united-states privacy hacking
Is it legal to publish personal information obtained in public?
<p>Lets say I built a device using some software like <a href="https://sourceforge.net/projects/nfcproxy/" rel="nofollow noreferrer">NFCProxy</a> or a hardware/software kit like <a href="https://store.ryscc.com/products/new-proxmark3-kit" rel="nofollow noreferrer">Proxmark3</a> and just stood in middle of a sidewalk with a high amount of foot traffic and I passively captured all the data of the people walking by me. The data captured might include personal/private information like credit cards, passports, drivers license, building access cards, etc. Basically anything that uses radio frequencies to transmit data within a certain proximity. </p>

<p>Since the data was captured passively and in public. Would publishing that data on a public website/forum be illegal? </p>

<p>EDIT: For clarification, This is for a cyber security project I had in mind to show the vulnerabilities in everyday items we carry with us (Phones, Tablets, Credit/Access Cards, ID's, etc). This is to raise awareness and eventually secure these devices properly.</p>

<p>This would probably constitute illegal wiretapping and would certainly constitute a 4th Amendment search if conducted by law enforcement. </p>

<p>Normally, the definition of whether something is "public" for purposes of an expectation of privacy is whether it could be detected by a human being unaided by technological enhancements from a place where someone could lawfully be to make that kind of observation. </p>

<p>Some of the relevant cases are <em>Katz v. U.S.</em>, 389 U.S. (1967) (tape recorder outside a public telephone booth was a search violating the expectation of privacy) and <em>U.S. v. Karo</em>, 468 U.S. (1984) (tracking device placed in barrel by authorities violated expectation of privacy).</p>

<p>RFID signals are not "public" even if they are not encrypted with a private code because a device, such as the ones identified in the question, is necessary to receive them.</p>

<blockquote>
  <p>The Wiretap Act, codified by 18 U.S. Code § 2511, is a federal law
  aimed at protecting privacy in communications with other persons.
  Typically, when you think of a "wiretap," the first thing that comes
  to mind is someone listening to your telephone calls. But the Act
  protects more than that. Under the Act, it is illegal to:</p>
  
  <ul>
  <li><p>intentionally or purposefully</p></li>
  <li><p>intercept, disclose, or use the contents of any wire, oral, or electronic communication</p></li>
  <li><p>through the use of a "device."</p></li>
  </ul>
  
  <p>The Act provides criminal and civil penalties for violations, although
  it creates various exceptions to when interceptions and disclosures
  are illegal.</p>
</blockquote>

<p>From <a href="http://communications-media.lawyers.com/privacy-law/wiretapping.html" rel="nofollow noreferrer">here</a>.</p>

<p>In this circumstance, despite being passive, one is intentionally intercepting the contents of electronic communications through the use of a device. The fact that there was not in all cases an intent to communicate through, for example, an RFID chip, on a specific occasion probably does not suffice to render it not a communication.</p>

<p>Extending ohwilleke's conclusion, RFID sniffing is interception of electronic communication (defined in 18 USC 2510(12)):</p>

<blockquote>
  <p>“electronic communication” means any transfer of signs, signals,
  writing, images, sounds, data, or intelligence of any nature
  transmitted in whole or in part by a wire, radio, electromagnetic,
  photoelectronic or photooptical system that affects interstate or
  foreign commerce, but does not include—</p>
  
  <p>(A) any wire or oral communication;</p>
  
  <p>(B) any communication made through a tone-only paging device;</p>
  
  <p>(C) any communication from a tracking device (as defined in section
  3117 of this title); or</p>
  
  <p>(D) electronic funds transfer information stored by a financial
  institution in a communications system used for the electronic storage
  and transfer of funds</p>
</blockquote>

<p>Oral communication, (2) that section</p>

<blockquote>
  <p>means any oral communication uttered by a person <em>exhibiting an
  expectation that such communication is not subject to interception
  under circumstances justifying such expectation</em>, but such term does
  not include any electronic communication</p>
</blockquote>

<p><a href="http://openjurist.org/630/f2d/414/briggs-v-american-air-filter-co-inc-f-c-roby#fn4_ref" rel="nofollow noreferrer">Briggs v. American Air Filter</a>, 630 F.2d 414 points to this distinction, saying</p>

<blockquote>
  <p>As we have noted, see n. 4 supra, interception (as defined by the
  statute) of wire communications is forbidden <em>regardless of the
  speaker's expectation of privacy</em></p>
</blockquote>

<p>The same reasoning would hold of electronic communication, since there is no "expectation of privacy" language in the definition of either wire or electronic communication – unlike oral communication. Thus the issue of "no expectation of privacy" falls by the wayside, and the interception is plainly illegal.</p>
