2

Is it unlawful in the United States to sell passwords of other people?

If the passwords were obtained through malicious attacks on an organization's database, does that affect the legality?

6
  • 1
    Do you mean "sell with permission of the account owner", or "sell without permission of the account owner"?
    – user6726
    Aug 31 '16 at 22:52
  • @Dawn Why not? That's also a perfectly good question too. Passwords may be considered the property of the system owner and not the account holder. Sep 1 '16 at 17:08
  • 1
    @DavidSchwartz Just didn't think that was the angle that the asker was going for.
    – user3851
    Sep 1 '16 at 17:22
  • 1
    The system owner should not even know what the password is.
    – gnasher729
    Sep 2 '16 at 14:47
  • 1
    He should securely hash the passwords but there's no way to enforce that. Also a compromise could occur while a password is en route to being secured. Sep 2 '16 at 14:49
4

Assuming here that this is without the permission of the current account-holder. As discussed above, from a tort law angle there would be some confusion as to who owned the password in the first place. However, under US Federal Criminal Law, such action is explicitly criminalized: Title 18 USC§ 1030(a)(6)(A) [Computer Fraud and Abuse Act] provides that:

(6) [Whoever] knowingly and with intent to defraud traffics (as defined in section 1029) in any password or similar information through which a computer may be accessed without authorization, if—

(A) such trafficking affects interstate or foreign commerce; or

(B) such computer is used by or for the Government of the United States;

... shall be punished as provided in subsection (c) of this section.

Subsection C then sets a punishment for such a crime at a fine and/or imprisonment for up to 1 year. Repeat offenses (this applies to any past offense under any part of the CFAA, not just password trafficking) have a maximum sentence of 10 years.

2
  • Suppose I steal somebody's password to access somebody else's account on a computer/server that I already have access to through an account of my own, is that illegal? By that definition, it seems it would not be, since I would already be authorized to access that computer/server.
    – jvriesem
    Apr 19 '20 at 16:50
  • 1
    @jvriesem you should look at the text of the statute. It explicitly covers "exceeding authorized access". Using somebody else's account without their permission would definitely be "exceeding authorized access". Apr 19 '20 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.