This is good advice, I think, but without getting into a lot of details, (3) is probably not going to be useful to Scott.

If it were me (it isn't, so again, grain of salt), gentle contrition and hard-earned wisdom would be the narrative I'd apply. He's got nothing to beat himself up over, but the message he probably wants to send to employers is "that sucked, not ever doing that again".

Hmm I may have misunderstood - I thought he was working for the vulnerable site as opposed to reporting it publicly (and presumably disclosing how he found out)

I am overly cautious on public records that are not obviously favourable to oneself - certainly have an attitude of juvenile regret, but I would be tempted to look at this area closely. But it is certainly a long term thing and will not help getting a job now.

What seems to have happened in this case is that Arciszewski stumbled unawares into what is in fact a cut-and-dried CFAA violation. Contrary to extraordinarily widespread and dangerous popular belief, it is not lawful to test random sites on the Internet for security flaws. It is unlikely to ever be lawful to actively exploit flaws on sites without permission. Arciszewski POC'd a serious vulnerability on a site, and had the misfortune and poor judgement to do so during the middle of a huge law enforcement shitstorm.

If that happens to you, I think the impression you don't want to create is that you vigorously contest the criminality of your actions. That impression comes freighted with the concern that you might think exploiting vulnerabilities without permission in order to make a point on Twitter is a good idea. That concern is, to many employers, both valid and relevant.

Instead, I think you want to create the impression that you've learned that the standards are strict for not messing with other people's systems without permission. And that you've learned better than most other professionals that systems in production are not to be trifled with out of process. And thus that of all the people a firm could hire, you're among the least likely to cause outages and disruption by making dumb out-of-process changes.

For whatever it's worth: if you want Exhibit A for why I don't have a lot of sympathy for people involved in "Lulzsec": breaking into sites and circulating credit card numbers and dumping databases created a set of circumstances that law enforcement absolutely had to respond to, and that's what sets up the crossfire that undisciplined but well-intentioned bug hunters get caught in. The people who go beyond doc'ing vulnerabilities to dump databases and take down sites are in some sense ruining things for everyone else.

Your description of the events seems overly mild to me.

I read that he POC'd a site, and then disclosed it the same day to @lulzsec.

The latter is what got him the felony, but you make it seem like the former or his timing was the problem.

The FBI agents said if I had done it six weeks prior, they wouldn't be arresting me they'd be saying "Don't do it again."

In fairness, lulzsec did morph from "security research group tired of waiting for site operators to protect their users" to "blackhat hacker collective".

The timing was a major problem. If you do have to defend yourself, I think saying you misjudged the nature of lulzsec is a defensible thing to say.

Hmmm - yes I was under that impression (although I do know the UK equivalents are similar) I just think back to the Citibank URL incident.

Re: jcampbell - I can't reply direct yet, but I am not sure that it is illegal to tell people how to pick a lock in the UK, even if you shout it out in some of the rougher pubs in the East End. It's just illegal to "go equipped".

I guess how the law is, and how the law would be under a sensible compromise is the OPs problem.

So, poor timing, poor choice of people to reveal it to.