0

Today my mother received an email from herself, containing the following message

This is an automated message by an email validator. If you are receiving this email it means that your email address and password have been compromised. I would suggest and urge you to change your password as soon as possible. This email was sent using your credentials (see sender) as proof of it.

I confirmed it was not just some scam mail posing as my mother email, but it really was sent and received from her own email.

Would the usage of an compromised email address in such a way be considered illegal? Or would it be considered a gray zone, due to the nature of the send email?

Improve this question
4
  • "I confirmed it was not just some scam mail..." How did you confirm this was a real email? Email headers? By a sysadmin? If it's not real, it's simply common spam and not a case of a password or account being compromised.
    – BlueDogRanch
    Commented Jan 16, 2017 at 15:22
  • @BlueDogRanch For starters, by checking the sent emails of the account, where the sent email was found as well. I also validated the headers, and with the limited knowledge I do have about those, they did seem to be correct. But I think the fact that the email could be found in the 'sent' folder of the receiver confirms plenty.
    – MX D
    Commented Jan 16, 2017 at 15:52
  • That's still not conclusive. What is the email domain? A company? Who is the ISP? A company intranet? That email could be from a sysadmin at a private company who has full rights to read/send/manage all email. It could be an IMAP Exchange Server where all email is available in all clients.
    – BlueDogRanch
    Commented Jan 16, 2017 at 17:10
  • @BlueDogRanch i let my companys sysadmin take a look. The email originates from an server in germany. It does not seem to be affiliated to a company, and is regidtered to an anonymous user. Security headers suggested the .net smtp (net mail) was used to send the email. He confirmed that it was indeed send using my mothers email.
    – MX D
    Commented Jan 16, 2017 at 17:19

1 Answer 1

Reset to default
0

If they compromised the data themselves, yes this is illegal. In the UK there is the computer misuse act, in other EU countries there are slimier laws thanks to the EU. For the computer misuse act in the UK, section 1 states "A person is guilty of an offence if he causes a computer to perform any function with intent to secure access to any program or data held in any computer [and] the access he intends to secure is unauthorised; and he knows at the time when he causes the computer to perform the function that that is the case"

I am unsure if there are any laws regarding handling data gained in an illegal manner but there are likely to be some. (likely to be in data protection act)

I would like to ask that you not not hold the person/company who emailed you responsible, they are doing what is known as responsible disclosure, where they are telling those involved that a breach has happened, most likely by another party. It is healthy for people to shout about insecure systems because that is the only way they will get fixed. If google find a broken system they tell the company it is broken and then give them a week to fix it before telling the world, even if it is not fixed.

If your medical details were left in view of the window, someone is trespassing and looks into the window and tells you that your details were visible, who do you blame? The trespasser who shouldn't have been there or the doctor for leaving your data somewhere insecure? Both parties are responsible, the trespasser for trespassing (or in your case unauthorized access to your data as mentioned above) and the doctor for not securing your personal data (Data protection act SCHEDULE 1, part 1, no 7, "Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.").

Any company worth dealing with will not have access to your password, only a representation of your password (think of your password being 5x6, the company would store 30 because it is easy to get from 5x6 to 30 but hard to get from 30 to 5x6) This is step one two how to store passwords (step one is try not to store passwords eg. sign in with facebook, google etc.)

I know of a company in the UK who were given 30 days to secure their system otherwise they would be getting £5000 per day fine due to data protection laws. It is the company's responsibility to secure your data.

Hope this helps. If you want to see if your details have been compromised elsewhere https://haveibeenpwned.com/ is a service that you put your email address in and it searches its database of breaches. It is run by a well respected security researcher who is very responsible with the data he holds.

Improve this answer
1
  • This is after all a site about law, so I think this answer would be a lot more helpful if you could add more detail about the laws you mention in the first paragraph - perhaps with specific citations, and explaining why you think they forbid the conduct described in the question. The remaining paragraphs may be useful practical advice but I don't see how they are relevant to law.
    – Nate Eldredge
    Commented Jan 16, 2017 at 18:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .