Wrong. He proved that the hole was exploitable, and provided necessary information to the proper authorities for handling. Who benefits from that action? The students whose sensitive information is at risk.

If he sold the database to spammers or the russian mafia, then his actions would have been wrong. He did not act wrongly.

The system serves up information on the internet. It is the responsibility of the system owners to serve up sensitive information in a secure manner.

McCarty didn't bring down the server, and he acted in a responsible and sensible manner after researching the system. He did nothing destructive.

However, the school acted irresponsibly in serving up sensitive information in an insecure fashion. The school as an organization is responsible for securing the students' information and should be sued for their gross negligence. Their intentions may have been good, but it doesn't matter. They put the sensitive information at risk that they are responsible for and should be held accountable.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11389/33778#33778