I follow what you're saying, but look at these cases: Aurenheimer was confronted with IRC logs in which he discussed selling the information he got from the website, and Barrett Brown was accused of actively assisting the people who breached Stratfor.

What ever you think of the actual prosecutions here, neither of those are cases of security research being mistaken for something else. The most you can say, for instance, about Brown is that he is not as closely connected to an extraordinarily serious crime as the DOJ believed he was.

Regarding Weev, should planning on selling the data really affect the legality of his behavior? I mean, there are services that sell data they scrape from websites after all.

Yes? Of course it would?

I guess I'm looking at it like this:

1. Someone physically breaks into factory, steals a list of customers for the purpose of (selling to competitors/personal interest)

2. Someone drives around the country and records locations of $company infrastructure, in an industry where optimal placement provides a major competitive advantage, for the purpose of (selling to competitors/personal interest)

In both cases, the person now has information that the target would rather keep private, and in both I would assume that their plans for the data would be irrelevant to the legality of gathering that data. (I'd assume case 1 would be illegal either way, and 2 legal either way) So if Weev's actions are akin to breaking into/hacking a system, then case 1 would apply - but if it was closer to looking at publicly exposed information, then the situation would be like case 2. But either way, I don't think his reasons for taking the actions (or after the fact plans on what to do with the data) would affect the legality of what he did.

Of course, IANAL and US computer law seems to be completely screwed up so maybe it would matter. I just don't see how.

There are two elements to almost every crime in the US criminal justice: conduct and intent. Without provable intent, inappropriate conduct is often excused. Without inappropriate conduct, predatory intent is almost never prosecutable.

Your first case has both prohibited conduct and intent (actually, with or without the intent to sell the data, I think deliberately breaking into a factory is itself criminal).

Your second case does not.

Conspiracy to commit crime is a crime in the US.

As to your first example, there seems to be this pervasive idea in tech culture that something shouldn't be a serious crime or tort because it is so easy to do. I see the argument very often in cases of unauthorized access and copyright infringement.

Murder is also rather easy, and we execute people for it.

That's not what he's saying. He's saying that independent of how easy it is to do, it's also something that professional security people do routinely. And he's right. But that's not the basis of the charge against Aurenheimer.

>That's not what he's saying. He's saying that independent of how easy it is to do, it's also something that professional security people do routinely. And he's right. But that's not the basis of the charge against Aurenheimer.

It's certainly part of what he said:

>but it also wasn’t exactly hardcore hacking; IIRC he just changed a URL parameter.

The difficulty of carrying out an action is completely irrelevant to its legality.

Even if he did attempt to sell the data, is it illegal to sell data that is freely available on the internet (honest question, I couldnt find a solid answer via googling)? It might be against TOS.

I agree with you that the "hardcoreness" of what Aurenheimer did is a red herring.