united-states privacy
Is It Illegal to sell passwords?
<p>Is it unlawful in the United States to sell passwords of other people?</p>

<p>If the passwords were obtained through malicious attacks on an organization's database, does that affect the legality?</p>

<p>Assuming here that this is without the permission of the current account-holder. As discussed above, from a tort law angle there would be some confusion as to who owned the password in the first place. However, under US Federal Criminal Law, such action is explicitly criminalized: Title <a href="https://www.law.cornell.edu/uscode/text/18/1030" rel="nofollow noreferrer">18 USC§ 1030(a)(6)(A)</a> [Computer Fraud and Abuse Act] provides that:</p>
<blockquote>
<p>(6) [Whoever] knowingly and <strong>with intent to defraud traffics (as defined in section 1029) in any password or similar information through which a computer may be accessed</strong> without authorization, if—</p>
<p>(A) such trafficking affects interstate or foreign commerce; or</p>
<p>(B) such computer is used by or for the Government of the United States;</p>
<p>... shall be punished as provided in subsection (c) of this section.</p>
</blockquote>
<p>Subsection C then sets a punishment for such a crime at a fine and/or imprisonment for up to 1 year. Repeat offenses (this applies to <em>any</em> past offense under any part of the CFAA, not just password trafficking) have a maximum sentence of 10 years.</p>
