@cobecio @popeawesomexiii The answer to the first question largely depends on the jurisdiction of the parties involved, but in the US at least, the person who took the illegal action, and possible the person who operated the instance they were on if they were notified about the activity and didn't curtail it, at least based on my reading of case law related to email.
But I'm not a lawyer, and I'm definitely not a fediverse lawyer.
What do you mean by shared policy/Angry mob?