> followed its internal policy and Hungarian law and reported the incident to authorities

Ho-humm. Care to point where the Hungarian law mandates this? The old BTK was simpler but even the new is pretty clear in that only a very few serious acts are mandatory to report (meaning not reporting is a felony in itself). 145. and 159 § details how military and civil superiors must report the crimes of those under them, obviously does not apply. 191. § makes reporting attempted or committed kidnapping mandatory. 263. § are crimes against the state, treason, spying and shit. 300. § makes it a crime not to report corruption but only for officials. 317. § makes terrorism mandatory to report. 328. § is about violating international sanctions. Finally 404. § makes reporting of certain financial trickery but only for the actual executor of the bankruptcy.

Which one was this one? Or did I miss something? Was he trying to sell stuff to Russia violating the sanctions? Did he make an attempt to overthrow the government? Or what?

Followed its internal policy -> this is why they did it

and Hungarian law -> this is how they did it

European law about data protection and breaches, not sure if it is in effect yet and not sure if it applies to this exact case:

http://www.lexology.com/library/detail.aspx?g=8185429b-c98d-...

They took him as a criminal, got his fingerprints, took a photo of him. I do not think they proceeded this in the right way. They should have fixed the bugs, protect our personal data and say sorry for this.

No, they brought him in as a person of interest following Hungarian law. If you do not like the law please vote the next election a party that changes that or move to a country that does not require police to follow the law. Determining if he is going to be charged with a crime is at later stage in the investigation anyways. There is no such a thing as "They took him as a criminal".

Moreover, it is not only Hungarian but also European law to report incidents involving personally identifiable information leaks and there are authorities that investigate and fine companies failing to comply with the law. Any person (including you) can report such companies to authorities.

> If you do not like the law please vote the next election a party that changes that or move to a country that does not require police to follow the law.

Sorry but how exactly electing a different party is supposed to change anything ? Moving to another country will not help either as most other countries are the same or worse.

Corruption is also a crime, I do not see the police visiting Mészáros or other entities involving corruption skandals.

But ofc I got your point.

I see so following up on a cyber crime is corruption?

You know exactly, what I have been referring to. The system is broken. Honestly, who cares if a young guy purchased a ticket to prove his right regarding a bug? How could he do otherwise? You need to make sure about the backend part of the system, too. Meanwhile, the company that developed this "service" is silent and the financing part is also not public, but we can be sure it was not cheap. The whole BKK e-ticket system is plain simple, a mediocre dev team could create a better one.

I understand that you are experienced in law, I understand what you wrote. Although, I do not think that it was the right thing to do. And maybe because of the reactions and the scandal, it will change in the future.

Would not have happened anything if we had just ignored this. We did the right thing.

No I do not know.

Try harder then. And do not campaign against an innocent young boy even if you think your point of view harmonises with the outdated Hungarian law that bleeds from hundreds of wounds.

You can try harder too. Law is the law, regardless of your feelings.

The article states that what happened to him was illegal.

> In Hungary, according to the law, this was pretty much illegal.

I'd disagree here, how would he know there was a bug to report if he didn't do it once ?

Besides this has been used for decades by corps to prosecute vulnerability reporters, see Serge Humpich who discovered a huge vulnerabilty in bank cards back in 1997. He reported to european bank card Economic Interest Group (EIG) with the support of a lawyer who said they would not believe him until he proved it practically. So he went an bought metro tickets that he did not use but sent them with every details of the transaction. The EIG then got him arrested, prosecuted and sentenced for bank fraud and falsifying a bank card. The fun part is that this got publicized and it was not long before bad guys found the vulnerability too and started issuing yescards (bank card that say yes to any withdrawal from an ATM) and it cost them many tens of billions of euros over a few years due to fraud and upgrading their security and hardware in a hurry.

He could have used the same value in the hacking as the original one or even adding 1 unit to the original price. This does not cause anybody any damages and it is much easier to defend it at the court while still illegal. If there is no bug bounty program and you do not have a contract to perform such activities than it is not a good idea to engage in such activities.

He didn't cause any damages. He reported the issue including the pass he purchased as evidence and it was invalidated.

By purchasing the ticket, he was confirming the vulnerability. I am sure he knew that they would cancel the ticket when he reported it. I don't find any wrong doing here.

Also, since he doesn't live in Budapest, it should be obvious he wouldn't be doing it for personal gain — he has no way to use the pass anyway, after all.

And you think that this is going to be enough at the court?

Have a look at this list, many of them thought they are not doing anything wrong:

https://en.wikipedia.org/wiki/List_of_computer_criminals

The point is that we live by the law, not how you feel about a certain action. I agree that the law is a bit problematic but regardless we cannot cherrypick which law to follow and which not.

Yes, that should be enough. You won't get into any trouble if you break a window when the house is on fire. This time, the site was on fire.

The point being that he should not have been sent to court here, yet they chose to do so anyways.