exploitation low: doesn't leak information unless you have access to email account
- it has not to my knowledge been abused in any way and public is keeping check on that - there would have been an outcry that would not go unnoticed
- it's less of a high value target than you'd think - it's built from data that is already in the wild and could be pieced together by a sufficiently motivated actor, especially in the light of the recent combined lists with hundreds of millions of emails surfacing..
Quite frankly if you look at just that it scores better than most datasets gathered by websites requiring user registration.
The only thing missing here really is the consent to be included in that list, but given the sources of the data and the points above I find lack of it more than sufficiently justified.
- Section 58 of the Terrorism Act[0] which makes it illegal to possess information "likely to be useful to a person committing or preparing an act of terrorism", though the law provides "reasonable excuse" as an explicit defence.
- Section 3A of the Computer Misuse Act[1] "making, supplying or obtaining articles for use in unauthorised access to computer material" [my paraphrasing]
It feels like Troy has a pretty strong defence of "reasonable excuse" to my lay understanding though.
[0] https://www.legislation.gov.uk/ukpga/2000/11/section/58 [1] https://www.cps.gov.uk/legal-guidance/cybercrime-prosecution...