There is a case in the news where a journalist identified a security issue in the web site of the Missouri Department of Elementary and Secondary Education that exposed 100,000 social security numbers. He did this by viewing the source of the page, using the f12 hotkey or right-click and selecting "Inspect" or "View page source" depending on your browser. When he made this discovery he disclosed the vulnerability to the DESE, and delayed publishing an article on the discovery until the department removed the vulnerability and worked to find if any other related sites and applications contained similar vulnerabilities.
The response of the Missouri Governor Mike Parson was to accuse the reporter of hacking under Section 569.095, RSMo. While the County Prosecutor has announced no charges would be filed this has involved four months of harm to the individual and their family and the Governor maintains that Renaud had unlawfully hacked the school website.
A somewhat similar case is the 2017 case of the Hungarian teenager who identified a bug in the Budapest Transport Authority (BKK) website that allowed anyone to set the price of a ticket. He demonstrated the flaw by buying a ticket, and told the BKK by email. He was arrested. He lived outside of Budapest and could not use the purchased BKK pass.
There are four aspects that seem to me could give rise to legal risks, but I have no idea if any could reasonably give rise to successful charges in cases such as this:
- Use of developer tools on third party web sites
- Decoding the data within the web site
- Handling of potentially erroneously exposed PII
- If one comes across personally identifiable information (PII) on the internet I would assume there are things you can do that are illegal. I am not sure what they are, but I do know that the accepted way to handle security issues in software is to inform the organisation responsible and wait an appropriate time before publishing the issue. This is roughly what the reporter did in this case, but are there any specific legal measures that one can take in such situations to ensure one is not breaking any laws?
- Fraudulently gaining something
- If one actually exploited a software error to get a material benefit, such as cheap transport, it seems that one could be committing fraud. If one makes a purchase to demonstrate a flaw and tell the organisation about it without making use of the purchase can this be illegal, or does one need to intend to actually gain a benefit?
Any jurisdiction would be interesting, particularly any that has actual case law of such actions being found to be illegal.