This doesn't seem like a good faith reading of the situation. The blog post you link to as a source for this claim describes how he was doing something he'd done thousands of times before in the service of tracking and disabling botnets, and that he considered it to be his job. But you make it sound like he was a total amateur who saw a domain name string and registered it on a whim with no intuition as to whether it would be more likely to do something helpful or harmful.
It sounds like he did in fact know a lot about what he was doing, such that he could make sensible inferences under uncertainty in the middle of a time-sensitive crisis. That's the best we ever get to expect from someone.
My reading of the situation is also based on additional data that's public if you care to look. His skill level and intuition can be extrapolated if you watch a few of his youtube videos. Or if you happened to talk with him on IRC. You'd realize he's little more than a script kiddie.
Hutchins is not what he has been portrayed as by the media.
this is insane, why not try localhost/local dns server first?
What if the malware had bound to www.google.com or www.fbi.gov? Would we hold these companies accountable for registering a domain?
"After about 5 minutes the employee came back with the news that the registration of the domain had triggered the ransomware meaning we’d encrypted everyone’s files (don’t worry, this was later proven to not be the case), but it still caused quite a bit of panic."
This nytimes article is just terrible. Absolutely terrible. Sarah Jeong should be ashamed. After this and the way she treated Naomi Wu [2], I don't think I'm going to be giving her any journalistic credence.
[1] https://www.malwaretech.com/2017/05/how-to-accidentally-stop...
[2] https://medium.com/@therealsexycyborg/shenzhen-tech-girl-nao...