Doxing violates US law

"Spying on data" is the name of the relevant offense in Section 202a of the Criminal Code. The hacker, who calls himself "Orbit" or "God", and his accomplices face a fine or imprisonment of up to three years. The penal provision has existed since the Second Act to Combat Economic Crime from 1986. It reads as follows: "Anyone who gains unauthorized access to data that is not intended for them while overcoming the security of access is subject to imprisonment up to three years or a fine. "

In this way, the right to informational self-determination is protected. And it is already punished if a perpetrator gains unauthorized access to the data; it is not at all necessary that he then actually procures the data, that he retrieves and calls them up. So even mere hacking, i.e. cracking a computer system without spying on data, is punished.

Any hacking will be punished

The mere hacking without the siphoning off of data was not originally sanctioned - in order, it was said, to avoid over-criminalization. Of course, this was soon seen as a mistake, the courts interpreted the "obtaining-of-data" broadly, so that many cases of hacking were punished against the actual intention of the legislature. The legislature followed suit, guided by an EU framework decision on attacks on information systems: Since August 11, 2007, hacking has been punished. Since then, the law no longer states that "obtaining data" is punished, but rather "obtaining access". The criminal liability is thus shifted forward.

However, the data must be specially protected against unauthorized access - by passwords, hardware security, electronic fingerprints or biometric access procedures; However, conventional safeguards can also be considered, for example keeping them in closed containers. The law demands that access security be "overcome". Overcoming is also understood to mean bypassing the access security - so that the cases that are common in practice (for example artificially induced system overload) are recorded under criminal law.

Improper use

And it has to be data that is not intended for the perpetrator. The improper use of data that is intended for the user does not meet the criteria: If a police officer calls up car owner data for private purposes, this is not "spying on" according to Section 202a of the Criminal Code.

According to Paragraph 202 b, the "interception of data" is punished - if a perpetrator uses technical means to obtain data from a non-public data transfer. The mere preparation for hacking, spying on or intercepting data (for example password theft) is already punishable - with imprisonment for up to one year or with a fine.

The dissemination and publication of illegally obtained data is punished as an administrative offense under the Federal Data Protection Act. If the publication and distribution is done with the intention of enriching oneself or harming another, it is a criminal offense - punishable by a prison term of up to two years or a fine. If a perpetrator obtains or disseminates the data that someone else has spied on, there may also be data theft according to Paragraph 202 d, in the event of damage or enrichment intent; it is fined or imprisoned for up to three years.

Filing offenses

All of these crimes are claims offenses. So you will only be prosecuted at the request of the injured party. When spying on and intercepting data and stealing data, however, the public prosecutor's office can affirm a special public interest in criminal prosecution and then prosecute it without filing a criminal complaint by the injured party.

What is strange is that attempting all of these crimes is not punished. The unsuccessful virtual break-in attempt therefore remains unpunished, even if it is practiced en masse. The legal system is wrong in the back and front - because the "preparation for spying on and intercepting data" (for example the password clause mentioned above) according to Paragraph 202c is even pursued ex officio. But: This paragraph does not help with passwords and tools that are kept abroad - German criminal law generally only applies to crimes that are committed in Germany.