Hacker News Reader

Comment by trhway | Hacker News Reader

is it legal to collect the hacked accounts/emails/etc. lists from the places like hacking forums/etc.? Wouldn't it be a stolen property what can make FBI go after you?

Coincidentally, just few days ago a Russian owner of a platform for such exchanges got his sentence:

https://www.justice.gov/usao-sdca/pr/russian-hacker-sentence...

"DEER.IO sold not only stolen accounts, like the gamer accounts identified in the plea agreement, but also Americans’ personal information, to include names, current addresses, telephone numbers and at times Social Security numbers. On March 4, 2020, the FBI purchased 1,100 gamer accounts, and on March 5, 2020, the FBI purchased the personal information for over 3,600 Americans. On March 7, 2020, Firsov was arrested by the FBI in New York City when he flew into JFK Airport from Moscow."

View on HN

Troy Hunt has blogged a few times about the legitimacy of his service, and it's clearly been a carefully walked path to where it is today.

I think ultimately it comes down to the fact that he's not redistributing the lists of emails, and he doesn't retain pairs of (email + password hash). He designed the site to provide two useful queries ("what breaches included my email" and "has this password been seen in any breaches you processed"), which strike a responsible balance between disclosure and privacy.

Moreover, he has written about his intentions and acted with a fair deal of transparency, which is a strong contrast to some of the shady behavior you'll see from people dancing in the gray areas of the law.

That was probably a stepping stone to partnering with other organizations, which has snowballed into having the cooperation of the FBI, as well as the endorsement of multiple countries' governments.

Not a lawyer, but my guess would be that whether it is legal or not depends on what (if anything) you intend to do with the information. This is based mainly on perusal of this page summarizing a bunch of state identity theft statutes: https://www.ncsl.org/research/financial-services-and-commerc...

Of the ones with details listed it seems most of them require intent to defraud or something similar in addition to possession of personal information. I think paying for the info could also be problematic, there are a few trafficking laws in that list.

In a similar vein, possession of the info with the intent to use it to hack into something would probably run afoul of the CFAA or other anti-hacking laws.

If you collect that info with the intent to submit it to haveibeenpwned I think you would probably be fine.

If you collect that info just for fun, but don't do anything with it, I suspect that's legal, but probably not well-advised, as I suspect cops/prosecutors/jurors would have trouble believing someone did that for fun, and would interpret it as evidence that you were up to something nefarious.

I don't think the stolen property angle is an issue. Digital information can't really be stolen: usually the problem is you've committed a copyright violation. In the US at least I doubt user names and passwords would qualify for copyright protection. (Generally, collections of facts do not qualify.)

> Digital information can't really be stolen

That's not completely true. Generally, most ways you can "steal" data are illegal in their own right. Examples include computer fraud and wire fraud.

The Computer Fraid and Abuse act does actually detail punishment for the trafficking of passwords but said trafficking must be done knowingly and with an intent to defraud, so this specific usage would probably be fine

I hazard it depends on the jurisdiction - one thing I remember from my vague parsing of Australia's cyber crime laws (IANAL etc) is that possession of these lists/hacking tools was only criminal where there was an intent to use them for another criminal act (Crimes Act 478.3, probably superseded [1])

[1]: https://www.legislation.gov.au/Details/C2004A00937

I imagine the FBI strongly considers scale and intent. Troy Hunt is very obviously not reselling accounts, for example.

Though keep in mind that the FBI can go after whoever they want, sometimes without reason at all.

Reply on news.ycombinator.com