Is it unlawful in the United States to sell passwords of other people?

If the passwords were obtained through malicious attacks on an organization's database, does that affect the legality?

  • 1
    Do you mean "sell with permission of the account owner", or "sell without permission of the account owner"? – user6726 Aug 31 '16 at 22:52
  • @Dawn Why not? That's also a perfectly good question too. Passwords may be considered the property of the system owner and not the account holder. – David Schwartz Sep 1 '16 at 17:08
  • 1
    @DavidSchwartz Just didn't think that was the angle that the asker was going for. – user3851 Sep 1 '16 at 17:22
  • 1
    The system owner should not even know what the password is. – gnasher729 Sep 2 '16 at 14:47
  • 1
    He should securely hash the passwords but there's no way to enforce that. Also a compromise could occur while a password is en route to being secured. – Ammar Bandukwala Sep 2 '16 at 14:49

Assuming here that this is without the permission of the current account-holder. As discussed above, from a tort law angle there would be some confusion as to who owned the password in the first place. However, under US Federal Criminal Law, such action is explicitly criminalized: Title 18 USC§ 1030(a)(6)(A) [Computer Fraud and Abuse Act] provides that:

(6) [Whoever] knowingly and with intent to defraud traffics (as defined in section 1029) in any password or similar information through which a computer may be accessed without authorization, if—

(A) such trafficking affects interstate or foreign commerce; or

(B) such computer is used by or for the Government of the United States;

... shall be punished as provided in subsection (c) of this section.

Subsection C then sets a punishment for such a crime at a fine and/or imprisonment for up to 1 year. Repeat offenses (this applies to any past offense under any part of the CFAA, not just password trafficking) have a maximum sentence of 10 years.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.