Shouldn't you hold the people who created that system responsible, rather than the person who used it? If I rig up my cell phone to a gun, so that every time someone calls it it shoots at a crowd of people, should the people who call it go to prison while I walk free?
He knew what he was doing once he'd pulled down a few records.
Also, yes, ATT should be held responsible for implementing lame security.
(a) Even altering a parameter once in the address could be considered illegal under the current laws.
(b) The access of information in and of itself would not be illegal alone. Say I kept a bunch of people's information in paper files in file cabinets. Then I gave you access to retrieve yours from the file drawer yourself. It is sleazy, but not necessarily illegal to look at other files in the drawer, as I have given you access to their container.
(c) Even if you want to make the action in (b) illegal, the reasonable punishment is almost certainly not a double digit prison sentence.
No one here is. I'm not sure why no one has done anything to them, legally. It'd be interesting if someone who actually knows what they're talking about in terms of the legal system about could comment on it.
I honestly don't even know where I stand on the actual discussion point, but I do know where I stand in the weird analogy tree we've made.
Bringing things back to reality here, AT&T was entrusted with personal information but failed to properly secure it. They set up a system that automatically responded to requests for personal information. They gave unauthorized people access to that system. We should be blaming AT&T and making them pay punitive damages for their irresponsible behavior, not whining about how terrible Weev is for using the system they gave him access to. The fact that AT&T can just shrug it off is what allows the sorry state of security to persist.
The RFC says at the point 9.1.1 that: "Naturally, it is not possible to ensure that the server does not generate side-effects as a result of performing a GET request; in fact, some dynamic resources consider that a feature. The important distinction here is that the user did not request the effects, so therefore cannot be held accountable for them."
But giving them to a responsible journalist for whistle-blowing purposes is not a crime. It's a public service.
In this case there is no crime. And I repeat this again, AT&T was behaving like http://www.mailinator.com/
Don't you think that the consequences should depend on what the action actually accomplished, rather than the action itself? Flicking a lighter is generally pretty innocuous, but if done to light a house on fire, it means it's a bit different - right?
Yes, it's their fault too for leaving it open, but you had a choice when you decided to access it N000 times, rather than saying "oops, that does something bad, I think I'll stop".
I don't think the punishment fits the crime in this case, but I don't think he's entirely innocent either. Once you've shown that someone stupidly left their door open, the polite thing is to let them know, rather than walking around in their house looking at all their things to show them the error of their ways. IMO a fine would more than suffice as a punishment, though.