This is old news I know, but my question is, as a service provider are they allowed MIM attacks like this (am I misreading this, isn't that what masquerading as the other computer your talking to and sending false data is?).

I know this is old, but isn't this illegal?