Hacking a scammer: is this guy breaking the law by deleting phishing data?
<p>I just watched <a href="https://www.youtube.com/watch?v=pRy4eViVxcI" rel="nofollow noreferrer">this video</a>. In it the presenter hacks a phishing website using a SQL injection attack and then deletes the database of harvested emails and passwords.</p>

<p>Assuming that he did this to a real scammer as opposed to a demo website he set up for the video, was he breaking the law?</p>

<p><strong>Edit:</strong> The presenter is American but computer crimes are generally held to happen in the jurisdictions of both the hacker and the computer, so I'm interested in other jurisdictions too.</p>

<p>You haven't specified a jurisdiction.  In the United Kingdom† this is a clear violation of section 3 of <a href="https://www.legislation.gov.uk/ukpga/1990/18/section/3" rel="nofollow noreferrer">The Computer Misuse Act 1990</a></p>

<blockquote>
  <p>(1) A person is guilty of an offence if— <br/>
  &nbsp; &nbsp; (a) he does any unauthorised act in relation to a computer; <br/>
  &nbsp; &nbsp; (b) at the time when he does the act he knows that it is unauthorised; and <br/>
  &nbsp; &nbsp; (c) either subsection (2) or subsection (3) below applies.<br/>
  (2) This subsection applies if the person intends by doing the act— <br/>
  &nbsp; &nbsp; (a) to impair the operation of any computer;<br/>
  &nbsp; &nbsp; (b) to prevent or hinder access to any program or data held in any
  computer; [F2or] <br/>
  &nbsp; &nbsp; (c) to impair the operation of any such program or the reliability of any such data; [F3or <br/>
  &nbsp; &nbsp; (d) to enable any of the things mentioned in paragraphs (a) to (c) above to be done.]]</p>
</blockquote>

<ul>
<li>Deleting the data is unauthorized  (3.1.a)</li>
<li>The ethical hacker knows it is unauthorized (3.1.b)</li>
<li>Deleting the data prevents access to the data (3.2.b and hence 3.1.c)</li>
</ul>

<p>† This is one of the few Acts that apply to the whole of the UK.</p>

ethical-hacking