| HN Mirror

"You are overlooking the fact that Al-Khabaz informed the system owner 2 days prior of the problem"

Warning the system owner doesn't give you the ability to run pen tests if they do not wish you to do so.

"True, but it makes the case quite different in legal and moral scope from one in which the system owner is not warned"

I would believe that it would really only make a difference if the systems administrator replied to your warning with acceptance and an invitation to do so.

Morals being subjective, how do you feel it would change the legal conditions?

"A warning removes malicious intent. Lack of warning leaves malicious intent in place."

The trespassing, using a system in nonstandard ways could still be considered "malicious", even if the user's intent was not. (I'm not making judgments on the guy so much as imagining that prior warning is not sufficient.)

I don't see how a reasonable person would conclude Al-Khabaz's actions were malicious. People with malicious intent do not draw attention to themselves prior to the event, nor do they advertise the exact attack that they will use.

You're still stumbling through systems you are not explicitly invited into. I understand why you might feel that good intentions validate the act, but assuming that all administrators are so gracious would be dangerous :P

No, not "validate", that would be equally black-and-white thinking. But a decision of the legality and morality of the action should take into account the whole circumstances, not just the bare fact of the unauthorized access.

This seems similar in many respects to the Aaron Swartz case. My initial response rejects the idea that all actions regardless of motive should be taken as equally unlawful and unethical.

A warning removes malicious intent. Lack of warning leaves malicious intent in place.

True, but it makes the case quite different in legal and moral scope from one in which the system owner is not warned.