Referring to no one and no incident in particular, imagine that some individuals, interested in performing a social/technical experiment, designed some changes to an open source project, knowing that their changes would cause security vulnerabilities in the product. They then requested the maintainers of the project incorporate these changes into the product (using the standard mechanism by which dozens of such requests are made daily), giving no indication of the security problems. The perpetrators main intent was not to introduce bugs into the final product and there is no indication that they had intent to exploit these bugs; rather, they intended to experiment with the change submission system and procedures. However, the bugs' introduction was a deliberate and predictable side-effect of their actions that they took no measure to prevent.
Did these individuals commit a crime? Are they civilly liable for the damages caused by the resulting security vulnerabilities?
In this theoretical question, the perpetrators are located in MN, US, and the open source project is based in CA, US.