[Aurornis]

Most countries will have laws covering cases of unauthorized access, theft of services, and computer misuse.

The user agreement helps define the service as a paid service with defined access cases. Going around those would put the user in violation of some laws.

An analogy would be showing up to a paid event venue and noticing a back door was left open. Going into the building without paying is not okay, even though you never engaged with the ticket office to agree to anything.

[ballenf]

If the user routed all traffic through a WeChat or other messaging service, they would just be using messaging.

[zem]

I would have had far more positive feelings towards the hack if they had done that - e.g. had their roommate configure a bot to monitor a wechat room and respond to url requests by sending back a webpage. tunneling over DNS feels icky because the reason DNS traffic goes into a separate accounting pool is so that the basic infrastructure of the internet can be kept working smoothly, so this is getting firmly into tragedy of the commons territory.

[nradov]

Intent matters. In US legal jurisdictions that could potentially be prosecuted as a CFAA violation, although I'm not aware of any cases like that yet.

https://www.justice.gov/jm/jm-9-48000-computer-fraud

[DaSHacka]

The U.S. has one of the most overbearing laws in that regard, though. The OP happened on a flight leaving Canada.