Very interesting, but as you point out, where do you draw the line? What is as part of my good intentioned efforts, I accidentally trigger a denial of service? Yes my intentions where good but I still caused damage to the organisation.

If there was a law to allow 'good samaritan' hacking it would be all to easy for it to be exploited. If I am doing reconisance for a less than noble cause then up until to moment I steal data/take down the system/whatever, I could claim I was doing them a favour and planning to reveal my findings, you would need to prove I indented to comitt a crime or wait until the damage is down.

My personal opinion is that these 'good works' should be regarded as a crime, however requiring the hacker to pay for improvements to your security because you got hacked is going to far, you should have already done that.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/481/35166#35166