You have nailed the essence of the problem. There are several factors that directly impede development of an ethical consensus for behavior over the internet.

First -- Reaction that is disproportionate to the offense. Note that the analogous physical offenses (c.f. the peeping tom statute noted above) are _misdemeanors_ while most laws dealing with computer crimes are targeted as felonies, even for something as harmless as this case.

Second -- There is no public consensus on ethical behavior in the physical world covering various types of tresspass. Breaking and entering is obviously illegal, but how about wandering into an area with just a 'keep out' sign? Journalists frequently ignore the law and are not punished for it...in the name of a free press.

Third -- It is hard to make a judgement on what the students did based on vague descriptions of the 'hack'. I'm afraid that my surfing habits would be frowned upon, as I frequently alter URLs in order to see what else is available on the site. Properly managed sites give an error message; improperly managed sites will frequently respond with the contents of the server directory. Is this 'hacking'? I don't think so. This is walking through a door out of curiosity, where there is no lock, or even a keep out sign. The ethical line for me is what happens after that.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/309/31158#31158