3

I found a US law firm's SQL database indexed on Google exposing email addresses, phone numbers, comments/questions of its clients. Not to mention the user database with even worse information. This is obviously some highly sensitive data that shouldn't be publicly archived.

Is it legal to access this using Google search, confirm by going to the database webpage, and then report it to the affected law firm as a problem? No unauthorized access was leveraged considering all I did was use a Google search term to locate indexed websites with filetype:sql

migrated from security.stackexchange.com Apr 30 at 10:53

This question came from our site for information security professionals.

  • Not exactly on point, but the lawyer's at that law firm would almost certainly receive some sort of regulatory discipline for violations of ethical rules pertaining to attorneys if this was reported to attorney regulation in the state where they practice and it would also be a basis for a potentially big $$ lawsuit against the law firm. They would be fools to try to shoot the messenger in this situation. – ohwilleke May 31 at 2:35
2

I am not a lawyer. I'm not your lawyer. If you want a valid legal opinion pay a lawyer to give you one.

Of course it's legal to tell somebody his database is publicly accessible by searching on Google, with the following caveats:

  1. Avoid to the greatest degree possible accessing any of the information in the database. If you did access any of the information, be prepared to explain why it was necessary.
  2. Do not tell anybody except the owner of the database (or his agent, as appropriate) about what you have found. If you cannot be 100% confident of the owner, either report it to the authorities (no, I'm not sure what authority would be the right one or if there is one) or do nothing.
  3. If you're going to report it, report it sooner rather than later. If you do report it, be prepared to give the date you found it, the date you reported it, and an explanation (if requested) for the time between the two.

In general, the law will not prohibit, and juries will not condemn, and judges will not punish reasonable and well-intentioned actions. To do so would be contrary to public policy, ethics and justice. There are, of course, exceptions to this, but I am not aware of an exception that would be relevant in this case. If I notice my neighbor left his door open:

  1. it would not be illegal to tell him about it
  2. if I went in his house, I'd better have a good explanation
  3. if I told somebody else besides him, there had better be a good reason I did so
  4. if I knew but waited six weeks to mention it (suppose he's on vacation and I have his phone number) there had better be a good reason I didn't mention it sooner
  5. if I never say anything I can reasonable argue I simply failed to notice; there's not necessarily a duty of care I need to meet if it can't be proven I reasonably should have known and should have been responsible to act
1

There is some lawful controversy as to whether obtaining data on a webserver is simply accessing public information on the web or whether it was through "hacking". A savvy computer user might be able to access a lot of files on a webserver that was not intended to be accessed by the server admins. Is finding access to these files a form of illegal hacking or are they publicly accessible?

Part of the issue in determining the legality of this is that a lot of people in law fields aren't technically savvy enough to understand the difference between hacking and simply viewing public web addresses. As a result, you could encounter lawyers who think you're stealing their personal databases.

On the bright side, because you've found these SQL databases indexed with Google, it's much more clear that these SQL databases have been made public. If you're at all concerned that the lawyers you would be reporting this to could mistakenly turn on you then you might want to send this information to them anonymously.

Remember, anyone can be sued for just about anything. And with a strong enough legal argument and a weak enough legal defense, anyone could win a lawsuit in court.

0

Assuming you're in the United States, I think Patrick87 has provided good advice from a practical and ethical perspective.

As a legal matter, though, I don't believe any of his caveats or necessary. You have no "duty of care" as a result of your discovery, and it would probably be legal to do just about whatever you wanted with the database.

You obtained it legally, and the First Amendment generally permits you to use legally acquired information as you see fit. Tell no one, tell the firm, tell the clients, tell the press, use it to start a competing law firm, upload to Wikileaks -- all those options would likely be legal.

  • If someone gives you information illegally, the mere that you didn't do anything illegal doesn't mean you are free to do anything you want with the information. – Acccumulation May 31 at 17:22
  • Not literally anything, of course; you can't use the information to extort people or print it out and use it to beat someone to death. But if we're just talking about disclosing the contents of a lawfully accessed database or the existence of the database, I'd love to see any cases you know of limiting the right to do so. – bdb484 May 31 at 21:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy