Legality of using data obtained by hacking to make a blog post

Question

As a data scientist, based in the UK, I am thinking about downloading the recently leaked Ashley Madison data, producing some interesting statistics (none of them incriminating), and using them to write a data blog post or making a dashboard about them. I would make all text completely impartial towards Ashley Madison or the users, since I only care about the statistical insights that could be drawn from the data.

What possible legal problems could I face? I'm guessing that the data is "owned" in the IP sense by Avid Life Media, but it's also very public.

Many thanks.

Answer 1

These are some thoughts about the state of affairs in the US, I do not know how it works in the UK.

In the US it seems to be a legal gray area. Gray enough that I do not think any lawyer could say for certain that the use of the data is legal. The data is stolen. If possessing stolen property is illegal then possessing this data is also likely illegal. Of course experts disagree, Stuart Karle, an adjunct media professor at Columbia University and former general counsel for the Wall Street Journal says:

...the documents have been published by the hackers, they are now public by virtue of being put on the Internet.

But Barrett Brown was charged with trafficking in stolen authentication when he forwarded a link to some stolen emails. He signed a plea for acting as an accessory after the fact. He spent more than a year in jail while they sorted it out.

In the US there is no law banning the download of hacked documents. In fact Bartnicki v. Vopper 532 US 514 (2001) stands for the rule that journalists can report on illegally obtained information. But contrast that with the Barret Brown prosecution! And decide where a data scientist fits. Also there is the question of whether an illegally recorded conversation is of the same "illegal" nature as hacked personal information.

Answer 2

In the UK the documents would be covered by Data Protection laws. If your report is using the data in a commercial context you would have to comply with those rules, and it is hard to see how you could since the subjects of the data have not given permission for you to use it.

If you are an academic or hobbyist the only risk is being sued by the subjects of the data (the site users) if they feel that your analysis has in some way harmed them financially.