Charges Dropped Against Student Who Alerted University To Security Flaws

from the don't-hack-and-tell dept

Last year, we wrote about a student at Carleton University in Canada who was arrested for hacking, after he wrote up a 16-page paper telling the school how poor its computer security was, and had some suggestions on how to fix it. It does sound like, in the process of figuring this out, the guy did hack into some accounts to prove that the vulnerability was there -- but there doesn't seem to be any evidence that he did anything with the access. And the fact that he wrote up a detailed paper on it and alerted the university certainly suggests his intentions were benevolent. So it was a bit disturbing that he was arrested. However, Allan Lussier-Meek writes in to let us know that charges against the guy were recently dropped after he agreed to go through a community service program. It's still not entirely clear why he needed to do that. This really does seem like blaming the messenger.

Filed Under: carleton university, hacking, security flaws

Student Charged With Crime For Telling University Officials About Security Hole

from the blame-the-messenger dept

For many years, we've covered case after case after case after case after case after case after case of people being blamed, arrested or even jailed for pointing out a security flaw. It should come as no surprise that many security researchers claim that it's just not worth it to research security vulnerabilities, since the risk is just too high.

It doesn't seem like those on the other side are getting the message just yet. Slashdot points us to the latest example, where a student at Carleton University has been arrested and charged with computer hacking after discovering a vulnerability and writing up a 16-paged paper to tell university officials about the vulnerability. A criminal doesn't write up a huge paper telling officials how to fix their problems. This just scares off people from telling universities that their systems are insecure. Remember, a few years back in Ohio there was a similar situation, with the whistleblower blamed -- and then the school didn't bother fixing the vulnerability, leading to more info being leaked.

Filed Under: blame, carleton university, hacking, white hat