With so many identities stolen last ten years, we know a bunch of emails and a bunch of passwords.

Are the two following databases legal under the US federal laws?

  1. Publish a database which victim's identity is paired up with victim's known passwords

  2. Publish a database which has a table of email addresses and another table of passwords that have been cracked without pairing up with any victim.

  • Questions of legality aside, you may want to consider the question of whether it's ethical. Would you be jeopardizing their security? Some may have recycled the compromised password for their emails (or other accounts). What about their privacy? Some people choose embarrassing passwords, and, depending on where the database came from, the fact that they had an account their might be something they don't want published.
    – Seth
    Dec 8, 2013 at 6:21
  • @Seth I think it is ethical. Yes, the first database is certainly very hard to push. The second database shields the issue of embarrassing password or guessing one's pattern. The ethical issue of releasing this massive db is trivial. To improve password meter or to understand how password is constructed, we need this database. And this extends to area in private information retrieval. How one would solve querying "is my password in this db" without me actually knowing the relationship between you and "this query that just made".
    – CppLearner
    Dec 8, 2013 at 23:45

1 Answer 1


Its depends on your state (But it's similar) It's Illegal !
for example for state of kansas :

Statute 21-3755: Computer crime; computer password disclosure; computer trespass. (a) As used in this section:

  (1)   "Access" means to instruct, communicate with, store data in, retrieve data from or otherwise make use of any resources of a

computer, computer system or computer network.

  (2)   "Computer" means an electronic device which performs work using programmed instruction and which has one or more of the

capabilities of storage, logic, arithmetic or communication and includes all input, output, processing, storage, software or communication facilities which are connected or related to such a device in a system or network.

  (3)   "Computer network" means the interconnection of communication lines, including microwave or other means of electronic

communication, with a computer through remote terminals, or a complex consisting of two or more interconnected computers.

  (4)   "Computer program" means a series of instructions or statements in a form acceptable to a computer which permits the

functioning of a computer system in a manner designed to provide appropriate products from such computer system.

  (5)   "Computer software" means computer programs, procedures and associated documentation concerned with the operation of a

computer system.

  (6)   "Computer system" means a set of related computer equipment or devices and computer software which may be connected or


  (7)   "Financial instrument" means any check, draft, money order, certificate of deposit, letter of credit, bill of exchange,

credit card, debit card or marketable security.

  (8)   "Property" includes, but is not limited to, financial instruments, information, electronically produced or stored data,

supporting documentation and computer software in either machine or human readable form.

  (9)   "Services" includes, but is not limited to, computer time, data processing and storage functions and other uses of a computer,

computer system or computer network to perform useful work.

  (10)   "Supporting documentation" includes, but is not limited to, all documentation used in the construction, classification,

implementation, use or modification of computer software, computer programs or data.

  (b) (1)   Computer crime is:

  (A)   Intentionally and without authorization accessing and damaging, modifying, altering, destroying, copying, disclosing or

taking possession of a computer, computer system, computer network or any other property;

  (B)   using a computer, computer system, computer network or any other property for the purpose of devising or executing a scheme or

artifice with the intent to defraud or for the purpose of obtaining money, property, services or any other thing of value by means of false or fraudulent pretense or representation; or

  (C)   intentionally exceeding the limits of authorization and damaging, modifying, altering, destroying, copying, disclosing or

taking possession of a computer, computer system, computer network or any other property.

  (2)   Computer crime is a severity level 8, nonperson felony.

  (3)   In any prosecution for computer crime, it is a defense that the property or services were appropriated openly and avowedly

under a claim of title made in good faith.

  (c) (1)   Computer password disclosure is the unauthorized and intentional disclosure of a number, code, password or other means of

access to a computer or computer network.

  (2)   Computer password disclosure is a class A nonperson misdemeanor.

  (d)   Computer trespass is intentionally, and without authorization accessing or attempting to access any computer, computer

system, computer network or computer software, program, documentation, data or property contained in any computer, computer system or computer network. Computer trespass is a class A nonperson misdemeanor.

  (e)   This section shall be part of and supplemental to the Kansas criminal code.

More : http://kansasstatutes.lesterama.org/Chapter_21/Article_37/21-3755.html
More : http://oits.ks.gov/security/policy.htm


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .