Spot a computer bug, go to jail

In a case with implications for security experts everywhere, who conduct "ethical hacking" in order to test the defences of websites and then report on the weaknesses, so that a fix may be found, on April 28, 2006, Eric McCarty was arraigned in U.S. District Court in Los Angeles. McCarty is a professional computer security consultant who noticed that there was a problem with the way the University of Southern California had constructed its web page for online applications. A database programming error allowed outsiders to obtain applicants’ personal information, including Social Security numbers.

For proof, the man copied seven applicants’ personal records and anonymously sent them to a reporter for SecurityFocus. The journalist notified the school, the school fixed the problem, and the reporter wrote an article about it. The school then, rather than simply fix the problem, got on to the FBI.

Read the full story (Wired)