I think in a vacuum your analogies make sense. IANAL, but I had criminal law in college and I work closely with legal where I work. In order for there to be a crime committed, there has to be a criminal act as well as a criminal intent. With your lockbox and mall analogy, there was no intent to commit a crime.

With the computer tampering laws, as I've seen them applied, the actual tampering was the crime. The act was breaking into the computer, and the intent was to simply access the system without permission. No further motive was required. So even with the best intentions, the "Samaritan" will still be guilty of computer tampering.

I agree in that this is a gray area, but I want to leave you with a scenario to consider. I'm the CISO for a large hospital, what if someone in "testing" manages to take offline a critical system, like a ventilator. You can make the argument that the system was faulty anyway, and it would be a matter of time before it happened, but maybe not. Who would be to blame if something like this happens and someone dies because of it? I doubt the person who attacked a network without permission would be lauded as a "Good Samaritan" in this case.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/481/35185#35185