> No-one ever defends themselves by saying "everything I did was enabled by the poorly designed system, therefore I am not a criminal".

People charged with hacking defend themselves this way all the time. And other people defend them in the same terms.

Recently a guy was charged for accessing public URLs. Sure, they were specifically made available to the public, but the public wasn't supposed to look at them.

The weev case was a travesty from start to finish. The failure on ATT's part is legendary. The "secret" information was only ever exposed to a professional journalist, who didn't pass it on to anyone. Nothing happened in New Jersey. And of course, as the appellate court found:

...no evidence was advanced at trial that the account slurper ever breached any password gate or other code-based barrier. The account slurper simply accessed the publicly facing portion of the login screen and scraped information that AT&T unintentionally published. [0]

[0] http://cdn.arstechnica.net/wp-content/uploads/2014/04/weevru...

I think it is pretty clear from the context that a) Tronno is referring to people exploiting vulnerabilities for nefarious purposes, and b) successfully defending themselves with that argument.

The CFAA is a terrible law that has been used to prosecute people over very questionable cases. Let's not bring (any more of) that level of subjectivity to finance.

For computer hackers, we have clear laws citing unlawful access to computer systems. Plus, computer hackers don't tend to consult with lawyers before doing their thing.

For traders, we don't have all-encompassing laws covering tax avoidance. Plus, traders have money for hiring professional for finding loopholes.

That's the difference.

>We have laws like this for computer hackers. No-one ever defends themselves by saying "everything I did was enabled by the poorly designed system, therefore I am not a criminal". Why not for the financial system?

Because the CFAA is pretty universally hated and makes for bad outcomes.

> No-one ever defends themselves by saying "everything I did was enabled by the poorly designed system, therefore I am not a criminal".

This is a pretty common argument, actually, when it comes to questions of "allowed" API access.

No such law is needed, at least in this case. This guy is up to his neck in lawsuits and the only reason he isn't cooling his heels in a Copenhagen jail is that he's on the run in Dubai

but should our legal system prosecute those hackers that didn't break any law on the books? I'd argue they shouldn't - sure some of the bad guys get put away, but so to do good* guys because of the legal precedent being followed

*good as being defined as likely a net positive value on society similarly bad as being defined as a net negative for society

Exploiting loopholes is virtuous for many of the people in the industry. It demonstrates your attentiveness to the rules.