Unlike the bank example, Lamo (and other hackers) are not just "walking by" these corporate networks. They're actively checking doorknobs.

If Lamo was in my network and had informed me of security issues (and I remained reasonably sure he hadn't done anything malicious), I wouldn't press charges. However, I do not want my option to prosecute trespassers taken away. If a hacker goes actively searching my network for security vulnerabilities, the onus should be on him to prove he didn't do anything malicious during his hacks, not on me to prove that he was doing anything beyond trespassing in my network. If one doesn't like the risks associated with uninvited vulnerability testing, one should not do it.
-Steve

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/70/11507#11507