Part of the problem is the over-reliance on metaphor. They're flawed, and often confuse people. The suggestion of people walking into houses, or sticking their hands through open windows (or even just peering through them), tends to unsettle people. It brings to mind trespassing and countless episodes of Law & Order that start off with rape and murder. So why are we willingly choosing to discuss encryption, networking, and security research/disclosure through analogies that set people on edge from the very beginning? We lose the listener immediately. And probably poison the well, too.

I feel like a better analogy, especially in this case, would be "it's not breaking into the house, it's looking in the window". Non-technical people would generally understand the equivalent of, say, a business leaving a stack of personal files next to a sidewalk window and someone calling up the news to say "this could lead to identity theft!".

From what little is described of this "hack", it does sound akin to looking in a window that nobody noticed was open. In general, uninvited pentesting is more like going around and checking doorknobs to see if they're locked. Not sure if that's illegal (in Slovenia no less), but I can't blame someone for feeling really uptight about it.

How does this analogy make sense? It's totally possible for someone to steal valuable data from a computer system, even personal information. There may not have been any sensitive information in this case, but to suggest that breaking a security system is a "public debate" seems wrong.

I mean the underlying conceptual security system, not the data it protects. Crowdsourced security audits are similar to everyone telling you in public debates why you're wrong.

Ah ok, sure. Thanks for clarifying.

Maybe now that he has been sentenced and everything seems settled, he should talk to some lawyers or NGOs and have them sued for negligence. Two years of not giving a damn is unacceptable.

I think it might be more like breaking into a house than you think. The reason is that there's no way to verify your intent. This leaves 'em free to make up one of their choosing.

"Security by design" seems to imply "oh, this is just a game." Nope. If you now require all people to be part of an electronics security arms race, this is a problem.

It may well be that there should be a mechanism for the police to refer such a kid to others in e. security to enculturate him or get him a network to be part of.

no, its not like breaking into anything.

Its more like walking past your neighbors house and finding the person who is supposed to be looking after it has left all the windows and doors open and a shopping list of things to steal pinned to the wall.

Then when your friend doesn't do anything about it.

Telling your other friends what an idiot he is.

The reason telling people they are insecure has been criminalised is the security agencies are the ones doing all the stealing.

Thanks for trying to explain it. Are you familiar with "window peeping"? It's sort of a tort.

That last part, what?

It's a simple posit. The security agencies (generally) don't breach systems to protect you from physical harm. They breach systems to steal the intellectual property of anyone and everyone for use by the elites that provide their funding.

So we've had three decades of systems security being cast as a dirty word only criminals care about.