1

Inspired by this question: https://security.stackexchange.com/q/210045/43940

Someone, person A, created an account using the email of someone else, person B. Person B noticed, logged in and reset the password, essentially taking ownership of the account. There are several comments saying that this violates some laws.

BTW, what you did was knowingly locking someone out of their account and accessing their info, which may get you heavy fines or jail time. The probability of that is of course small, but remember that lady who shared a handful of songs on e-mule, then was asked to pay $10'000 per song: I bet she didn't expect it either.

The intention of person A is unknown but its speculated that they were taking advantage of free trials. I dont know if the intention matters. However, I would think this would almost be similar to domain squatting or taking a user name on a social media site in order to extort money from another user that would want to use that identity.

Is there any law related to the prevention of someone using an online identity in this way?

zero298
  • 111
  • 3

2 Answers2

-1

It has nothing to do with the email being sent to you, but you can't steal someone's account in general whether the email came to you or anyone.

Taking something someone paid for is theft.

Putvi
  • 4,050
  • 11
  • 22
-2

The relevant law, in the US, is (starts at) 18 USC 2701. It is a crime if one "intentionally accesses without authorization a facility through which an electronic communication service is provided". This law applies to any unauthorized access, be it to an email account or an online forum. Although the initial act was a crime, that does not excuse a subsequent violation – duo iniuria ius non efficiunt. This answer on a somewhat related question reminds us that one is not allowed to commit another crime to get retribution for a law-breaker. You can however file a complaint with the authorities.

The punishment for the email account owner would probably be more severe than it for the initial criminal: 5 years vs. 1 year. The distinction resides in the purpose of the crime. On the assumption (not guaranteed from the hypothetical) that the use of email was simply to avoid being traced, there is no commercial advantage to avoiding being detected, no malicious destruction, creating an account is not a crime of tortious action, so the trigger condition for the higher sentence is not met.

if the offense is committed for purposes of commercial advantage, malicious destruction or damage, or private commercial gain, or in furtherance of any criminal or tortious act in violation of the Constitution or laws of the United States or any State

Locking a person out of their email account is malicious and creates damage (loss of access to the account).

user6726
  • 217,973
  • 11
  • 354
  • 589