-5

I have a standard forum, currently plagued with bots. In the registration agreement, I included the following text:

SPAMBOT OWNERS, YOU HEREBY WAIVE ALL YOUR RIGHTS TO PRIVACY. ANY AND ALL INFORMATION YOU OR YOUR BOTS LEAVE, INTENTIONALLY OR ACCIDENTALLY, ON THESE FORUMS CAN AND WILL BE EXPLOITED. YOU HEREBY ALLOW US TO HACK YOUR COMPUTER(S), INTERNET CONNECTION, ETC.

While I doubt the spammers will ever go to the FBI (their IPs are all in Russia), I want to know how legal it is to hack them. After all, they did agree to it.

closed as off-topic by Eric G, Xander, Gilles, TildalWave, Adi Apr 20 '14 at 7:04

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Eric G, Xander
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    What kind of hack do you mean exactly ? – ack__ Apr 19 '14 at 7:17
  • I guess they agreed to your EULA (is it a EULA?) before you included the above amendment? I think you should then send them an email (if they have an account) to notify them of the change? – Steven Volckaert Apr 19 '14 at 7:31
  • 1
    People could pick at your EULA. For example, assume I "own" a spambot (although ownership of such a thing would be odd... most software is licensed, not sold, so I don't "own" most of my software). Then, if I visit your website and agree to your EULA, then, per your EULA, I have agreed to be hacked even if I never deploy my bot on your site! I would try to make your EULA seem absurd in court, if there was ever legal action taken. – apnorton Apr 19 '14 at 14:54
  • 1
    SEC.SE is not a law firm, for legal advice you should consult with a lawyer; a better fitting question may be how to prevent and limit the bots from getting on your forum or hardening the forum. – Eric G Apr 19 '14 at 18:24
  • 3
    This question appears to be off-topic because it is purely about legal aspects. Besides being off-topic, is is far too underspecified to answer. – Gilles Apr 19 '14 at 19:44
6

If you sign a paper that says it's okay to kill you would you agree that this is legal? Of course not. While law is different for every country, most have a prinicple which says that a law cannot be waved with a contract. This isn't even a contract, but just an agreement. Therefore it is still illegal to do so as accessing someone else his computer without their permission is considered a crime.

Furthermore

ANY AND ALL INFORMATION YOU OR YOUR BOTS LEAVE, INTENTIONALLY OR ACCIDENTALLY

If you "find" this information from a victim and contains data that falls under the privacy law, you can be considered in breach as well if you do not handle it correctly.

Of course this all depends on where you live.

  • Didn't they give me permission to access their computer while signing up? They had to accept the agreement while making an account. The information consists mostly of IP addresses and spamposts. – Skylar Ittner Apr 19 '14 at 7:58
  • 3
    Nope, it's still illegal by law. The law protects people from doing stupid things, this includes protection from non-sensical EULA rules as the one drafted above. – Lucas Kauffman Apr 19 '14 at 8:13
6

Most importantly, you need to consider the fact that these bots are not the machines of the attacker themselves, but rather victim PC's likely controlled as part of a larger botnet.

These machines are most likely those of users uneducated in the ways of computer security and general online know how. If you were to attack these users, it's likely the bot-master wouldn't care and you'd be adding to the woes of the 'innocent' user by attacking them personally.

A better idea might be to get in contact with their ISP's and see if they can reach out to the infected users but given the size and scale of some botnets, i'd probably just recommend using CAPTCHAs everywhere.

Not the answer you're looking for? Browse other questions tagged or ask your own question.