If a "good samaritan" breaks into my home, he's charged with breaking-and-entering. He doesn't get charged with attempted murder just because breaking-and-entering can facilitate it. Similarly, it doesn't make sense to charge a "good samaritan" with anything more than can be proven on a computer network.

Btw, the often noted massive resources to verify a system from break-ins might be right. But, given that almost all software is buggy and the systems in question are often made available to the best and brightest and/or the whole internet, it's very probably that eventually the system would be broken into. That doesn't justify any instance of a break-in, but any competent server administrator would already be doing the expensive verification of their system. So, the actual costs for any intrusion are depreciated by the verification that should already be being done.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/481/35169#35169