Most laws against "hacking" have some section that defines hacking with various levels of specificity, but at the end it always some generic statement that allows them to prosecute anyone for anything. Something along the lines of "using a system to gain inappropriate access to information", or even just "usage of a system for purposes other than it's intended use".
Wasn't there a news story recently about a student that accidentally found a file with personal info available from his school's libary computer, and was subsequently arrested when notifying the administration?
I think that's the disease of security researchers - thinking that Average Joe will give a shit. Average Joe's got more interesting thing to do than some hypothetical threat - unless the threat actually occurs, in which case he'll start shooting the messenger.
The first part of the operation involves getting a target's cell phone number from a public database that links names to numbers for caller ID purposes. DePetrillo used open-source PBX software to spoof the outgoing caller ID and then automated phone calls to himself, triggering the system to force a name lookup.
Uh, oh. And the rest does not look good either - the attack looks credible (the tracking bit looks legally iffy).
the hands of GSM providers in the U.S. are tied.
Just today was talking with a lawyer who's reviewing data protection legislation, vs. mandated (by EU regulations) information disclosure requirements. There may not be a way of reconciling both ...
