There is a minimum bar for what is a protectable "work" under copyright. It also has to be creatively produced, not machine generated in singles. (Not taking about collections here)

Rolling a die and publishing a number between 1 and 6 is not copyrightable.

Would a single number of 20 bytes be a "work?" Even if it's almost certainly generated through strong random? That seems unlikely.

What Sony could do would seem be civil action under "trade secrets" and/or the EULA.

Dunno if that's the actual interpretation though?

What about the computational power question? At what point does it become illegal to publish an encrypted SSN/illegal number if you know it takes 1 day to break the encryption using current computational power? What about 10 days? a year? ten years? a hundred years? a thousand years? And what if computational power changes, and a thousand years turns into 1 day? Does the action become illegal retroactively?

Those are meaningless questions. It's trivial to think of 100's of hypos and go 'is this legal? Is that legal?' 1000's of first years do that every year because they think that's what being a lawyer is about, not to mention the amateurs. A judge however considers one specific case, with arguments as to what is the objective reality as presented by the parties. 'What ifs' don't matter. Law is not a closed rule-based system. 'Loopholes' (I loathe thay word) are not like buffer overflows.

(have law degree, not practising lawyer)

Wait, but aren't so many of the important US supreme court rulings so contested because they have to consider the ramifications, e.g., of whether a ruling will take power away from the state and give it to the federal government? How is that not a "what if" scenario? Isn't the Baston rule just a big loophole?

Appellate courts get to make such considerations, but not the lower court. The lower court judge can say "I believe the facts say X and therefore law Y should apply" but the appellate courts can say that the interpretation or Y or even law Y itself is incorrect and tell the lower court judge to reconsider the outcome of using law Y in that manner given facts X.

This is why companies with weak crypto can perhaps avoid liability for disclosure, because the crypto shows that they "intended to" protect the information, and it's not zero work to break, even if it's /now/ cheap.

You have to look at the procedures for moving against the publisher. Until someone actually reads the material, it isn't going to be a criminal matter. It would be like dumping shredded classified material. There is no crime there, until someone proves that they can piece it back together. Then you have published (distributed).

In the civil world, the issue would be one of harm. You aren't going to sustain a lawsuit unless you can state some harm. So long as nobody can read the encrypted material, there is no harm. But as soon as someone does you've got a case to bring.

There is an interesting statute of limitations question here as to when the clock starts, but that is a minor procedural issue imho. Many such statutes start not at the wrongdoing, but at the realization of the harm (or reasonable time of realization).