|
I think that it is a bit far fetched here but where do you draw the line between what is an intrusion and what is not? To continue with the prosecutor analogy of the lock, having a shitty lock doesn't allow others to enter your house, but what if there is no lock, and what if the door is wide open? If you write "do not look" on top of your source code, can you prosecute someone who looked at it? If not, can you open a package marked "for Alice" if you are Bob, even if it is unsecured. For computer security, what is punishable? Obviously, using exploits and installing rootkits is, but what about deciphering weakly encrypted streams, what about accessing "secret" urls that do not have access control, what about probing undocumented APIs. For me, it is just the prosecutor doing his job of accusation, maybe poorly, I don't know, but if there is a trial, there will be a defense attorney, and a judge, and hopefully a reasonable verdict. |
If a researcher breaks a few ciphers, and makes no effort to store the plaintext, and reports the flaw, that not a crime.