Good point. There ought to be something in law to protect the person who wants to report something they have uncovered. It should protect them up to the point where they cause damage, even accidentally.

Personally, I think he definitely went too far when he created the database entry. No doubt in my mind that that was not necessary to make the point. But I think a law should stipulate that the burden of proof is on the government and the company that your actions caused grevious actual damage before they can stick it to you for reporting a problem with an OS. Saying that they had to check all of their systems and blah blah blah is not "damage" to me. That's a result of recklessness on their part. On the otherhand, companies should have an absolute right to bar anybody from probing their network without permission. In that case, if we assume that by law it will be illegal to probe without permission, then you get prosecuted, damage or not.

-bob

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/6888/22042#22042