In a world of ever increasing numbers of internet connected devices people are having more and more of their appliances exposed to the outside world: cameras, fridges, thermostats etc.

Many of these are left with the default passwords enabled and are easily searchable on websites such as Shodan.

My question is this, is it legal to access such a device for the sole purpose of determining if the default credentials have been used so that you can alert the owner of this security vulnerability?

For instance: by default, a Raspberry Pi has SSH enabled with the login pi and password raspberry.

I'm particularly interested in the take on this in the UK and any precedents.


1 Answer 1


In almost all jurisdictions unauthorised access to a computer is against the law. In most of these the definition of "computer" is sufficiently broad to encompass anything with WiFi access and unauthorised means without the owner's permission.

Using a default password is similar to using a default code on a combination door lock - it's really foolish but it's still a legal signal that access beyond it is unauthorised.

  • Is it not relevant that the intent is not to cause harm?
    – user175
    Jan 25, 2017 at 13:18

You must log in to answer this question.