[dtgriscom]

You send a query string to a server with the hopes that the server will give you what you want. Isn't that the World Wide Web?

Proving "intent" is much harder than proving action. And, to me it seems bad for the law to enforce based on whether the server's authors "wanted" to provide a specific piece of information.

[chii]

Intent is something that is considered in murder homicide cases, so why not in these cases too?

[_y5hn]

Because murder is a crime, intent is not.

[chii]

To differentiate between murder and manslaughter (say, due to negligence), the idea of intent (or state of mind) is taken into account.

[_y5hn]

There is nothing illegal about reading what was sent to you though.

[chii]

If the data was sent as part of normal operation, then yes, it should be fine. But the post above is talking about incrementing an ID in a query, or inject SQL.

The intent of the person doing the incrementing id, or sql injection, is very much required to be taken in to consideration when considering whether it is an illegal act of computer trespass.

[_y5hn]

Anyone can increment an ID or try to inject sql. 30 years of security practices shows white/grey hat hacking to be a good thing, and should be expected. GDPR even makes poor security finable. Cyberdefence also requires more security expertise, which can only be had from real experience.

"It's fine when the good guys do it", is poor lawmaking. So intent is hard to prove, and not very practical. It also put the blame on the accused, having to prove their innocence.

I find it interesting that people equate information breaches with murder.

[egberts1]

Intent to murder is now a misdemeanor… in Maryland.

[_y5hn]

Plans for crime can be a crime though. Law is complicated! :P