One interesting thing about the statute of limitations is “the discovery rule.”

For example, say the statute of limitations for 18 USC 1030 is two years. If a person hypothetically stole a scooter by hacking, two years later, they would be in the clear, right?

No. The discovery rule says that if a damaged party, for good reason, does not immediately discover their loss, the statutes of limitations is paused until they do.

Accordingly, if the scooter company read a post today about a hack that happened “a long time ago” and therein discovered their loss, the statute of limitations would begin to tick today and the hacker could be in legal jeopardy for two more years.

Does this apply to criminal or just civil?

Generally it applies to both. But some crimes (eg murder) might not have a statute of limitations.

https://www.law.cornell.edu/wex/statute_of_limitations

Also there are subtle questions around what discovery means here. Usually it is some sort of "could be discovered with reasonable effort". If I had proof of your wrongdoing in a letter sent to me, I am unlikely to get away with saying, "Oh, I didn't read the letter when I got it." If that proof was buried in a computer file with a million pages, I probably can reasonably say, "That was a needle in a haystack, and I didn't even know what to look for." For situations between those extremes, there will be case law that likely varies by state.

This is where a lawyer gets to earn their pay.

Huge arrow pointing to “varies by state” on all of this.

1030 actually has a specific discovery/statute of limitations in the text of the statute, and so may not be affected by state discovery rule law.

The scooter company was well aware of it as I told them about that + several other issues immediately. :)

Well that makes me smile. I should have figured there was more to that story!

It is common. But before you curse at Google here. This is VERY well documented. When you create a database the UI screams at you that it's in dev mode, that security has not been setup etc.... if you keep ignoring the database will eventually close itself down automatically.

So this is entirely on the dev team to blame.

If I recall correctly, you can set your firebase rules such that a user can only read/write/delete certain collections based on conditions such as if user.email == collection.email.

Doing authorization within firestore breaks down instantly outside of toy applications.

I think deleting a scooter is against some law of conservation :)

Which is why I hate that people keep claiming that you don't need to know what you are doing nor employ anyone who knows what they are doing to setup infrastructure. You might be able to stand things up without knowing what you are doing, but you probably shouldn't be running it in production that way.