united-states privacy hacking defamation first-amendment
In the United States (Michgan) is it legal to publish IP Addresses that were trying to hack my web server?
<p>I have a private web server that gets attacked a lot (brute forces, nmap scans). I would like to compile a list of the IP addresses that were trying to hack my server and publish them on my website. Is this legal? I realize that the IP address could belong to a botnet (so the owner of the IP address is unwillingly knows that it's comprised).</p>

<p>In general, you can publish anything unless an exception to the First Amendment applies.</p>

<p>The only exception that could plausibly be relevant is that you could be improperly defaming someone else's reputation.</p>

<p>If you have a good faith believe that these IP addresses were used to hack your server, this would almost surely be a matter of public concern (why else publish) and would involve a statement that was not false or made with reckless disregard for its truth or falsity.</p>

<p>To avoid inadvertently tarnishing someone else's reputation, you might consider including a notice that recognizes that the IP addresses could belong to a botnet and was not controlled by the legitimate owner of the IP addresses together with your "page of shame".</p>

<p>Think about your website like it's your own country and the "Terms of Service" and your "Privacy Policy" like the bill of rights of the country. You can set any terms you like and anyone who visits the website can either agree to terms or leave. If one of the terms is that any malicious activity will allow you to publish any connection information. Then you are clear to do what you wish with the information of any malicious connections.</p>
