4 ms·

This is slightly OT and probably not a popular opinion, but does anyone else feel that Troy having this massive dataset of emails is unethical? I definitely be

This is slightly OT and probably not a popular opinion, but does anyone else feel that Troy having this massive dataset of emails is unethical? I definitely believe it is illegal and was surprised that during his recent visit to the US that the FBI did not arrest him.

tyingq 9y ago
Curious which specific US law(s) it violates. Sounds like he downloaded a few torrents and built a search interface.
Griffinsauce 9y ago
You jumped to illegal before even explaining why it's unethical.
mi100hael 9y ago
Simply possessing the information (which is already freely available online) is not on its own unethical. It depends entirely upon what he does with the information, which in this case is protect the owners from malicious individuals who also have access to the information because it's freely available online.
- 2close4comfort 9y ago
  It is if its stolen property...which most of that data belonged to the company that was hacked.
  - emodendroket 9y ago
    I'm not going to pretend to understand the legal niceties here, but the analogy to "stolen property" rings false because 1) he's not depriving anybody of their passwords 2) the very fact they've been leaked means they aren't really of value anymore.
snug 9y ago
These passwords were already publicly available, some with the email address associated with them.
joshuata 9y ago
He has written about that very problem here: https://www.troyhunt.com/the-ethics-of-running-a-data-breach-search-service/ https://www.troyhunt.com/the-ethics-of-running-a-data-breach...
- 2close4comfort 9y ago
  Charging people to access my stolen info seems like it is less of a service and more about Troy than anything else.
  - joshuata 9y ago
    From what I understand, the only people that are charged access to the service are large organizations that want callbacks when new data that matches their users is entered. This seems like a very reasonable balance between making money to pay for hosting related fees, and providing a free and publicly available service.
c2h5oh 9y ago
Strongly no. In an better world existence of such dataset would be unnecessary. In the less ideal one you have to look at it's existence in a broader context. - it provides a clearly beneficial service to owners of those email accounts bridging the gap in the legal systems (disclosure requirements) - it's exposed in a way that keeps the risk of 3rd party exploitation low: doesn't leak information unless you have access to email account - it has not to my knowledge been abused in any way and public is keeping check on that - there would have been an outcry that would not go unnoticed - it's less of a high value target than you'd think - it's built from data that is already in the wild and could be pieced together by a sufficiently motivated actor, especially in the light of the recent combined lists with hundreds of millions of emails surfacing.. Quite frankly if you look at just that it scores better than most datasets gathered by websites requiring user registration. The only thing missing here really is the consent to be included in that list, but given the sources of the data and the points above I find lack of it more than sufficiently justified.
rimliu 9y ago
For a bit more serious case see https://en.wikipedia.org/wiki/New_York_Times_Co._v._United_States https://en.wikipedia.org/wiki/New_York_Times_Co._v._United_S...
heartbreak 9y ago
During his recent visit to the US he testified before Congress on issues regarding data breaches. That would have been one hell of a bait and switch.
tomalpha 9y ago
In the UK (where Troy is not based), I guess a prosecutor might try and build a case around either: - Section 58 of the Terrorism Act[0] which makes it illegal to possess information "likely to be useful to a person committing or preparing an act of terrorism", though the law provides "reasonable excuse" as an explicit defence. - Section 3A of the Computer Misuse Act[1] "making, supplying or obtaining articles for use in unauthorised access to computer material" [my paraphrasing] It feels like Troy has a pretty strong defence of "reasonable excuse" to my lay understanding though. [0] https://www.legislation.gov.uk/ukpga/2000/11/section/58 https://www.legislation.gov.uk/ukpga/2000/11/section/58 [1] https://www.cps.gov.uk/legal-guidance/cybercrime-prosecution-guidance https://www.cps.gov.uk/legal-guidance/cybercrime-prosecution...

tyingq 9y ago

Curious which specific US law(s) it violates. Sounds like he downloaded a few torrents and built a search interface.

Griffinsauce 9y ago

You jumped to illegal before even explaining why it's unethical.

mi100hael 9y ago

Simply possessing the information (which is already freely available online) is not on its own unethical. It depends entirely upon what he does with the information, which in this case is protect the owners from malicious individuals who also have access to the information because it's freely available online.

2close4comfort 9y ago
It is if its stolen property...which most of that data belonged to the company that was hacked.
- emodendroket 9y ago
  I'm not going to pretend to understand the legal niceties here, but the analogy to "stolen property" rings false because 1) he's not depriving anybody of their passwords 2) the very fact they've been leaked means they aren't really of value anymore.

snug 9y ago

These passwords were already publicly available, some with the email address associated with them.

joshuata 9y ago

He has written about that very problem here: https://www.troyhunt.com/the-ethics-of-running-a-data-breach-search-service/ https://www.troyhunt.com/the-ethics-of-running-a-data-breach...

2close4comfort 9y ago
Charging people to access my stolen info seems like it is less of a service and more about Troy than anything else.
- joshuata 9y ago
  From what I understand, the only people that are charged access to the service are large organizations that want callbacks when new data that matches their users is entered. This seems like a very reasonable balance between making money to pay for hosting related fees, and providing a free and publicly available service.

c2h5oh 9y ago

Strongly no. In an better world existence of such dataset would be unnecessary. In the less ideal one you have to look at it's existence in a broader context. - it provides a clearly beneficial service to owners of those email accounts bridging the gap in the legal systems (disclosure requirements) - it's exposed in a way that keeps the risk of 3rd party exploitation low: doesn't leak information unless you have access to email account - it has not to my knowledge been abused in any way and public is keeping check on that - there would have been an outcry that would not go unnoticed - it's less of a high value target than you'd think - it's built from data that is already in the wild and could be pieced together by a sufficiently motivated actor, especially in the light of the recent combined lists with hundreds of millions of emails surfacing.. Quite frankly if you look at just that it scores better than most datasets gathered by websites requiring user registration. The only thing missing here really is the consent to be included in that list, but given the sources of the data and the points above I find lack of it more than sufficiently justified.

rimliu 9y ago

For a bit more serious case see https://en.wikipedia.org/wiki/New_York_Times_Co._v._United_States https://en.wikipedia.org/wiki/New_York_Times_Co._v._United_S...

heartbreak 9y ago

During his recent visit to the US he testified before Congress on issues regarding data breaches. That would have been one hell of a bait and switch.

tomalpha 9y ago

In the UK (where Troy is not based), I guess a prosecutor might try and build a case around either: - Section 58 of the Terrorism Act[0] which makes it illegal to possess information "likely to be useful to a person committing or preparing an act of terrorism", though the law provides "reasonable excuse" as an explicit defence. - Section 3A of the Computer Misuse Act[1] "making, supplying or obtaining articles for use in unauthorised access to computer material" [my paraphrasing] It feels like Troy has a pretty strong defence of "reasonable excuse" to my lay understanding though. [0] https://www.legislation.gov.uk/ukpga/2000/11/section/58 https://www.legislation.gov.uk/ukpga/2000/11/section/58 [1] https://www.cps.gov.uk/legal-guidance/cybercrime-prosecution-guidance https://www.cps.gov.uk/legal-guidance/cybercrime-prosecution...