Should Uninvited Security Examiners Be Punished?
This entry was posted on 5/3/2006 7:15 AM and is filed under Internet.
Recently another "good samaritan" has been criminally charged (SAN DIEGO COMPUTER EXPERT CHARGED WITH HACKING INTO U.S.C. COMPUTER SYSTEM CONTAINING STUDENT APPLICATIONS, http://www.usdoj.gov/usao/cac/pr2006/045.html) relative to the discovery of a security risk which was then revealed; all efforts having been made without the knowledge of the owner of the database. Rather than discuss the specific case, the basic question is do we as a society allow/encourage or punish those that practice vigilante like security tests?
While a well intentioned individual that were to walk around a neighborhood and check whether doors and windows were locked, it would not take too long before the individual would be apprehended by law enforcement and likely face a bevy of charges. Some would like to have the same level of enforcement on the Internet, but few support the concept as the Internet is a "new world" and deserves unique controls. However, when the Internet "security examiner" takes overt steps to exploit vulnerabilities and perhaps even "takes" a sample item to prove their success the picture changes. This is not unlike the well intentioned individual walking into homes with unlocked doors and searching for and taking an item of value to prove success.
If that were your home, you would likely be outraged and very possibly embarrassed. Law enforcement would also take a very dim view. Whereas the first incident would likely result in probation with full dismissal upon successful completion of probation or the charges simply dropped with a stern warning, the latter situation would likely result in some form of permanent criminal record. Should not the same standard apply to those who take on the role of vigilante Internet security examiner?
