Sales of accounts and invites to invite-only sites

[theymos]

Selling invites is allowed, but there are some restrictions in order to prevent people from selling accounts and invites obtained through hacking. In order to sell invites or accounts to invite-only sites, you must:
- Have some history here, with more history being required for trades of invites/accounts in bulk. Or,
- Have substantial history on reputable invite trading forums such as torrentinvites.org which prohibit selling hacked accounts. Or,
- Be vouched for by someone from one of the above two categories.

[shep]

Selling invites is allowed, but there are some restrictions in order to prevent people from selling accounts and invites obtained through hacking. In order to sell invites or accounts to invite-only sites, you must:
- Have some history here, with more history being required for trades of invites/accounts in bulk. Or,

Any sales of credentials for service accounts where a right to property does not exist for the user IS illegal (misuse of access). Access to an account without the express permission of the site owner is constituted as illegal access and any services used is theft of service. There is no major difference between providing credentials or access codes to authorize service on an internet modem, a cable box, or satellite dish than there is providing credentials to a website to gain access to services. Re-selling services when not explicitly authorized is illegal access.

There is an exception pertaining to transferability of accounts (or the goods within those accounts) when the account contains physical property of the account holder (such as a lock box containing personal possessions) or your own bitcoin wallet. Transferability of games purchased by the account holder of a steam account qualifies (backed by EU case precedent), as do transferability of funds (assets) in a bank account, stock trade accounts (assets), and transferability of goods in amazon accounts (that hold music, movies, or ebooks purchased or owned by an account holder). There is legal argument and precedent to potentially apply this towards transferability of music purchased through online accounts like itunes (it hasn't been tested yet in some jurisdictions, but it should hold in the eu). These are specific instances where the account holder holds a right to property within an account.

But the vast majority of accounts are only granted on provisional access, such as service accounts or user accounts like newegg, ebay, or other accounts which allow you the ability to facilitate direct purchases or use database services, but don't allow you to hold or retain any physical property in an account. The user does not own the database for which they use, they are provided provisional access to services, which may subsequently produce an intangible good as a byproduct of use.

Torrent accounts and nzb accounts are service accounts granted on provisional access. Invites are access codes and can not be sold without authorization of such sales by the site owner or it becomes illegal access and theft of service. The user does not hold a right to property, they are granted provisional access to use a database service, therefore they have no right to sale. This is considered a service; database and bandwidth services are utilized, an account may generate an nzb (user may claim some ownership of the generated nzb at that point as an intangible good), but they do not own the account used to generate it. This is no different than using my provisioned bitcointalk.org account to make posts to a database (a service), and then using the print function via my web browser to make a copy of a thread or post (a tangible good created by a service).

A similar argument would apply to the sale of bitcointalk.org accounts.  I do not own your server or database (property), nor do I own the bandwidth (hosting services) that you pay for.  I do not have a right to resell your services should anyone choose to want to buy accounts from me if I registered them or acquired them by other *wink* means.  Doing so would constitute theft of service unless you explicitly authorized such transactions for your own website.

Putting legalities aside, how do you expect someone to acquire accounts in bulk unless they are hacking or automating site registrations en mass (site abuse)?   How would you expect a member to sell more than one set of credentials (account) unless they're acquiring accounts in illegal or very shady means?  Bulk sales should throw a red flag and warrant thread lock or user ban no matter who sells them and it shouldn't matter if they are sales of credentials for a forum, a business account, or any other type of account that has a login mechanism.

- Have substantial history on reputable invite trading forums such as torrentinvites.org which prohibit selling hacked accounts.

I think you missed the point of the existing thread, hacked/compromised account trades are illegal, as are unauthorized trades of credentials.   Access is provided to an authorized user.  That user may invite another user, but the user is not permitted to sell their accounts or invites.  Doing so constitutes a breach of ToS and is considered misuse of devices per the Council of Europe Treaty - Convention on Cybercrime CETS No.: 185. Any attempt to gain access to a system as a result of such sales constitutes illegal access.  Torrentinvites.org can operate, but they are not reputable, nor are their activities of trading ("making availability of") credentials legal by the Convention of Cybercrime signed and ratified by a majority of EU nation member states and non-member states like the US.

I would think sales of accounts would be considered an illegal activity, which we're not supposed to post here on BitCoinTalk.

No, that's ridiculous. I should be able to sell *my* accounts, but there should be forum rules prohibiting selling other accounts.

I honestly feel that the only reason this forum allows it is because of the donations.

Bitcointalk.org domain is registered in Toronto, Canada.
However, this forum is hosted in the US and is subject to US laws and regulations.

Bitcointalk.org
IP Location Results for 50.97.137.52
==============

City:        
Zip Code:    
Region Code:  
Region Name:  
Country Code: US
Country Name: United States
Latitude:     38
Longitude:    -97
GMT Offset:  
DST Offset:


Now, I'm sure some of you are asking, "what if the forum was hosted in Europe?"
The Council of Europe proposed a treaty covering cybercrime in 2001. A majority of
member states and non-member states have either signed the treaty or ratified
the treaty by accession over the past 11 years.

What is the definition of accession with respect to Treaties?

http://treaties.un.org/Pages/Overview.aspx?path=overview/glossary/page1_en.xml#accession

3. Accession

"Accession" is the act whereby a state accepts the offer or the opportunity to become a party to a treaty already negotiated and signed by other states. It has the same legal effect as ratification. Accession usually occurs after the treaty has entered into force. The Secretary-General of the United Nations, in his function as depositary, has also accepted accessions to some conventions before their entry into force. The conditions under which accession may occur and the procedure involved depend on the provisions of the treaty. A treaty might provide for the accession of all other states or for a limited and defined number of states. In the absence of such a provision, accession can only occur where the negotiating states were agreed or subsequently agree on it in the case of the state in question.

[Arts.2 (1) (b) and 15, Vienna Convention on the Law of Treaties 1969]

In simple terms, there are laws covering sales of hacked/compromised and or
unauthorized transfers of accounts.


Council of Europe Treaty - Convention on Cybercrime CETS No.: 185

http://conventions.coe.int/Treaty/Commun/QueVoulezVous.asp?NT=185&CM=8&DF=&CL=ENG


Chart of ratifications and signatures by member states and non-member states

http://conventions.coe.int/Treaty/Commun/ChercheSig.asp?NT=185&CM=8&DF=&CL=ENG


Full Text with relevant passage(s) cited.

http://conventions.coe.int/Treaty/en/Treaties/Html/185.htm

Article 2 – Illegal access

Each Party shall adopt such legislative and other measures as may be necessary to establish as criminal offences under its domestic law, when committed intentionally, the access to the whole or any part of a computer system without right. A Party may require that the offence be committed by infringing security measures, with the intent of obtaining computer data or other dishonest intent, or in relation to a computer system that is connected to another computer system.

Article 6 – Misuse of devices

1    Each Party shall adopt such legislative and other measures as may be necessary to establish as criminal offences under its domestic law, when committed intentionally and without right:

a     the production, sale, procurement for use, import, distribution or otherwise making available of:

i    a device, including a computer program, designed or adapted primarily for the purpose of committing any of the offences established in accordance with Articles 2 through 5;

ii    a computer password, access code, or similar data by which the whole or any part of a computer system is capable of being accessed,

with intent that it be used for the purpose of committing any of the offences established in Articles 2 through 5; and

b     the possession of an item referred to in paragraphs a.i or ii above, with intent that it be used for the purpose of committing any of the offences established in Articles 2 through 5. A Party may require by law that a number of such items be possessed before criminal liability attaches.

2    This article shall not be interpreted as imposing criminal liability where the production, sale, procurement for use, import, distribution or otherwise making available or possession referred to in paragraph 1 of this article is not for the purpose of committing an offence established in accordance with Articles 2 through 5 of this Convention, such as for the authorised testing or protection of a computer system.

3    Each Party may reserve the right not to apply paragraph 1 of this article, provided that the reservation does not concern the sale, distribution or otherwise making available of the items referred to in paragraph 1 a.ii of this article.

Or,
- Be vouched for by someone from one of the above two categories.

Being vouched does not eliminate illegality of these sales.

[Maged]

Putting legalities aside, how do you expect someone to acquire accounts in bulk unless they are hacking or automating site registrations en mass (site abuse)?

I think you just answered your own question: we would allow people to sell accounts that were registered through automation. Whether or not we ban that is a completely different debate.

[shep]

Putting legalities aside, how do you expect someone to acquire accounts in bulk unless they are hacking or automating site registrations en mass (site abuse)?

I think you just answered your own question: we would allow people to sell accounts that were registered through automation. Whether or not we ban that is a completely different debate.

I think you're missing the point.  Mass registrations aren't illegal (unless it's brute force, or DDoS), but the sales of those accounts are illegal if it's a service account where the registered user is granted provisional access.  Selling such service accounts when the user is not authorized to do so (and holds no right to property) constitutes a breach of ToS and is considered misuse of access (illegal).  Any user which gains access to the service account is doing so illegally, which is considered illegal access with theft of service.

It's not like selling your bitcoin wallet which you actually own a right to property and therefore you have the right to sell.  

You're trying to rationalize illegal sales and theft of service by only recognizing the highly illegal sales of hacked/compromised credentials while turning a blind eye to illegal sales of access codes (invites) and credentials of service accounts, which will then be used for theft of service.

[theymos]

In many countries, terms of service are not legally binding. Traders can figure out their own legal risks. The forum will not enforce terms of service.

[shep]

In many countries, terms of service are not legally binding. Traders can figure out their own legal risks. The forum will not enforce terms of service.

I think we've already established which nations signed on to the treaty, as you can see that covers most of europe and other nations like the United States.  Theft of service is theft of service no matter how you rationalize it.  You're using services which are not authorized for use and therefore it is considered illegal access.

Theymos I'll ask you this, if you tried to use a hacked cable modem (stolen, compromised, or access codes that were given to you which you were not authorized to use) would you be prosecuted for theft of service?  I guarantee you the answer is yes.  The same argument and logic applies to gaining access to a site with service account credentials that were not authorized to a specific user. Unauthorized consumption of bandwidth and resources of a server is theft of service.

If you support, rationalize, and approve of these transactions, you are approving illegal sales, which go against your own marketplace rules.

[John (John K.)]

Putting legalities aside, how do you expect someone to acquire accounts in bulk unless they are hacking or automating site registrations en mass (site abuse)?

I think you just answered your own question: we would allow people to sell accounts that were registered through automation. Whether or not we ban that is a completely different debate.

I think you're missing the point.  Mass registrations aren't illegal (unless it's brute force, or DDoS), but the sales of those accounts are illegal if it's a service account where the registered user is granted provisional access.  Selling such service accounts when the user is not authorized to do so (and holds no right to property) constitutes a breach of ToS and is considered misuse of access (illegal).  Any user which gains access to the service account is doing so illegally, which is considered illegal access with theft of service.

It's not like selling your bitcoin wallet which you actually own a right to property and therefore you have the right to sell.  

You're trying to rationalize illegal sales and theft of service by only recognizing the highly illegal sales of hacked/compromised credentials while turning a blind eye to illegal sales of access codes (invites) and credentials of service accounts, which will then be used for theft of service.

If we actually start to enforce separate TOS for every product advertised here, we would be better closing off the Marketplace entirely. I'm sure most items/digital accounts/ does not allow resale of their products.

[shep]

Putting legalities aside, how do you expect someone to acquire accounts in bulk unless they are hacking or automating site registrations en mass (site abuse)?

I think you just answered your own question: we would allow people to sell accounts that were registered through automation. Whether or not we ban that is a completely different debate.

I think you're missing the point.  Mass registrations aren't illegal (unless it's brute force, or DDoS), but the sales of those accounts are illegal if it's a service account where the registered user is granted provisional access.  Selling such service accounts when the user is not authorized to do so (and holds no right to property) constitutes a breach of ToS and is considered misuse of access (illegal).  Any user which gains access to the service account is doing so illegally, which is considered illegal access with theft of service.

It's not like selling your bitcoin wallet which you actually own a right to property and therefore you have the right to sell.  

You're trying to rationalize illegal sales and theft of service by only recognizing the highly illegal sales of hacked/compromised credentials while turning a blind eye to illegal sales of access codes (invites) and credentials of service accounts, which will then be used for theft of service.

If we actually start to enforce separate TOS for every product advertised here, we would be better closing off the Marketplace entirely. I'm sure most items/digital accounts/ does not allow resale of their products.

There's a difference between a good (property) and a service.  Goods can be traded per the rule of first-sale doctrine.  Services can not be resold without approval of the property owner (site owner).

All secondary sales of service accounts or invites which employ a database and bandwidth should be observed as illegal unless explicitly permitted by the site owner.  Failing to ban secondary sales of service accounts opens the site and staff to criminal and civil liability for facilitating illegal transactions. Secondary sales refers to sales in an underlying market, which is not the same as a primary market of first availability (site owner).

[vampire]

All secondary sales of service accounts or invites which employ a database and bandwidth should be observed as illegal unless explicitly permitted by the site owner.  Failing to ban secondary sales of service accounts opens the site and staff to criminal and civil liability for facilitating illegal transactions. Secondary sales refers to sales in an underlying market, which is not the same as a primary market of first availability (site owner).

But they aren't illegal, contract law is a civil matter. So far what you're doing could be "illegal", i.e. a threat.

Article 2 – Illegal access

Each Party shall adopt such legislative and other measures as may be necessary to establish as criminal offences under its domestic law, when committed intentionally, the access to the whole or any part of a computer system without right. A Party may require that the offence be committed by infringing security measures, with the intent of obtaining computer data or other dishonest intent, or in relation to a computer system that is connected to another computer system.

Could care less about ToS. It's a load of crap and won't hold in court.

You need to prove two things at the same time, that the website was hacked AND it was used for a dishonest intent. The ball lies in your court,

Here is a definition of dishonesty: http://en.wikipedia.org/wiki/Dishonesty

[grue]

how come this guy gets to sell accounts?
https://bitcointalk.org/index.php?topic=134044.0

- Have some history here, with more history being required for trades of invites/accounts in bulk. Or, nope, account created a week ago
- Have substantial history on reputable invite trading forums such as torrentinvites.org which prohibit selling hacked accounts. Or, none that was mentioned
- Be vouched for by someone from one of the above two categories. nope

[21after2]

how come this guy gets to sell accounts?
https://bitcointalk.org/index.php?topic=134044.0

- Have some history here, with more history being required for trades of invites/accounts in bulk. Or, nope, account created a week ago
- Have substantial history on reputable invite trading forums such as torrentinvites.org which prohibit selling hacked accounts. Or, none that was mentioned
- Be vouched for by someone from one of the above two categories. nope

Title says he's selling invites, which are allowed.

[grue]

Selling invites is allowed, but there are some restrictions in order to prevent people from selling accounts and invites obtained through hacking. In order to sell invites or accounts to invite-only sites, you must:

selling invites doesn't make a difference.

[21after2]

Selling invites is allowed, but there are some restrictions in order to prevent people from selling accounts and invites obtained through hacking. In order to sell invites or accounts to invite-only sites, you must:

selling invites doesn't make a difference.

My bad. Must have read through too quickly and misread it. Maybe the mods haven't noticed him yet? This is a very new ruling.

[shep]

All secondary sales of service accounts or invites which employ a database and bandwidth should be observed as illegal unless explicitly permitted by the site owner.  Failing to ban secondary sales of service accounts opens the site and staff to criminal and civil liability for facilitating illegal transactions. Secondary sales refers to sales in an underlying market, which is not the same as a primary market of first availability (site owner).

But they aren't illegal, contract law is a civil matter. So far what you're doing could be "illegal", i.e. a threat.

I have not threatened anyone.  I have however bought to light the criminal and civil liability that exists from ignoring transactions of illegal sales, which so far appears to be what the staff here is advocating for.

Article 2 – Illegal access

Each Party shall adopt such legislative and other measures as may be necessary to establish as criminal offences under its domestic law, when committed intentionally, the access to the whole or any part of a computer system without right. A Party may require that the offence be committed by infringing security measures, with the intent of obtaining computer data or other dishonest intent, or in relation to a computer system that is connected to another computer system.

Could care less about ToS. It's a load of crap and won't hold in court.

You need to prove two things at the same time, that the website was hacked AND it was used for a dishonest intent. The ball lies in your court,

Here is a definition of dishonesty: http://en.wikipedia.org/wiki/Dishonesty

Actually prosecutions of computer fraud, access fraud, and theft of service does routinely hold up in court.  Unauthorized distribution or sales of access codes do result in jail time.  I already posted proof the previous thread and you'll find that most first world nations and even third world nations contain laws covering this activity.  Invites are access codes which if shared in an unauthorized manner are considered illegal access.  It's no different then providing login credentials.  If you want to believe something else, you're free to do so, but laws in most nations state otherwise.

[paraipan]

Selling invites is allowed, but there are some restrictions in order to prevent people from selling accounts and invites obtained through hacking. In order to sell invites or accounts to invite-only sites, you must:

selling invites doesn't make a difference.

Why is that?

[shep]

Selling invites is allowed, but there are some restrictions in order to prevent people from selling accounts and invites obtained through hacking. In order to sell invites or accounts to invite-only sites, you must:

selling invites doesn't make a difference.

It seems like the admin here is finding new and creative ways to rationalize existing behavior and transactions without changing much of anything other than banning the low hanging fruit that dare to be bold enough to admit to their procurement and acquisition methods.

Nothing has really changed.  As long as the seller admits nothing publicly it's business as usual and the rules that Theymos has drafted clearly reflect that.

[lolwut]

Selling invites is allowed, but there are some restrictions in order to prevent people from selling accounts and invites obtained through hacking. In order to sell invites or accounts to invite-only sites, you must:

selling invites doesn't make a difference.

It seems like the admin here is finding new and creative ways to rationalize existing behavior and transactions without changing much of anything other than banning the low hanging fruit that dare to be bold enough to admit to their procurement methods and acquisitions.

Nothing has really changed.  As long as the seller admits nothing publicly it's business as usual and the rules that Theymos has drafted clearly reflect that.

It seems like you joined the forum just to start shit about this......  What makes your words so valuable? Are you a lawyer? Law enforcement?

[shep]

Selling invites is allowed, but there are some restrictions in order to prevent people from selling accounts and invites obtained through hacking. In order to sell invites or accounts to invite-only sites, you must:

selling invites doesn't make a difference.

Why is that?

I answered that in the 2nd post, but if you would prefer an abridged version I posted in this other thread.

Hey shep , first of all i will sell what i want  and 2nd my accounts or invites are not hacked or compromised in conclusion you can erase your message coz i don`t care about it .

Your accounts may not be hacked, but you are selling accounts in an unauthorized secondary market which is misuse of access.  Your account is a service account provided with provisional access to database services.  You do not own your account or the invites (access codes) you possess.  You were provided provisional access to services.   Access codes are also provided on provisional grounds that they are not sold. Attempting to sell or otherwise "making availability of" access codes that do not comply with the sites ToS is "misuse of access".   Any access by a buyer which results from an illegal sale, such as this constitutes illegal access and theft of service.


I see that you're Romanian. You realize that it's illegal for you to engage in these types of sales?

[shep]

Selling invites is allowed, but there are some restrictions in order to prevent people from selling accounts and invites obtained through hacking. In order to sell invites or accounts to invite-only sites, you must:

selling invites doesn't make a difference.

It seems like the admin here is finding new and creative ways to rationalize existing behavior and transactions without changing much of anything other than banning the low hanging fruit that dare to be bold enough to admit to their procurement methods and acquisitions.

Nothing has really changed.  As long as the seller admits nothing publicly it's business as usual and the rules that Theymos has drafted clearly reflect that.

It seems like you joined the forum just to start shit about this......  What makes your words so valuable? Are you a lawyer? Law enforcement?

Nope I'm not law enforcement.   However, I do object to illegal sales and distribution of login credentials and access codes, no matter what website or forum they are used for.  Most website or database admin you would ask would tell you the same thing.  I'm sorry if you disagree with that opinion.  Don't kill the messenger because you can't agree with the message.  This is a real issue that shouldn't be ignored; the longer this topic remains unaddressed without real change, the probability increases that something will be sold on this site that may have real legal consequences.

[lolwut]

Selling invites is allowed, but there are some restrictions in order to prevent people from selling accounts and invites obtained through hacking. In order to sell invites or accounts to invite-only sites, you must:

selling invites doesn't make a difference.

It seems like the admin here is finding new and creative ways to rationalize existing behavior and transactions without changing much of anything other than banning the low hanging fruit that dare to be bold enough to admit to their procurement methods and acquisitions.

Nothing has really changed.  As long as the seller admits nothing publicly it's business as usual and the rules that Theymos has drafted clearly reflect that.

It seems like you joined the forum just to start shit about this......  What makes your words so valuable? Are you a lawyer? Law enforcement?

Nope I'm not law enforcement.   However, I do object to illegal sales and distribution of login credentials and access codes, no matter what website or forum they are used for.  Most website or database admin you would ask would tell you the same thing.  I'm sorry if you disagree with that opinion.  Don't kill the messenger because you can't agree with the message.

It bothers me to see someone like you trying to police this forum. You have said your piece more than a couple times here. If you don't like whats going on here, then just get off of the forum, please. Save your breath and save us all from having to read your legalese.