"Jennifer Granick, a law professor at the Stanford Center for Internet and Society, said that the legal questions around the hack are still murky, but a few things are clear. Researchers using this data would not, she said, be guilty of any federal crime, because they are not involved in any way in the hack itself. She said a researcher who downloaded the data might theoretically run afoul of their state's statute on possession of stolen property. But, she explained, some of these statutes don't apply to digital data, and prosecutors have been very reluctant to go after individuals for cases like this.
"I think that the risk to people for getting in any kind of criminal trouble is really low," Granick said.
Granick admitted that researchers might be open to lawsuits from individuals whose data was hacked, or even from Ashley Madison, but said that such lawsuits would be unlikely to prevail.
"I'm not saying they have great cases," she said, "but nobody likes to be sued.""