[voxic11]

Most crimes require intent, hacking is one of them. The relevant law in this situation is:

> (a) Whoever— (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— (C) information from any protected computer; shall be punished as provided in subsection (c) of this section.

https://www.law.cornell.edu/uscode/text/18/1030

So if it can't be proven that you intended to access a computer without authorization, or exceed your authorized access, then you can't be found guilty of the crime.

Consider the possible consequences of the law not requiring intent, if simply accidentally exceeding your authorized access could be a criminal act.

[navigate8310]

Isn't there an intention on part of the agent itself? I know it's impossible to _punish_ the matmuling agent, however, the lab/owner operating it should be liable

[bredren]

In the "old west" if a horse was spooked and ran a person over, liability for the horse's owner varied but was similar to how this might be handled.

Consider this Supreme Court case, Brown v. Collins. [0]

A pair of horses were spooked by a nearby train engine, causing the animals to damage a stone post.

The driver of the grain-loaded wagon was not found to be at fault because he was "not guilty of any malice or unreasonable unskilfulness or negligence." And that the horses "did damage there against the will, intent and desire of the defendant."

If you read OpenAI's statement, in the Actions Being Taken section:

    1. "As part of the investigation, we are implementing strict controls in infrastructure configuration at the cost of research velocity while the vulnerabilities are patched."

Which I think implies that as a result of this incident, OpenAI has instituted controls beyond ~"reasonable skillfulness" such that it might even impede their business (and from a certain point of view impede the progress of the people governed by the laws which might hold the company accountable.)

I'm not taking a position on the merit of the above but I can understand the line of thinking.

[0] https://www.jstor.org/stable/3303590

[fastball]

I'm sure that will change sooner rather than later, otherwise enterprising hackers will be able to claim that the model they were using went rogue.

[pjc50]

This would be bad; we've already had a few cases on HN where someone noticed that they could increment the customer number in a URL or similar, resulting in police action.

[OliverGuy]

Got a source for that?

[voxic11]

Not from the US but https://www.cbc.ca/news/canada/nova-scotia/freedom-of-inform...

This news segment goes into more detail about how he downloaded the documents (by incrementing the document id in the url) https://x.com/Brett_CBC/status/984751373525901313

[bornfreddy]

Wow, just wow. How about charging the website builders for negligence, for failing to protect sensitive data? Simply incredible.

[jfyi]

IDOR is a well known security issue that can result in exactly the scenario described (someone incrementing a counter in a url) and has on many occasions in different jurisdictions caused legal issues for the person doing it. Unless you are specifically asking for a hn reference, which I don't understand the relevance but I'm sure they exist.

[Schlagbohrer]

US Law doesn't actually encode the little workaround that "If you're really rich, none of this applies to you", it's hidden somewhere in the metadata of society

[TeMPOraL]

It's propagating in the runtime state - it's a "Trusting Trust" thing.