It probably would have been best to just notify Winzip.

Telling the FBI you broke into a server to see if you could, and that you found that someone else had also broken in before you is just plain stupid.

Bank robber calling the cops to report the safe has already been cleaned out...

It's a safe cracker calling the cops in this scenario. "I wanted to see what banks I could break into" is a much more reasonable defense in this situation seeing as he's alerting others to the intrusions when he clearly could have just kept quiet and stayed out of trouble.

Not that it says anything about whether he'll be in legal trouble. Laws are crazy.

You poke into someone's house when you see their front door wide open, see it has been cleaned up and then notify the cops...

That would imply OP had malicious intentions, which he apparently did not.

Malice is in the eye of the beholder. He logged into a server he didn't own and ran commands without authorization. That is malicious from the perspective of the law.

Out of curiosity, wouldn't this also apply to the security researcher at erratasec.com that did an earlier survey? That scan logged into peoples boxes and executed a ping going out. Now obviously there isn't any damage, but what legal theory is protecting these legit security researchers?

Really this a question that can only be answered by a judge.

The CFAA in the US might apply, section a.2.c bit is pretty broad: information from any protected computer). The wikipedia article is full of interesting bits and bobs: http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

Though whether or not a DA would be bothered with investigating and building a case is a different story (probably not, unless there were lots of complaints and/or "serious" complaints).

I strongly doubt anyone, even at the FBI, is tasked with finding hackers independent of any complaints.

Nothing is protecting them legally, and many people mentioned similar things on those threads. However the fact that this guy sent himself reverse shells and actively exploited the servers makes it much more likely that someone will try to prosecute him.

The lack of anybody attempting to prosecute them.

If you walk into my house through the backdoor you're trespassing. Your intentions are irrelevant.

Intention is relevant. What if I was mentally ill and mistaken your backdoor for my own? Or it was was the only feasible escape route from a murderer that was in pursuit of me? Of course this doesn't apply directly to the OP, because this house analogy doesn't hold water. BUT, intent is very relevant when it comes to law.

Well, no, intention is not relevant in the sense that these people are still trespassing. Ok though, you have a point; in some extremely rare circumstances it may make a difference. Of course, as you said, none of these apply here, so what's your point?

Only good to a certain extent, and since hackers are often easy targets and successful computer prosecutions are a good feather in the cap of prosecutors ever more concerned about having something on their resumes related to the "cybersecurity" buzzword, they'll frequently get harsh sentences.

Weev got 3.5 years and also did nothing malicious with the data he found: http://www.wired.com/2013/03/att-hacker-gets-3-years/

I think intention is important in these cases, more than what you actually did.

He did not break there to make himself rich or to cause any trouble for the server owner; quite the contrary.

The prosecution and charges brought against Aaron Swartz would lead me to believe that you are quite wrong.